Privacy policy
Version 1.0 · 5 November 2026
This policy follows Llei 29/2021, qualificada de protecció de dades personals (LQPD), and its regulation, Decret 391/2022. Our record of processing activities is at the end.
The essentials
- We only ask for the data needed for your account, your listing or your quote request.
- If you request a quote, your data goes only to the businesses you see before sending, and only so they can reply.
- We do not sell data, send advertising or use tracking cookies or third-party analytics.
- From your account you can download your data and delete the account whenever you like.
- If something seems wrong, you can complain to the Agència Andorrana de Protecció de Dades (APDA).
Controller
| Item | Detail |
|---|---|
| Controller | Uriel Iglesias (individual), owner of empresas.ad |
| Email for data matters | uriel@nf6.ai |
| Without an account | form to exercise your rights |
We have no data protection officer: given what we process today, article 38.2 of the LQPD does not require one. We will review this if that changes.
What we process, why and on what basis
The legal basis is the one in article 6.1 of the LQPD shown on each row: contract (b), legal obligation (c), legitimate interest (f) or consent (a).
| Processing | Data | Purpose | Basis |
|---|---|---|---|
| Your account | email, name, password (stored hashed with argon2id: nobody can read it), language, version and date of the terms you accepted, confirmation that you are an adult and date of last login | create and keep your account, let you log in and email you about what happens in it (a new request, for example) | contract (b) |
| Your business listing | name, legal form, sectors, services, parish, address and location, opening hours, languages, phone, WhatsApp, email, website and social media, logo, photos, text and which members manage it | publish the listing and let several people from the business manage it | contract (b) |
| Verifying and claiming listings | NRT (never published), role in the business and the proof you provide | check that the business exists and that you represent it, and prevent impersonation | contract (b) and legitimate interest (f) |
| Request a quote | what you need, parish, timing, name, email, phone if you give it, language, photos if you add them and the version of the text you accepted | pass your request to the businesses you choose so they can reply | steps you ask for before a contract (b) |
| Alert when businesses are available | email, sector and parish | write to you once when there are businesses that can handle your request | consent (a), only if you tick the box |
| Contact | name, email and message | reply to you | legitimate interest (f) |
| Data protection rights | what you tell us when exercising them and our reply | deal with your request and be able to show we did | legal obligation (c) |
| Content reports | details of the person reporting, the content reported and the listing owner's reply | handle the report and remove what is unlawful | legitimate interest (f) |
| Listing history | who changed each detail and when | know what the business wrote and what we wrote (Llei 20/2014, art. 11) | legitimate interest (f) |
| Security and anti-spam | IP and browser of open sessions; IP and email turned into an encrypted fingerprint in the login log, attempt limits and blocks; log of emails sent by the site, without their content | protect accounts, stop spam and fraud, and detect attacks | legitimate interest (f) |
| Statistics | daily counters: views of each listing, clicks on its contact buttons, searches, requests; no IP, no cookies and no one identified | show each business how its listing is doing and see which parts of the site get used | legitimate interest (f) |
We do not send you advertising. If a newsletter ever exists, only people who ask for it in a separate box will get it, with a one-click unsubscribe link in every email.
An automatic filter scores quote requests that look like spam and may hold them back. A person reviews held requests before discarding them.
Where the data comes from
From you, when you create an account, fill in a listing or send a form. If a colleague invites you to manage your business's listing, they give us your email so we can send the invitation.
Today every listing is created by the business itself. If we ever add listings from official public registers, we will say so here first, show the source on each listing, leave out individuals who have not signed up, and inform the people concerned within one month, as article 17 of the LQPD requires.
Who receives your data
- The businesses you send a quote request to. Before sending you see their names and can remove any you do not want. Each one receives your name, your contact details and your message, agrees in its terms to use them only to reply to you, and becomes responsible for what it does with them.
- Anyone who visits a listing, and search engines: they see what the business has marked as visible.
- The other members of your business on empresas.ad, who see the listing, the requests received and the name and email of whoever manages it.
- Hostinger International Ltd (Cyprus, EU), which hosts the site, the database and the backups and sends the site's emails, in a European Union data centre, under a data processing agreement.
- OpenStreetMap, only if you open the map to place your listing's address: your browser requests the map images and the OpenStreetMap Foundation sees your IP. If you do not open it, it receives nothing.
- Authorities and courts, when a law or an order requires it.
We do not sell or pass data to anyone for advertising.
Transfers outside Andorra
Our provider stores the data in the European Union, which under article 43.2 of the LQPD offers an adequate level of protection. We use no US providers and load no third-party analytics or advertising scripts.
