Legal
Privacy Policy
Last updated: June 2026
This Privacy Policy explains how Apex Marbella collects, uses, and protects personal data through this website. We are committed to handling your data lawfully, fairly, and transparently under the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD). Please read it alongside our Cookie Policy and Legal Notice.
1. Who is responsible for your data
The data controller for this website is Apex Marbella, operated by Alfie Kew (sole operator), based in Estepona, Spain. For any privacy question or to exercise your rights, contact us at .
2. What we collect, why, and on what basis
We only collect what we need for the purposes below. We do not collect payment card details or special-category data (such as health, religion, or ethnicity) through this website.
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Contact form: your name, business name, business type, WhatsApp number | To respond to your enquiry and discuss a possible project | Our legitimate interest in responding to enquiries, and steps prior to a contract | Up to 24 months after our last contact |
| AI chat assistant: the messages you type into the chat widget | To answer your questions in real time | Our legitimate interest in providing support | Processed to generate a reply; not used to build a profile of you |
| Booking details you submit | To arrange and confirm a call or meeting | Steps prior to a contract, and our legitimate interest | Up to 24 months after the booking |
| Client and project details, including information needed to issue and chase an invoice | To deliver the project and manage payment | Performance of our contract, and legal obligation for accounting records | Invoicing and tax records kept 6 years as required by law |
| Contract and e-signature data (name and the action of signing) | To agree and evidence our service agreement | Performance of our contract | Duration of the relationship plus 6 years |
| Your cookie choice, and analytics data if you accept (see Cookie Policy) | To record your consent and understand site usage | Consent | Analytics up to 14 months; consent record up to 24 months |
3. Apex AI, our AI chat assistant
Our website offers Apex AI, an AI chat assistant. It is an automated system, not a human, and it is labelled as such wherever it appears, in line with the EU Artificial Intelligence Act's transparency requirements. Messages you send in the chat are transmitted to our AI provider, Anthropic, which processes them to generate a response. Anthropic may retain these messages for up to 30 days for security and abuse-prevention purposes and then deletes them. Your messages are not used to build a profile of you or to train AI models. Please do not enter sensitive personal information into the chat. If you would rather not use it, you can contact us directly by email or WhatsApp instead.
4. Who we share your data with
We do not sell, rent, or trade your personal data, and we never share it for third-party advertising. We use a small number of trusted providers that process data on our behalf, under contract and only on our instructions:
- Supabase and Vercel host the website and store its data.
- Google Analytics provides anonymised usage statistics, only after you accept analytics cookies.
- Anthropic powers Apex AI, our AI chat assistant.
- Resend and Google (Gmail SMTP) deliver our emails to you, such as a reply, a project invoice, or a single reminder.
5. International transfers
Some of these providers are based outside the European Economic Area, including in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, so that your data continues to receive an equivalent level of protection.
6. Your rights
You have the right to access your data, correct it, request its deletion, restrict or object to its processing, request portability, and withdraw consent at any time. To exercise any of these, email and we will respond within one month. If you are not satisfied, you can complain to the Spanish Data Protection Agency (AEPD, aepd.es) or your local supervisory authority.
7. Security
We take reasonable technical and organisational measures to protect your data, including encrypted connections, access controls, and reputable hosting. No method of transmission or storage can be guaranteed to be completely secure, but we work to protect your information and to address any issue promptly.
8. Children
This website and our services are intended for businesses and adults. They are not directed to children under 16, and we do not knowingly collect their data.
9. Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with a revised date. Please check back periodically.