Last updated: 29 September 2026
This policy explains what personal data we process when you visit www.whitewallsolutions.com, write to us or work with us, what we use it for, who we share it with and how you can exercise your rights. It describes what this website and our systems actually do; if that changes, this page will change too.
Whitewall Solutions also runs the website of its REKOSER brand (rekoser.com), which has its own policy.
We measure visits with a cookieless analytics tool installed on our own servers. It uses no cookies, stores nothing on your device and does not store your IP address: to count unique visitors it computes a fingerprint from the IP address and browser mixed with a random value that is discarded every 24 hours, so we cannot identify you or follow you across days or websites. We only get aggregate figures: page views, referring page, country, device type and browser, and clicks on download or contact links.
If you arrive from a campaign link (one of our emails or an ad), the address may include parameters naming the campaign (for example utm_source or utm_campaign); the analytics tool counts them in aggregate.
Legal basis: our legitimate interest in knowing which content is useful (Art. 6(1)(f) GDPR), without data that identifies you.
The form collects first name, surname, email address, company, country, phone number, type of enquiry, subject and message. With your enquiry we store the date, the IP address it was sent from and, if you came from a campaign link, that campaign's parameters, so we know which campaigns work.
We use it to reply to you and, if there is mutual interest, to prepare a quotation. Your enquiry reaches our sales team by email and is recorded in our customer management system, developed and hosted by us.
Legal basis: taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
To filter automated submissions, the form checks the sender's IP address against public lists of abusive addresses and against an external IP reputation service, derives the country from the IP address with a local database, and checks any links in the message with a malicious-site detection service. We do not use third-party captchas.
Legal basis: our legitimate interest in protecting the form and our systems (Art. 6(1)(f) GDPR).
This website loads no tags from Google, LinkedIn, Meta or any other advertising platform. When you arrive from an ad, the address includes a click identifier (for example Google's gclid or LinkedIn's li_fat_id). Only if the form shows the advertising measurement checkbox and you tick it do we store that identifier with your enquiry; if the enquiry later becomes a quotation or an order, we send the platform the identifier, the date, the stage (quotation or order) and its amount, to measure which ads work. We do not send them your name, email address or phone number. If you do not tick the box, the identifier is discarded when the form is received.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time through our contact form: we will delete the identifier and nothing more will be sent; what has already been shared with the platform cannot be withdrawn from it.
If we work together, we process the contact details of the people at your company, quotations, orders, invoices and correspondence.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal, accounting and tax obligations (Art. 6(1)(c) GDPR).
We send emails about products and services similar to those purchased to our customers, and to other people only if they asked for them or consented. Every email includes a one-click unsubscribe link. We measure whether emails are opened and which links are clicked, to learn what content is of interest and stop sending what is not.
Legal basis: for customers, Article 21(2) of the Spanish Information Society Services Act (LSSI) and our legitimate interest; otherwise, your consent. You can object or unsubscribe at any time.
Our email is provided by a business email provider. Messages you send us are stored there and in our customer management system so we can answer and follow them up.
We do not sell or transfer your data. We disclose it only to public authorities when the law requires it and to the providers that serve us, under a data processing agreement when they act on our behalf:
Some older blog posts show images hosted on other websites; when you view them, your browser connects to those servers, which receive your IP address.
Some of these providers are US companies or belong to US groups (business email, email delivery, the IP reputation service and, with your consent, the advertising platforms). Where your data may reach the United States, the transfer relies on the EU-US Data Privacy Framework, if the provider has joined it, or on the standard contractual clauses approved by the European Commission (Art. 46 GDPR).
This website does not use tracking, analytics or advertising cookies. The only thing it stores in your browser is that you closed the information notice, so it is not shown again.
The contact form is loaded from our own server and may use strictly necessary technical cookies to work securely (protection against forged submissions and a submission session that expires within hours). They do not require consent.
Videos on this website (success stories and blog) are embedded from youtube-nocookie.com, YouTube's privacy-enhanced mode: no cookies are set when the page loads, but they may be set when you press play. From that moment Google's privacy policy applies.
You can ask us for access to your data, its rectification or erasure, object to or ask us to restrict its processing, request its portability, and withdraw any consent you have given at any time, without affecting processing carried out before. Write to us through our contact form or to the postal address in section 1; we will reply within one month.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of your country.
Communication with the website and the form is encrypted (HTTPS). Access to our systems is restricted to the staff who need it, with two-factor authentication, and credentials for external services are stored encrypted.
This website is aimed at businesses and professionals. We do not knowingly collect data from children under 14; if we find that we have, we will delete it.
If what we do with your data changes, we will update this page and the date at the top. If the change is significant and we have your email address through a business relationship, we will let you know.