Privacy policy

Last updated: 31 May 2026

1. Data controller

• Controller: José David Rodríguez Payo (self-employed)
• Tax ID: 20861520Z
• Address: Calle O'Donnell, 67, Alzira (Valencia), España
• Email: contacto@workwise.es
• Trade name: WorkWise is the trade name under which José David Rodríguez Payo (self-employed) identifies his activity on workwise.es.

2. Scope of application

This policy applies to the processing of personal data carried out through https://workwise.es, including the public information and pricing website, the contact form on the /contact page, credential-protected areas (/login and /app/*) when available, and communications arising from contact with the owner.

3. Data we may process

• Browsing and device data: IP address, online identifiers, pages visited, usage events, browser and system type, collected for analytics purposes if you accept analytics cookies.
• Contact data: name, email, phone, business type, or any information you voluntarily send us by email, phone, or the contact page form.
• Account and operational data (private area): user identifiers, email, role, employment or business data necessary to manage payroll, attendance, internal communications, or other WorkWise HR product features when you use those areas.
• Session technical data: token or session identifier associated with the authentication cookie.
• Web contact form data: name, phone, email (optional), business type, and message, submitted from the /contact page.

Web contact form

On the /contact page you can send us an information or quote request. Below we detail the processing of data collected through that form.

• Location: The form is available at the /contact route on the site. The data controller is the one listed in section 1.
• Data collected: full name (required), contact phone in Spanish format (required), email address (optional), business type or activity (required), and message with your enquiry (required). It includes a hidden anti-spam field (_gotcha) that must not be filled in.
• Purpose: to handle your enquiry, assess your needs, prepare a quote, or arrange an initial commercial call.
• Legal basis: pre-contractual measures at the data subject's request (Art. 6(1)(b) GDPR) and, where applicable, consent when submitting the form after reading the privacy notice linked next to the submit button.
• Processor: Formspree Inc. (United States), which receives the data on our behalf and makes it available to the controller for management.
• Retention: while we handle your request and, if a commercial relationship begins, for its duration and applicable legal periods. If no commercial relationship is established, we will retain the data as long as needed to respond and for a maximum of 24 months from the last contact, unless a different legal obligation applies.
• International transfers: Formspree may process data in the United States. GDPR safeguards apply (standard contractual clauses or other recognised measures).
• Mandatory fields: name, phone, business type, and message are required to handle your request. Email is optional; if you do not provide it, we will contact you by phone.

4. Purposes and legal basis

5. Recipients and processors

We may share data with providers that deliver services necessary to operate the site:

• Vercel Inc. (hosting and site delivery). The site is hosted on Vercel infrastructure, with possible data processing in the United States and other countries depending on the content delivery network.
• Google Ireland Limited / Google LLC (Google Tag Manager and Google Analytics), when you have accepted analytics cookies.
• Cloud database provider (for example, Neon/PostgreSQL) for application data storage when you use features that require it.
• Email providers (for example, Resend or other SMTP), for sending technical or service communications.
• Formspree Inc. (public website contact form), to receive, temporarily store, and forward enquiries submitted from the /contact page.

These providers act as processors in accordance with the controller's instructions and, where applicable, with appropriate contractual safeguards.

6. International transfers

Some providers may process data outside the European Economic Area (for example, the United States). This includes hosting (Vercel), the contact form (Formspree Inc.), and, if you accept analytics cookies, Google. In those cases, the safeguards provided for in the GDPR apply, such as standard contractual clauses or adequacy decisions, depending on the provider.

7. Retention periods

• Commercial contact data: for the duration of the relationship and subsequent legal periods.
• Account and operational data: for the duration of the service and periods necessary for claims or legal obligations.
• Analytics data: according to Google Analytics configuration and your consent decision.
• Hosting technical logs: for the provider's usual retention periods.
• Contact form submissions: while we handle the enquiry and, at most, 24 months from the last contact if no commercial relationship is established.

After those periods, data is deleted or anonymized when no longer necessary.

8. Rights of data subjects

You may exercise the following rights by writing to contacto@workwise.es:

• Access, rectification, and erasure
• Restriction of or objection to processing
• Data portability, where applicable
• Withdraw consent at any time (without affecting the lawfulness of prior processing)

You must verify your identity when necessary. We will respond within the legally established timeframe.

9. Complaint to the supervisory authority

If you believe that processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

10. Obligation to provide data

Data marked as necessary to contract or access the service is essential for that purpose. On the contact form, name, phone, business type, and message are required to handle your enquiry; email is optional. If you do not provide the required fields, we will not be able to respond to your request.

11. Minors

The services are aimed at businesses and individuals in a professional or commercial context. They are not intended for minors under 14. If we detect data from minors without parental authorization, we will delete it.

12. Security measures

We apply reasonable technical and organizational measures to protect data (access control, encrypted communications where appropriate, sound hosting practices). No system is completely infallible.

13. Changes to this policy

We may update this policy to reflect legal or site changes. We will publish the current version at this URL with the update date.

14. Related documents

Also see the legal notice and the cookie policy. Main activity: Website creation and business digitalization