We tell you what data of yours we process, what for, for how long and what you can require of us. No copied-and-pasted clauses: this describes what this website actually does.
1. Data controller
- Controller: Rafael Ricardo Reyes Sandoval
- NIF/CIF: 39524126Y
- Address: Calle Dr. Buades, 68 · 03012 Alicante (España)
- Contact and privacy email: rgpd@magicboxdesk.com
- Telephone: +34 665 492 199
We are not required to appoint a data protection officer, given the type of activity we carry out. If we appoint one at any point, we will publish their contact details here.
2. What we process and why
These are all the purposes for which we use personal data, with their legal basis and their retention period:
| Purpose | What data | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Answering your enquiry from the contact form | Name, email, telephone and the content of the message | Art. 6.1.b: pre-contractual steps at your request | One year from the last contact, unless the enquiry leads to a contract |
| Managing an appointment booking | Name, email, telephone, and the date and time chosen | Art. 6.1.b: pre-contractual steps at your request | One year from the appointment, so that we can evidence what was agreed |
| Providing the contracted service and giving you support | Professional contact details and technical information about your infrastructure | Art. 6.1.b: performance of the contract | For as long as the contract lasts and for the limitation periods applicable to liabilities |
| Keeping the site secure and preventing abuse | IP address and technical access logs | Art. 6.1.f: legitimate interest in protecting the service | A maximum of twelve months |
| Sending you commercial communications, if you ask for them | Name and email address | Art. 6.1.a: your consent | Until you withdraw your consent or unsubscribe |
We do not take automated decisions that produce legal effects on you, nor do we build profiles of you.
3. Where your data comes from
You provide the data yourself, through the forms on the site, by email, by telephone or during the contractual relationship. We do not buy databases and we do not obtain your data from third parties. The fields marked as mandatory are those we cannot do without in order to help you: if you do not provide them, we will not be able to.
4. Who else sees your data
We do not sell or transfer your data. It is only accessed by those who provide us with services we need in order to operate, always with a signed data processing agreement in place (art. 28 GDPR):
- Website hosting provider: Hetzner Online GmbH — servidores en Alemania (Unión Europea)
- Email services that we use to communicate with you.
- Accounting and tax advisers, when you are a client and invoicing is involved.
In addition, your data may be disclosed to public authorities, judges and courts where a legal provision requires us to do so.
5. Third-party services used by this site
We prefer not to load other people’s services behind your back. These are the only ones involved:
- Fonts: they are hosted on our own server. When you browse, no request is made to Google Fonts or to any other content delivery network.
- Map on the contact page: it is served by the OpenStreetMap Foundation, but it does not load on its own. You will see a placeholder and, until you click, that service is not contacted. If you open it, your IP address is disclosed to OpenStreetMap.
- Internal notifications: when a form reaches us we receive a notification. If that notification is sent via Telegram, the content of the message passes through Telegram Messenger, which is based outside the European Economic Area. That is why we ask you not to include sensitive data in the form and, if you need to tell us something delicate, to say so and we will deal with it by another route.
6. International transfers
As a general rule your data is processed within the European Economic Area. The only possible transfer out is the one indicated in the previous point about notifications via Telegram. Where an international transfer does take place, it is covered by the safeguards provided for in Chapter V of the GDPR (adequacy decision or standard contractual clauses). You can ask us for a copy of those safeguards at the contact address.
7. Minors
This site is aimed at businesses and professionals. It is not intended for children under 14 and we do not knowingly collect their data. If we find that we have received data from a minor without the authorisation of their legal guardian, we delete it.
8. How we protect the information
We apply technical and organisational measures appropriate to the risk: traffic encryption, access control, backups with tested restores, system updates and activity logging. No measure removes the risk completely, but we work to reduce it and we review periodically whether it is still sufficient.
9. Your rights
You can exercise the following rights at any time:
- Access: to know what data of yours we process and obtain a copy of it.
- Rectification: to correct data that is inaccurate or incomplete.
- Erasure: to ask us to delete it once it is no longer necessary.
- Objection: to object to processing based on our legitimate interest.
- Restriction: to ask us to keep the data but stop using it while a complaint of yours is being resolved.
- Portability: to receive the data you gave us in a commonly used, machine-readable format, or to have us send it to another controller.
- To withdraw your consent at any time, without this affecting the lawfulness of the processing carried out beforehand.
To exercise them, write to us at rgpd@magicboxdesk.com or to Calle Dr. Buades, 68 · 03012 Alicante (España), stating which right you wish to exercise. We may ask you to prove your identity. We will reply within one month, extendable to two if the request is complex, in which case we would let you know.
If you believe that we have not dealt with your request properly, or that we are processing your data improperly, you can lodge a complaint with the Agencia Española de Protección de Datos, the Spanish data protection authority (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid). We would be grateful if you gave us the chance to put it right first.
10. Changes to this policy
If we change the way we process your data, we will update this page. When the change is significant and we have a way of telling you, we will.
Last updated: 31 July 2026.