Privacy policy

01Data controller

Owner

Francesco Junior De Liso

Legal status

Natural person (sole trader)

Trading name

AMPERSAND

Tax ID (NIF)

Y5817122E

Address

Calle Domingo J. Navarro, n.º 1, Planta 2, Oficina 5, 35002 Las Palmas de Gran Canaria (Las Palmas), Spain

Email

hello@ampersandweb.com

Website

www.ampersandweb.com

For any question about your data, write to hello@ampersandweb.com. We have not appointed a data protection officer because, given the type and volume of our processing, we are not required to (Article 37 of the GDPR and Article 34 of the LOPDGDD).

This policy is based on Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR); Spanish Organic Act 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD); and Spanish Act 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).

02In a nutshell

• We only ask for the data we need to do what you ask of us: reply to your request, prepare your design, take payment and invoice you.
• We do not sell your data or pass it on to anyone for commercial purposes.
• We only send you marketing emails if you subscribe by ticking the consent box; every email includes a one-click unsubscribe link.
• Payments are processed by Stripe: we never see or store your card number.
• Analytics cookies (Google Analytics) and advertising cookies (Meta and Google Ads) are only activated if you accept them; rejecting them is as easy as accepting them.
• In our forms we don’t store your IP address in plain form: we use an encrypted fingerprint that changes every day. Your IP is only stored as proof of your consent when you subscribe.

03Booking requests

Data

Your names, email, approximate date and place of the wedding (or that you don’t have a date yet), the design and package you’re interested in, the language you’d like us to write to you in, your message, up to three favourite designs and, if you have one, your gift card code.

Purpose

To reply to you in writing, confirm availability, details and how to pay and, if you book, prepare the order. To curb abusive submissions, the server records the time of each submission together with an encrypted fingerprint of the connection (derived from the IP address with a secret key and renewed every day); the IP address itself is not stored.

Legal basis

Taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). The anti-abuse check is based on our legitimate interest in protecting the form (Article 6(1)(f)).

Retention

If you don’t go on to book, up to 12 months from our last communication. If you do, the request becomes part of your order file (see client area). Anti-abuse fingerprints can no longer be linked to a connection once the day changes.

04Online purchase and payment

Data

Your email; for packages, your names, the date and place of the wedding, design, package, language and message (and, if you provide one, a gift card code); the billing details you enter in the payment form (name, address and, if you add it, your tax ID or other tax number); and the transaction details: reference, amount, price applied, promotional code if you use one, date and status of the payment, the version of the terms you accept and your request for us to begin work within the withdrawal period.

Card and payment method

You enter your card details (or those of Apple Pay, Google Pay or any other method Stripe offers) directly into the Stripe form embedded in our page. They are processed by Stripe: we never see or store them; at most, we can see the card type and its last digits in the Stripe dashboard.

Purpose

To take payment, manage the order, send you the receipt and access to the client area, issue the invoice, handle incidents, withdrawals and refunds, and prevent fraud and abuse (a limit on payment attempts per connection, using the same encrypted fingerprint as for booking requests).

Legal basis

Performance of the contract (Article 6(1)(b) GDPR); compliance with legal accounting and tax obligations (Article 6(1)(c)); fraud prevention, on the basis of legitimate interest (Article 6(1)(f)).

Retention

For the duration of the contractual relationship and, afterwards, up to 6 years for accounting records and invoices (Article 30 of the Spanish Commercial Code), in addition to the periods set by tax legislation. If a payment is not completed, its record is deleted after 12 months at the latest.

Stripe acts as our payment service provider. For certain purposes of its own, such as fraud prevention or its legal obligations as a payment institution, Stripe processes the data as an independent controller under its privacy policy.

05Gift cards

Data

About the giver: name or signature, email, message for the couple, what is being given (a package or an amount, and whether the amount is shown), card finish and delivery method. About the couple receiving it: their names and, if you ask us to send it, their email and the delivery date.

