Legal

Privacy policy.

Last updated: April 1, 2026 · Effective from April 1, 2026

This privacy policy explains how PMax Online S.L. (“pmax”, “we”, “us”) collects and processes personal data when you visit pmax.online or engage us as a service provider. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

PMax Online S.L., Calle Cordova 5, 07184 Calvià, Mallorca, Spain. Email: hello@pmax.online.

2. What data we collect

When you visit our website

  • Server log files (IP address, user agent, referrer, timestamp)
  • Cookies and similar technologies (see our cookie policy)
  • Aggregated, anonymised analytics data via Google Analytics 4 with IP anonymisation enabled and only after consent

When you fill out our contact form

  • Name, company, email address, phone number (optional), the message you send us

When you become a client

  • Business contact details of your team
  • Billing and invoicing data
  • Access to your marketing platforms granted to us solely for the purpose of providing our services

3. Legal basis for processing

  • Art. 6(1)(a) GDPR — Consent for analytics and marketing cookies
  • Art. 6(1)(b) GDPR — Contract for processing client data to deliver our services
  • Art. 6(1)(f) GDPR — Legitimate interest for responding to inbound enquiries and securing our website
  • Art. 6(1)(c) GDPR — Legal obligation for retaining accounting records under Spanish tax law

4. How long we keep your data

Enquiry data: 24 months from your last contact, unless you become a client. Client data: duration of the engagement plus 10 years for invoicing records as required by Spanish tax law. Server logs: 14 days. Analytics data: 14 months.

5. Your rights

Under GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. To exercise any of these rights, contact hello@pmax.online. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.

6. Third-party processors

We use the following processors, each bound by Data Processing Agreements (Art. 28 GDPR):

  • Google Ireland Ltd. — Google Workspace, Google Analytics (EU servers)
  • HubSpot Ireland Ltd. — CRM
  • Vercel Inc. — Website hosting (EU region)
  • Sendgrid (Twilio Ireland Ltd.) — Transactional email

Some of these providers may transfer data outside the EEA. Where this occurs, transfers are protected by Standard Contractual Clauses (SCCs).

7. Contact

For privacy questions: hello@pmax.online. We respond to all rights requests within 30 days as required by GDPR.