Privacy Policy
Last updated: 8 November 2026
This Privacy Policy explains how SHEPHARD handles your personal data when you visit this website, fill in the contact form, or contact us by email, phone or instant messaging. We process personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Spanish Organic Law on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD, Ley Orgánica 3/2018).
1. Who is responsible for your data
The controller (Responsable del tratamiento) of your personal data is:
- Operator: SHEPHARD
- Email: [email protected]
- Phone: +34 617981368
For any question or request about your personal data, email us at [email protected] with “Data protection” in the subject line.
2. What data we process and why
| Activity | Data involved | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Website contact form | Name, email, company, company website, phone, job title, number of employees, and the description of your needs | Responding to your inquiry, understanding your needs, providing proposals and quotes, and arranging meetings | The consent you give when submitting the form (Art. 6(1)(a) GDPR) and steps taken at your request prior to entering into a contract (Art. 6(1)(b)) | Up to 2 years after your inquiry has been handled; if we start working together, for the term of the contract and any statutory retention period |
| Contact by email, phone or instant messaging | The contact details and communications you choose to provide | As above | As above | As above |
| Website operation and security | Technical logs such as IP address, browser type, time of access and pages visited | Keeping the website running properly, preventing attacks and misuse, and troubleshooting | Our legitimate interest in keeping the website secure (Art. 6(1)(f)) | Only as long as necessary, usually no more than 90 days, unless a longer period is needed to investigate a security incident |
The fields marked as required in the contact form are necessary for us to respond to your inquiry; without them, we cannot process your request. All other information is optional.
We do not sell or rent your personal data, we do not subject you to automated decision-making or profiling, and we do not send you marketing emails without your separate consent.
Maturity assessment tool: Your answers in the “Digital Maturity Assessment” are calculated only in your own browser. They are not sent to our servers, and we cannot see them.
Template downloads: You do not need to provide any personal information to download templates from this website.
3. Who has access to your data
- SHEPHARD team: Only colleagues who need to respond to or follow up on your inquiry can access the relevant data.
- Service providers (processors): For example, providers of website hosting, server and email services. They process data only on our instructions and for the purposes above, and are bound by data processing agreements.
- Competent authorities: Data is disclosed to courts, regulators or other competent authorities only when required by law.
4. Transfers outside the European Economic Area
The SHEPHARD team is based in Europe and China. If responding to your inquiry requires your data to be processed by colleagues or service providers outside the European Economic Area, we transfer it only where the recipient's country or region is covered by a European Commission adequacy decision, or where appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission. You can request information about these safeguards by emailing [email protected].
5. Your rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access: To know whether we are processing your data and to obtain a copy.
- Right to rectification: To correct inaccurate or incomplete data.
- Right to erasure: To request deletion of your data in the cases provided for by law.
- Right to restriction of processing: To request that processing of your data be suspended in certain cases.
- Right to object: To object to processing based on our legitimate interests.
- Right to data portability: To receive the data you have provided to us in a structured, commonly used and machine-readable format, or to ask us to transmit it to another controller.
- Withdrawal of consent: You can withdraw your consent at any time. This does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
To exercise these rights, email [email protected]. To protect your data, we may need to verify your identity. We will respond within one month of receiving your request; for complex or numerous requests, this may be extended by up to two further months, in which case we will tell you why.
If you believe we are not processing your data in compliance with the rules, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid. You are also welcome to contact us first, and we will do our best to resolve the matter.
6. Cookies and similar technologies
This website does not use analytics, advertising or social media tracking cookies, and does not embed third-party content that sets cookies on your device (such as external video players or maps). The website's fonts, images and videos are all served from our own servers. The social media icons on our pages are plain links; you leave this website only when you click them.
The only cookie this website uses is:
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| shephard_admin | SHEPHARD (first-party) | Keeps website administrators signed in to the admin area. Set only when SHEPHARD staff sign in to the admin area; regular visitors never receive it. | 12 hours | Technical, strictly necessary |
In addition, the intro animation on the home page uses your browser's session storage (sessionStorage) to save a flag called shephard_intro_seen, solely so that the animation plays only once per browsing session. It contains no personal information, is not sent to our servers and is not used for tracking. It is cleared automatically when you close the browser tab or window.
The cookie and session storage described above are used only for the operation and display of the website itself. As technical uses, they do not require consent under Article 22.2 of the Spanish Law on Information Society Services and Electronic Commerce (LSSI-CE). If we introduce cookies that require consent in the future, we will update this policy beforehand and ask for your consent before using them.
7. Data security
We protect your data with technical and organizational measures appropriate to the risk, including encrypted transmission (HTTPS), access controls for the admin area and the principle of least privilege, to prevent unauthorized access, disclosure, alteration or loss.
8. Minors
Our services are intended for businesses and professionals, not for minors. We do not knowingly collect personal data from anyone under the age of 14; if we discover that we have done so inadvertently, we will delete it promptly.
9. Changes to this policy
We may update this Privacy Policy to reflect changes in our business or the law, and will show the date of the latest update on this page. If a change significantly affects your rights, we will display a prominent notice on the website.
Last updated: 8 November 2026