Purpose

To prepare, charge for and issue the card, deliver it as you instruct and manage its redemption. The couple’s email is used only to deliver the card to them; if they later book with us, their data is then processed like that of any other client.

Source of the couple’s data

It is provided by the giver, who undertakes to do so legitimately (normally because they know the couple and want to give them a gift). We inform the couple of this processing when we deliver the card.

Legal basis

Contract with the giver (Article 6(1)(b) GDPR); delivery to the couple, on the basis of our legitimate interest in fulfilling the gift order (Article 6(1)(f)); accounting obligations (Article 6(1)(c)).

Retention

While the card can be redeemed and until it is redeemed; afterwards, up to 6 years for accounting records. Requests that are never paid for are deleted no later than 12 months after our last communication.

You can buy a card by paying online (with Stripe, as in the previous section) or by sending us a request so that we can write to you with payment details: in both cases we process the same data.

06Client area and carrying out your order

Data

Your email and order code; the order details (the couple’s names, package, design, wedding date, status and website address); what you fill in on the questionnaire (names to display, date, times, ceremony and reception venues, the day’s schedule, your story, dress code, transport, accommodation, gifts, RSVP deadline, menus, languages, preferred domain, music, approximate number of guests and notes); the photos and documents you upload; the messages we exchange; and an activity log (logins, changes, uploads) with the session and browser you use.

Purpose

To provide the service you have contracted: to gather the information and materials, design, review with you, publish your website, notify you by email of updates to your order and protect access (attempt limits using encrypted fingerprints, secure sessions).

Legal basis

Performance of the contract (Article 6(1)(b) GDPR). Access security is also based on our legitimate interest (Article 6(1)(f)).

Retention

For as long as the order lasts and your website is live (up to 12 months after the wedding). We then delete photos, documents, the questionnaire and messages within 3 months at most, except for anything we must keep blocked because of a legal obligation or to deal with possible claims (Article 32 of the LOPDGDD). You can ask us to delete any file sooner.

Photos and the people in them. We store photos exactly as you upload them, with their metadata (which may include the date or place they were taken); if you don’t want to share it, remove it before uploading. If other people appear in your photos or texts, please only share them if you have their permission; don’t upload sensitive data that isn’t needed for your website.

07Your wedding website and your guests

On your wedding website, guests can RSVP and leave details such as their name, plus-ones, menu choice or allergies and intolerances. Sharing allergies or intolerances is always optional for the guest, and that information is used only to plan the menu with the caterer. You, the couple, are the controllers of that data: the studio processes it solely on your behalf, as a processor, to host the website and prepare your guest dashboard, in accordance with Article 28 of the GDPR and the terms and conditions.

If you are a guest and wish to exercise your rights, please contact the couple. If you write to us, we will pass your request on to the couple and help them deal with it.

08Subscription and welcome code

Data

Your email; your language; where you subscribed from (the website pop-up, the footer or another form) and the page; the interests you select; the status of your subscription (active, client or unsubscribed); proof of your consent (date and time of sign-up and, where applicable, of unsubscribing; versions of this policy and of the promotion terms, a fingerprint of the text accepted and how you gave it, by ticking the box; language, source, page, IP address and browser); if you use the promotional code, the email address you pay with, the order reference and the amount before and after the discount (to apply the one-use-per-couple rule); and the emails sent with their status (delivered, opened, clicked, bounced or complaint) when Brevo reports it to us.

Purpose

To send you your welcome code and a series of emails with ideas, designs, studio news and reminders about your code — around twenty emails spread over about four months, never more than one a day — in your language and according to your interests; to send fewer if you don’t open any for a while; to stop sending you the welcome series once you book; and to be able to prove that you gave us your consent.

Legal basis

Your consent (Article 6(1)(a) GDPR and Article 21 of the LSSI-CE), which you can withdraw at any time without affecting prior processing. Keeping proof of consent and the unsubscribe list responds to the obligation to be able to demonstrate consent (Article 7(1) GDPR) and to our legitimate interest in respecting your decision to unsubscribe (Article 6(1)(f)).