How long we keep it
| Data | Period |
|---|---|
| Account | while you have it; if you do not log in for 24 months we warn you and, with no reply within 30 days, delete it |
| Listing | while you keep it; when you delete it we erase its details and photos, and only a redirect from its web address to its sector remains |
| A listing's change and moderation history | 24 months after the listing is deleted |
| Listing claims and proof provided | 12 months after they are resolved |
| Quote requests | 12 months; then we erase name, email, phone, description and photos, keeping only data that identifies no one (sector, parish, date). You can withdraw it earlier from the link in your email |
| Alert when businesses are available | until we send the alert, 12 months at most |
| Contact messages | 12 months |
| Rights requests and content reports | 24 months after closing |
| Sessions | until you log out or they expire: 30 days if you are logged in, 24 hours if not |
| Login log and sent email log | 12 months |
| Attempt limits | cleared automatically when the limit period ends |
| Blocks for abuse | for as long as the block lasts; permanent blocks keep only the encrypted fingerprint |
| List of people who asked not to appear | while the directory exists, with the minimum needed not to publish them again |
| Backups | replaced every 30 days |
When you delete your account, within 30 days at most we erase your data or block it. Blocking means nobody sees or uses it, and it is kept only while liability for the processing can still be claimed, as article 30 of the LQPD provides. Then it is erased.
Your rights and how to use them
You can ask for access to your data, correct it, erase it (including removal from search engines, art. 20.2), object to a processing activity (art. 24), restrict it, take your data with you in a machine-readable format, and withdraw consent at any time. It is free.
- With an account: correct your details and your listing in the dashboard. Under "My account" you have "Download my data" (a file with your account, your listings, the requests received and your logins) and "Delete my account".
- If you requested a quote: the confirmation email has a link to withdraw the request and erase your data.
- Without an account, or if you appear in a listing you do not manage: use the rights form or write to uriel@nf6.ai.
We reply within one month at most (art. 15.3). If the case is complex we may extend that period, and we will tell you within the first month, with the reason. If there is reasonable doubt about who you are, we will ask you to confirm it.
Complaining to the authority
If you think we are not handling your data properly, you can complain to the Agència Andorrana de Protecció de Dades (APDA) at apda.ad. If you write to us first, we will try to put it right.
How we protect the data
Encrypted connection (HTTPS with HSTS), passwords hashed with argon2id, protected session cookies (HttpOnly, Secure and SameSite), protection against forged form submissions, attempt limits, uploaded photos checked for their real type and stripped of location data (EXIF), admin access for the owner only, and a daily database backup.
If there were a security breach, we would notify the APDA within 72 hours at most and, if the risk is high, the people affected as well.
Children
The site is for adults. Creating an account requires confirming this.
Cookies
We only use technical cookies. The details are in the cookie policy.
Changes to this policy
If we change it, the version and date at the bottom change. If the change affects what we do with your data, we will email account holders in advance.
Record of processing activities
Published under article 26.4 of Decret 391/2022. Controller for every activity: the one named above. Processor for every activity: Hostinger (hosting, database, backups and email). International transfers: none outside the European Union. Security measures: those in the section above.
| Activity | Purpose | People | Data | Basis | Recipients | Period |
|---|---|---|---|---|---|---|
| User accounts | give access and manage the account | people who create an account | identity and contact, credentials, preferences, acceptance of terms | contract | none | while the account exists (24 months unused) |
| Business listings | publish and manage directory listings | businesses, sole traders and their users | business details, work contact details, images, members, NRT (private) | contract | visitors and search engines (visible part only) | while the listing exists |
| Verification and claims | check existence and representation | people who claim or ask for verification | NRT, role, proof provided | contract and legitimate interest | none | 12 months after resolution |
| Request a quote | pass requests to businesses | people who request quotes | identity, contact, description of the need, optional photos, proof of the accepted text | pre-contract steps; consent for the alert | the chosen businesses | 12 months, then anonymised |
| Contact and rights | answer messages and handle rights | people who write | identity, contact, message, reply | legitimate interest; legal obligation | none | 12 months (contact); 24 months (rights) |
| Moderation | handle content reports and keep each listing's history | people who report, listing owners | identity, contact, content reported, changes | legitimate interest | the owner of the listing concerned (the report, without the reporter's details unless needed) | 24 months after closing |
| Security | protect accounts and stop abuse | users and visitors | IP and browser of sessions; IP and email as encrypted fingerprint; email log | legitimate interest | none | session; 12 months (logs) |
| Statistics | measure use of the site and each listing | no identifiable person | daily aggregate counters | legitimate interest | each business sees its own listing's figures | no limit (not personal data) |
Version 1.0 · 3 November 2026