Privacy Policy.

01

Data collected

Personal data is collected only when someone provides it voluntarily through one of the site's three channels, plus the technical measurement data described at the end of this section:

• Contact form: first name, last name, email address, company, phone, type of need, estimated budget, timeframe and project description. The form also includes a hidden field that only automated programs fill in and whose content is never stored, and the server records the address of the page the form was sent from and the browser identifier (user-agent).
• Review form: name, role and company, LinkedIn or website address, email address, a rating from 1 to 5 and the review text.
• Chat assistant: the content of the conversation and, if an email address is typed into it, that address together with the full transcript.
• Technical data: usage and performance statistics from Vercel Analytics and Vercel Speed Insights, cookieless and served from the site's own domain, and, only if cookies are accepted, browsing statistics from Google Analytics 4.

No third-party advertising trackers are used and no data is passed to advertising networks. Google Analytics runs only with prior consent, and that consent can be withdrawn at any time from the “Cookies” link in the footer.

02

Legal basis for processing

The processing described in this policy relies on the following legal bases of the General Data Protection Regulation (GDPR):

• Consent: the voluntary submission of the contact form, of the review form or of a chat message, the publication of an approved review, and the activation of Google Analytics.
• Legitimate interest: keeping the site available and protected against abuse, through submission rate limits and the hidden anti-spam field in the forms. Audience measurement does not rely on this basis, but on consent.
• Performance of a contract or pre-contractual steps: answering a request for a quote and delivering the services agreed.

03

Purposes

• Answering the enquiries and requests for a quote received through the contact form or the chat.
• Reviewing the reviews received and publishing on the site the ones that are approved.
• Measuring how the site is used in order to improve it, with prior consent in the case of Google Analytics.

Personal data is not sold, not rented and not shared with third parties for marketing purposes.

04

Client reviews

The site's review form collects the name, the role and company, the LinkedIn or website address, the email address, a rating from 1 to 5 and the review text.

• What is published: once a review is approved, the site publicly shows the name, the role and company, the text, the rating and the LinkedIn address as a link. The email address is never published.
• Why the email is asked for: it is used to check that the review comes from a real person with whom a project actually took place, and to be able to write to that person if something needs clarifying or the review needs to be taken down. It is not used to send marketing messages.
• Who receives it: the review is stored in LakeTab's management platform and in a Google spreadsheet, and it triggers a Telegram notification to the two people who run the site. That notification includes the name, the role, the text, the LinkedIn address and the email address.
• How long it is kept: the review and the email address that comes with it are kept for as long as the review remains published. Its removal can be requested at any time by writing to info@laketab.com.

05

Chat assistant

The site's chat is handled by an automated assistant based on a language model, not by a person. Its answers are generated automatically, may contain errors, and do not constitute an offer or a contractual commitment.

The model is run by Groq, Inc., a provider established in the United States. The content of the conversation is sent to its infrastructure to generate each answer, so it leaves the European Economic Area.

If an email address is typed into the conversation, the server detects it and records that address together with the full transcript as a contact request, by email and in a Google spreadsheet. Without typing an address, the conversation is not linked to any contact details.

The conversation in progress is kept in the browser's own session storage so that it is not lost when moving between pages. That copy is deleted when the tab is closed and is not sent to any server as a result of being stored.

06

Processors

The following providers process personal data on behalf of LAKETAB SL, each for the purpose stated:

• Vercel: website hosting and usage and performance measurement with Vercel Analytics and Vercel Speed Insights, cookieless and served from the site's own domain.
• Google: delivery of the internal notifications through the Gmail API, recording of contacts and reviews in Google Sheets spreadsheets and, only with prior consent, audience measurement with Google Analytics 4.
• Groq: running the language model that answers in the site's chat.
• Telegram: delivery of the internal notification that the two people who run the site receive when a new review arrives.
• LakeTab's own server: the internal management platform, where contacts and reviews are stored, runs on a self-hosted server located in Poland.