Retention

Until you unsubscribe. After you unsubscribe, we keep proof of consent and of unsubscribing for up to 3 years (the limitation period for infringements of the LSSI-CE) and an encrypted fingerprint of your email so that we don’t write to you again. The sending history is kept for up to 24 months.

Opens and clicks

Emails are sent through Brevo, which may include a tiny invisible image (a pixel) that records whether they are opened, and links that pass through its server to record clicks. We use this to understand which content interests you and to send you fewer emails if you don’t open them, and it is part of what you agree to when you subscribe. You can prevent it by turning off automatic image loading in your email app; it stops when you unsubscribe. The links also carry parameters that identify the campaign (for example, “utm_source=brevo”) and, where relevant, your promotional code so that it is applied at checkout.

How to unsubscribe

Use the “Unsubscribe” link in any email (a single click), the unsubscribe option in your email app, or write to us at hello@ampersandweb.com. You will then receive no further marketing emails; to start receiving them again, a new consent would be needed. Emails about an order you have placed are not marketing emails and will keep arriving for as long as the order lasts. If someone subscribes an email address that isn’t theirs, its owner can unsubscribe with a single click from the welcome email itself, as from any other.

If you book with us, we stop sending you the welcome series. We do not send marketing communications to clients who have not subscribed.

09Reviews

If you leave a review on our website, we process the following data to publish it and to check whether you are clients.

Data

Your names, as you write them; your email; your rating, text and language and, if you tell us, your design or package; the date; and proof of your consent (date and version of the text you accepted). To stop automated submissions we keep, for one day at most, an encrypted fingerprint of the IP address and the email, never the IP itself.

What is published

Only your names, rating, text, the design or package if you give it, the date and, where applicable, the “Verified” mark. Your email is never published: we only use it to check whether it matches a paid order and, if needed, to write to you about your review.

Purpose

Publishing reviews on our website, checking whether they come from clients and moderating them (removing those containing insults or personal details, or that have nothing to do with AMPERSAND).

Legal basis

Your consent to publish your names and text (Article 6(1)(a) GDPR), which you can withdraw at any time by asking us to remove the review. Verification and moderation rely on our legitimate interest in offering genuine reviews (Article 6(1)(f)) and on our duty to explain how we verify the reviews we publish.

Retention

While the review is published. Reviews that are removed or never published are deleted once no longer needed and within 12 months at most.

To remove or correct your review, write to hello@ampersandweb.com from the email address you sent it with.

10Measurement and advertising with Meta

We may use the Meta pixel to measure the effectiveness of our ads on Facebook and Instagram and to show them to people who may be interested. It only loads if you accept marketing cookies and only while the studio has it switched on; if you don’t accept them, nothing from Meta is loaded.

Data

The pages you visit and certain events: viewing a design, subscribing, starting a payment (with its amount) and completing a purchase (with its amount and reference); as well as your IP address, technical data about your browser and device, and Meta’s cookies (see the cookie policy). If you are logged in to Facebook or Instagram, Meta may link this data to your account.

Legal basis

Your consent (Article 6(1)(a) GDPR and Article 22(2) of the LSSI-CE), which you can withdraw at any time from the cookie settings.

Responsibility

We are joint controllers with Meta Platforms Ireland Ltd. for the collection and transmission of this data through the pixel; any further processing is determined by Meta as controller, under its privacy policy.

We do not send Meta any data from our server (the Conversions API is switched off), nor do we give it your email.

11Analytics and ad measurement with Google

If you accept analytics cookies, we use Google Analytics 4 to understand, in aggregate, how many visits the website gets and how it is used. If you accept marketing cookies, we also use the Google Ads tag to measure which AMPERSAND ads on Google lead to sign-ups and bookings. Without your consent nothing from Google is loaded, not even its tag (Google consent mode, basic implementation).

