Legal
Privacy policy
Last updated: 13 June 2026
This policy describes how BackendFlowAgency S.L. (trading as BackendFlowAgency, "we", "us") collects, uses and protects personal data when you visit backendflowagency.com (the "site") or engage us for services. We are the data controller for any personal data you provide.
1. Who we are
- Trading as: BackendFlowAgency S.L.
- Trading address: C. Manuel Benítez "El Cordobés", 6, Poniente Sur, 14005 Córdoba, Spain
- Company registration: CIF: B-87412034
- VAT: ES B87412034
- Contact: text@backendflowagency.com · +34 957 41 16 67
2. The data we collect
We collect personal data when you submit a contact form, start a checkout, sign up to a Care Plan, or correspond with us by email or phone.
| Data | When collected | Why we hold it |
|---|---|---|
| Name (first & last) | Contact form, checkout, project intake | To address you and identify the engagement |
| Email address | Contact form, checkout, billing | To reply, send proposals, issue receipts/invoices |
| Phone number | Contact form, checkout | To call you when email isn\'t the right channel |
| Country & billing address | Checkout, invoicing | To determine VAT obligations and produce a valid invoice |
| Company / project name | Contact form, project intake | To understand context and tailor our reply |
| Message contents | Contact form, correspondence | To respond and to retain a project record |
| Payment metadata | Checkout via Stripe | To verify and reconcile a payment (we never see card numbers) |
| Server logs (IP, user-agent, timestamp) | Every request | Security, abuse prevention, debugging |
| Client codebase access (if applicable) | During engagement | To perform the contracted work; revoked at project close |
3. Lawful bases for processing (GDPR art. 6)
- Contract — to perform a contract with you or take steps before entering one.
- Legitimate interests — security logging, fraud prevention, responding to enquiries.
- Legal obligation — to retain invoicing records under Spanish tax law (typically six years).
- Consent — for the optional analytics cookie.
4. Sharing data with third parties
- Stripe Payments Europe, Ltd. — payment processing.
- EU-based hosting provider — server logs and data submitted via the site.
- Email provider — sending and receiving correspondence.
- Accountant — receives invoice records for tax filing.
- Client infrastructure (during engagement) — only for the purpose of the contracted work.
5. International transfers
Your data is processed inside the European Economic Area. Where a processor operates infrastructure outside the EEA (Stripe is the primary example), the transfer is governed by Standard Contractual Clauses approved by the European Commission.
6. How long we keep data
- Contact-form messages with no follow-up: 12 months.
- Active project records: project duration + 24 months.
- Invoicing records: 6 years (Spanish tax law).
- Server logs: 30 days.
- Client credentials and codebase access: revoked at project close, removed from our password manager within 30 days.
7. Your rights
Under the GDPR you have the right to access, correct, erase, restrict, object to, and port your data, and to lodge a complaint with the Spanish supervisory authority (www.aepd.es). To exercise any of these: email text@backendflowagency.com. We respond within 30 days.
8. Security
The site is served exclusively over HTTPS. Sessions are signed and HTTP-only. Backups are encrypted and rotated weekly. Access to project records is limited to the four people in the studio. We do not store payment-card data on our servers; that is handled entirely by Stripe. Client credentials live in a password manager with end-to-end encryption and required two-factor authentication.
9. Cookies
Cookie use is described separately in the cookie policy.
10. Data Processing Agreement (DPA)
Where an engagement involves processing personal data of your end users, we sign a GDPR article 28 DPA at kickoff. We have our own template and will sign yours if it\'s reasonable.
11. Changes to this policy
If we change how we handle data we\'ll update this page and adjust the "last updated" date. Material changes are communicated by email to active clients.
12. Contact
Questions, requests or complaints: text@backendflowagency.com or by post to C. Manuel Benítez "El Cordobés", 6, 14005 Córdoba, Spain.