07

International transfers

Some of the providers above are United States companies or process the data from outside the European Economic Area (EEA):

• Vercel, Inc. (United States): site hosting and usage and performance measurement. The data may be processed or accessed from outside the EEA.
• Google (Gmail API, Google Sheets and Google Analytics): the data may be processed in data centres and by staff located outside the EEA, including the United States.
• Groq, Inc. (United States): the content of every chat conversation is sent to its infrastructure, outside the EEA.
• Telegram: the internal review notifications are delivered through its infrastructure, located outside the EEA.

The internal management platform runs on a self-hosted server located in Poland, so that data does not leave the EEA.

These transfers take place under the data protection commitments each provider undertakes by contract with its European customers. Information about the safeguards that apply to a specific provider can be requested at info@laketab.com. Anyone who prefers their data not to leave the EEA can write to that same address instead of using the chat or the forms.

08

Cookies and browser storage

This site sets no cookie before obtaining consent: on a first visit there are no cookies. There is no language cookie either, because the language is part of the page address. If “Accept” is chosen in the cookie notice, the two Google Analytics 4 cookies described below are loaded. If “Reject” is chosen, none is loaded.

• _ga (Google Analytics cookie, 400 days): pseudonymously distinguishes the browsers that visit the site, so that separate visitors can be counted.
• _ga_XNBVP501GN (Google Analytics cookie, 400 days): stores the measurement session state for this specific Google Analytics property.

Besides those cookies, the site uses two browser storage keys. They are not cookies, they are not sent with requests to the server, and their content does not leave the browser:

• laketab-cookie-consent, in local storage, together with the date the choice was made: it records whether cookies were accepted or rejected, so the question is not asked again on every page. The choice is asked again after twelve months, and is kept until then or until the site's data is cleared in the browser.
• laketab-chat-messages, in session storage: it keeps the conversation in progress with the chat assistant so that it is not lost when moving between pages. It is written without prior consent because it does not leave the browser, and it disappears when the tab is closed.

The cookie decision can be changed at any time from the “Cookies” link in the footer, which reopens the notice. Rejecting them after having accepted them removes the Google Analytics cookies from the browser.

09

Retention periods

Data is kept only for as long as the purpose that justified collecting it requires:

• Contact requests: kept for as long as the commercial interest that prompted them remains, and for the term of the contract and the legal periods that follow it where they lead to a contractual relationship. They are not deleted automatically once a period elapses; they are reviewed and removed when they are no longer needed or when the person asks.
• Reviews: for as long as the review remains published on the site.
• Chat conversations: the transcript is stored only if an email address was typed into it, and in that case it is kept as a contact request, under the same criterion. The copy held in the browser disappears when the tab is closed.
• Measurement data: kept by Google according to the configuration of the Google Analytics 4 property, and the associated cookies expire after 400 days.

Erasure can be requested at any time by writing to info@laketab.com, and it is applied to every copy: the mailbox, the backup spreadsheet and the internal management platform.

10

Rights of data subjects

The GDPR grants anyone whose data is processed the following rights:

• Access: to obtain confirmation of whether their data is being processed and a copy of it.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to request deletion of their data when it is no longer necessary for the purpose that justified it.
• Restriction of processing: to ask that the data be kept but not used while its accuracy is verified or an objection is resolved.
• Portability: to receive the data provided in a structured, commonly used format.
• Objection: to object to processing based on legitimate interest.
• Withdrawal of consent: to withdraw consent already given at any time, without affecting the lawfulness of processing carried out before. For cookies, the “Cookies” link in the footer is enough; for a published review, requesting its removal is.
• Complaint to the supervisory authority: to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), without prejudice to any other administrative or judicial remedy.

To exercise any of these rights, it is enough to write to info@laketab.com stating which right is being exercised. Requests are answered within one month.

Contact details of the supervisory authority: Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es.

11

Changes to this policy

This policy is updated when the site or the services that process the data change. The version in force is the one published on this page, with its last updated date at the top.

12

Contact