Data

The pages you visit and certain events: viewing a design, subscribing, starting a payment (with its amount) and completing a purchase (with its amount and reference); as well as a random identifier stored in Google’s cookies (see the cookie policy), technical data about your browser and device, and your approximate location (country or city). Google Analytics does not log or store your IP address. If you arrive from a Google ad, also the identifier of that click.

Legal basis

Your consent, given separately for analytics and for marketing (Article 6(1)(a) GDPR and Article 22(2) of the LSSI-CE), which you can withdraw at any time from the cookie settings.

Google’s role

For Google Analytics, Google Ireland Ltd. acts as our processor, under its data processing terms. For Google Ads conversion measurement, Google acts as an independent controller, under its privacy policy. We have switched off Google signals and ad personalisation based on analytics data.

Retention

We have set Google Analytics to keep user and event data for 14 months; after that it is deleted. Cookies last as stated in the cookie policy.

Transfers

Google may process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework and also relies on the European Commission’s standard contractual clauses (see international transfers).

We do not send Google any data from our server, nor do we give it your name or email.

12Contact by email or social media

If you write to us at hello@ampersandweb.com or message us on social media, we process the data you give us in order to reply, on the basis of our legitimate interest in dealing with your enquiry or, if it concerns a booking, as a pre-contractual step (Article 6(1)(f) and 6(1)(b) GDPR). We keep the conversation until it is resolved and then for up to 12 months, unless it forms part of an order. On social media, the platform’s own policies also apply.

13Technical logs and cookie-free statistics

Like any server, our hosting provider’s server logs technical data about each visit (IP address, date and time, page requested, browser) for the operation and security of the service, on the basis of legitimate interest (Article 6(1)(f) and Recital 49 GDPR). The provider keeps these logs for a limited time and we do not use them to identify you.

To know how often the subscription pop-up is shown and closed, the website sends our server only a count, with no cookies, no identifiers and without storing the IP address: daily totals are added up and they do not reveal who saw it.

14Recipients and processors

We do not disclose your data to third parties except where required by law (for example, to the tax authorities or to courts and tribunals when they require it). To provide the service we rely on the following providers, under a data processing agreement or on the terms indicated:

15International transfers

We choose providers that process data within the European Economic Area. Some belong to groups headquartered in the United States (Stripe, Meta, Google and, where applicable, Microsoft), so data may be accessed from there. According to the information they publish, these companies are certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, in addition or failing that, rely on the standard contractual clauses approved by the Commission (Article 46 GDPR). You can ask us for more information about these safeguards by writing to hello@ampersandweb.com.

16How long we keep data

After these periods we delete or anonymise the data. While it has to be kept solely because of a legal obligation or to deal with claims, we keep it blocked (Article 32 of the LOPDGDD).

17Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time and free of charge, and withdraw any consent you have given us (without affecting the lawfulness of prior processing). We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you.

Write to hello@ampersandweb.com (or by post to the address shown above) stating which right you wish to exercise. We will only ask you to prove your identity if we have reasonable doubts about it. We will reply within one month, which may be extended by two further months in complex cases (we would let you know).

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es), or with the supervisory authority of the EU country where you live.

18Minors

Our services and our subscription are intended for adults. If you are under 18, please do not send us your data or subscribe. If we learn that we have received data from a minor without the necessary authorisation, we will delete it.

19Security

We apply technical and organisational measures appropriate to the risk: encrypted connection (HTTPS); requests, orders, files and database stored in private folders on the server, inaccessible from the web; access to the client area with a personal code and secure sessions; studio dashboard protected by a strong password and two-step verification; encrypted fingerprints instead of IP addresses; passwords and keys kept outside the website code; and access to data restricted to the owner. Should a security breach affecting you occur, we would act as required by Articles 33 and 34 of the GDPR.

The photos and documents you upload to the client area can only be downloaded with your session or the studio’s. You can help too: don’t share your access code.

20Changes to this policy

We may update this policy when our processing or the law changes. The version and the date of the last update are shown at the top. If the change is significant and we have your email as a client or subscriber, we will let you know. When the version of the policy changes, we ask you about cookies again.