Privacy Policy

1. Who is responsible for your data

Solar Master (in process of incorporation as a limited company — target May 2026). Until then, your data is managed by Julio Valderrama in his capacity as a self-employed professional, on behalf of the future company.

• Contact email: info@solar-master-malaga.com
• Operating base: Málaga, Andalusia, Spain
• Tax ID (NIF): available on request via the email above

2. What data we collect

Only the data you give us voluntarily when contacting us. When you fill the contact form or use the calculator:

• Name (required so we can address you)
• Phone or WhatsApp (required so we can contact you)
• Postal code (5 digits, to confirm service area)
• Email (optional, only if you want a written copy)
• Message (optional, context of your enquiry)
• Calculator data if you arrive from there (estimated kWp, approximate bill, municipality) — always pre-filled, never collected without explicit action from you

We do NOT collect: full postal address, ID document number, banking data, salary, or any data you have not actively given us.

3. What we use it for

Your data is used exclusively to:

• Reply to your enquiry
• Schedule the free technical visit if you request it
• Prepare the indicative quote
• Maintain contact during the commercial process

Legal basis for processing:

• Explicit consent (GDPR art. 6.1.a) — by ticking the consent checkbox on the form
• Performance of pre-contractual measures (GDPR art. 6.1.b) — to prepare your quote

4. How long we keep it

Your data is kept for 24 months from your last contact. After that period, it is permanently deleted — unless the commercial relationship is still active or the law requires a longer period (for example, installation warranties for 25 years).

If the enquiry does not result in a customer, we delete the data after 12 months without contact.

5. Who we share it with

We never sell your data, nor do we hand it to data brokers or competing installers.

It is processed, in technical infrastructure only, by the following providers strictly necessary for the website to operate:

• Cloudflare, Inc. (USA, adhered to EU Standard Contractual Clauses) — website hosting and CDN delivery
• Resend (USA, SCC) — transactional email when we reply to your enquiry
• Sentry (USA, SCC) — technical error monitoring (anonymised, no personal data)

For marketing purposes, the only planned data sharing is Google Ads conversion measurement (with Google Ireland Limited, acting as an independent controller) and only if you accept advertising cookies; we explain this in section 8 ("Cookies and similar technologies"). We do not build cross-site behavioural profiles, and remarketing stays switched off unless you expressly opt in.

6. Your rights

The GDPR grants you the following rights over your data:

• Access — to know what data of yours we hold (art. 15)
• Rectification — to correct inaccurate data (art. 16)
• Erasure — to delete your data (art. 17, "right to be forgotten")
• Objection — to oppose a specific processing (art. 21)
• Restriction — to temporarily restrict use (art. 18)
• Portability — to receive your data in structured format (art. 20)
• Withdraw consent — at any time, without affecting previous lawful processing

To exercise any of these rights, send an email to info@solar-master-malaga.com with subject "GDPR Rights" and a copy of your ID (or equivalent document to verify you are the data subject). We respond within one month.

7. Complaints to the AEPD

If you consider that your data protection rights have not been respected, you may file a complaint with the Spanish Data Protection Agency (AEPD) — the independent supervisory authority.

Before doing so, we appreciate you contacting us first at info@solar-master-malaga.com: most issues are resolved without need for a formal complaint.

8. Cookies and similar technologies

A cookie is a small file a website stores on your device. By default we only use the strictly necessary ones; any non-essential cookie — such as advertising cookies — requires your prior consent (art. 22.2 of Spain's LSSI-CE and art. 6.1.a GDPR).

Status as of this update: the site uses only technical cookies and privacy-first web analytics. We do not yet load any advertising cookie. The Google Ads measurement described below will be switched on when we launch our campaigns, together with a consent banner, and will only work if you accept it.

Types of cookies

• Technical or strictly necessary (always on, exempt from consent): session and language preference. The site does not work without them.
• Analytics (cookieless): Cloudflare Web Analytics sets no cookies on your device and measures in aggregate and anonymous form — no personal identification, no cross-site tracking and no capture of personal data. Being cookieless and identifier-free, it is exempt from consent (art. 22.2 of Spain's LSSI-CE).
• Advertising and conversion measurement (Google Ads) — consent required, off by default. Its sole purpose is to measure whether a visit arriving from one of our Google ads ends in a contact request, so we can tell whether our advertising works. Once enabled and accepted, it will set first-party cookies of the _gcl_* family (for example _gcl_au and _gcl_aw) lasting up to 90 days. These cookies are not installed unless you accept them.

Consent and Google Consent Mode

We will use Google Consent Mode v2: by default, advertising storage is set to "denied" for users in the European Economic Area. That means no advertising cookie will be installed and no advertising data will be sent to Google until you accept that category in the consent banner we will add. If you reject it — or simply do not accept — it stays off. Continuing to browse, scrolling or closing that banner will not count as acceptance. Personalised advertising and remarketing stay switched off unless you expressly authorise them.

If you refuse cookies, Google may still receive anonymous, cookieless "pings" — with no identifiers or personal data — used only to estimate conversions in aggregate.

Who receives this data and international transfers

The recipient of the advertising measurement is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), acting as an independent controller of that data, not as our processor. Google may process it in the United States through Google LLC; that transfer relies on the EU-U.S. Data Privacy Framework (to which Google LLC is certified) and, failing that, on the European Commission's Standard Contractual Clauses (art. 46 GDPR). You can read how Google handles this data in its privacy policy and its advertising cookies page.

How to manage or withdraw your consent

When we launch advertising measurement, the cookie banner will let you "Accept", "Reject" or "Configure" each category at the same level — rejecting will be as easy as accepting, with no pre-ticked boxes — and you will have a permanent "Cookie settings" link to change or withdraw your choice at any time, as easily as you gave it. You can also delete cookies from your browser and manage your ad preferences at Google's ad settings. We will ask for your consent again periodically (at most every 24 months).

What we do not do: we do not use Google Analytics, Facebook Pixel, heatmaps that capture personal data, or sell your information to third parties.

9. Changes to this policy

This policy may be updated when applicable laws, technical providers or company operations change. When we make substantial changes, we will update the date in the header and notify users with active relationships by email if we have their contact.

Minor changes (typographical, wording) are not explicitly notified.

10. Pre-SL disclosure

Solar Master will be incorporated as a limited company (SL) with target date May 2026. Until then, operations are managed under self-employed regime. When the company is formally incorporated, this policy will be updated with the official tax ID, registered address, and, if applicable, designation of Data Protection Officer (DPO).

This transparency is deliberate: we prefer to publish the real state of the company rather than simulate a legal infrastructure that does not yet exist.