This policy describes how the provider processes the personal data of its own prospects and customers. Processing of the data a customer enters into the application about their clients is governed by the Data Processing Agreement; there the provider acts as processor, not as controller.
1. Controller
Marco Lohmann, newways.consulting, Carrer de Monsenyor Palmer 1, 07014 Palma de Mallorca, Spain. Email: mlo@newways.consulting.
No data protection officer has been appointed, as none of the cases in Art. 37 GDPR or Art. 34 LOPDGDD applies.
2. Processing activities
a) Visiting the website
On access, the IP address, date and time, the page requested, the response code and the browser used are logged automatically.
- Purpose: secure operation, detection of attacks, fault analysis.
- Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
- Retention: 14 days; in the event of an incident, until it is resolved.
Fonts and the provider’s own resources are loaded from its own server. A technically necessary session cookie is used for sign-in and forms. Optional advertising measurement (point f) and the provider’s own booking statistics (point g) have separate consent choices and can be declined or withdrawn independently.
b) Booking the service
Processed: company name, contact person, email address, telephone, postal address, VAT number, plan chosen, together with the IP address and time of booking.
- Purpose: formation and performance of the contract, verification of business status, evidence of acceptance of the terms.
- Legal basis: Art. 6(1)(b) GDPR; for VAT number verification and retention of the acceptance record, Art. 6(1)(c) and (f) GDPR.
- Retention: for the duration of the contract and thereafter in line with commercial and tax periods (6 years under the Spanish Commercial Code, 4 years tax limitation, counted from the end of the relevant financial year).
c) VAT number verification
The number provided is checked against the European Commission's VIES system. Only the number is transmitted, with no additional data. The result and its date are retained as evidence of the tax treatment applied.
d) Invoicing
- Legal basis: Art. 6(1)(c) GDPR (accounting and tax obligations).
- From the start of the obligation, invoicing records are transmitted to the Spanish tax administration under RD 1007/2023 (Verifactu).
e) Correspondence
Incoming messages are processed in order to answer them.
- Legal basis: Art. 6(1)(b) GDPR where related to a contract or its preparation, otherwise Art. 6(1)(f) GDPR.
- Retention: 3 years from last contact, unless a retention obligation applies.
f) Advertising measurement with Google Ads — booking pages only, consent only
If the provider advertises on Google, the booking pages may use Google Ads conversion measurement. In that case a consent question appears there first; without consent no Google code is loaded and nothing is measured — the pages work exactly the same. If measurement is not configured, no question appears either.
Only after clicking "Agreed" does the browser load Google's measurement script (gtag.js). It tells Google that the booking pages — including the confirmation page shown after a booking — were visited, together with the ad click identifier (gclid), technical browser data and the IP address; Google sets a cookie for this with a lifetime of roughly 90 days. The sole purpose is to know whether an ad click leads to a booking. No ad-personalisation signals are set and Google Analytics is not used.
- Purpose: measuring the effectiveness of the provider's own ads (conversion measurement).
- Legal basis: your consent — Art. 6(1)(a) GDPR and Art. 22.2 LSSI.
- Recipients: Google Ireland Limited (Ireland) and Google LLC (United States); on the third-country transfer see section 4.
- Retention: your answer to the question — yes or no — is stored in your browser (localStorage) so it is not asked on every page; it is not transmitted to anyone. The Google cookie expires after roughly 90 days.
- Withdrawal: at any time via the "Ad measurement" link in the footer of the booking pages — the question appears again, and a "No thanks" stops the measurement from that moment. The lawfulness of measurement carried out until then remains unaffected.
g) Own booking statistics — consent only
With your optional consent, the provider counts plan selections, form views, successful bookings and, for validation errors, the field name and error source (browser or server) on its own server. Input values, email addresses, IP addresses and visitor identifiers are not stored in these statistics. Only daily totals by plan, step and, where applicable, error field are stored. They help identify booking friction. No data is sent to an analytics service by this measurement. The technical access logs described in point a are separate.
The basis is your consent. Your choice is stored locally in your browser and sent to the provider for the current session. Without consent no measurement events are stored; booking remains fully available. You may change your choice at any time using “Booking statistics” in the booking page footer. Withdrawal stops further collection; totals already aggregated cannot be attributed to a person. Daily totals older than 90 days are deleted during daily housekeeping, on a new measurement event or when the report is opened.
h) Support, feedback and account setup
When you submit a support question, bug report or improvement idea, your message, selected area, application version, name and account are stored with the reply history. Please do not send passwords or confidential customer data. This information is used to answer your request and improve the service; the customer communication rules in point e also apply.
To help new accounts get started, the operator can see whether access has been set up, onboarding completed or skipped, and a first customer or quote draft created. This operational overview shows no customer or quote contents and includes no visitor profiles. It displays up to 200 newest accounts in a selected period of up to 90 days; underlying operational data remains subject to the deletion rules of your account contract.
3. Recipients
Data is passed only to those necessary to deliver the service: the hosting provider, the email provider, the tax adviser and, where applicable, the payment provider. These act as processors under an Art. 28 GDPR agreement — except the tax adviser and public authorities, which act as controllers in their own right.
The current list appears in the List of subprocessors.
4. International transfers
Hosting and email are provided within the European Union.
While the Assistant is switched on, every triggered analysis involves a transfer to Anthropic PBC (United States), based on standard contractual clauses. For accounts set up on or after 1 November 2026 this function is delivered switched on; accounts set up earlier keep their state. Switching it off is the customer's decision, sits under Settings → Assistant and takes effect immediately.
The same applies to dictation and read-aloud: while they are on, the recorded speech or the text to be read out goes to ElevenLabs Inc. (United States), likewise based on standard contractual clauses — but only once the dictation key is pressed or read-aloud is requested. Without a key, the customer's own or the provider's, that transfer does not take place.
If someone consents to advertising measurement on the booking pages (section 2 f), Google LLC (United States) also receives the data described there. Google LLC is certified under the EU-US Data Privacy Framework; the transfer relies on the European Commission's adequacy decision for that framework. Without consent this transfer does not take place.
5. Your rights
You may request access, rectification, erasure, restriction, portability and object to processing, and withdraw consent where processing is based on it. Please write to mlo@newways.consulting.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority where you live.
6. Automated decision-making
No decisions are taken based solely on automated processing that produce legal effects or similarly significantly affect data subjects. In particular, the Assistant proposes actions but does not carry them out by itself: every proposal requires confirmation by a person.
7. Necessity of providing data
The data requested at booking is necessary to form the contract. Without it the service cannot be provided.