Legal
Privacy policy
Last updated 30 October 2026
1. Identity of the Data Controller
This privacy policy ("Policy") governs the processing of personal data carried out through the website located at https://www.builtwithskills.com (the "Website"), the community operated on the Circle platform at https://builtwithskills.circle.so (the "Community"), and the paid services we provide.
The data controller, within the meaning of Article 4(7) of Regulation (EU) 2016/679 ("GDPR") and Organic Law 3/2018, of 5 December ("LOPDGDD"), is Heidi Hein, a self-employed individual (autónoma) registered in Spain, trading as Built With Skills ("we" or "us"). Jethro Pickering works with her and has access to personal data only to the extent needed to deliver the Community and our services, under the same duty of confidentiality.
Contact e-mail: info@builtwithskills.com. Tax identification number (NIF): ESY9226768X. Business address: Calle Montano, 4, 29012 Málaga, Spain.
Given the scale of the processing described in this Policy, the appointment of a Data Protection Officer under Article 37 GDPR is not mandatory, and none has been appointed. Any communication that would ordinarily be addressed to a Data Protection Officer should be sent to the e-mail address above.
2. Scope of this Policy
This Policy applies to personal data processed in connection with: (a) browsing the Website; (b) joining or using the Community; (c) subscribing to our e-mail list to receive a free download; (d) sending us a form or an e-mail; and (e) buying and receiving a paid service. It does not govern processing that a third party carries out for its own purposes once you use its service directly, which is governed by that party's own privacy policy (see Section 6).
3. Categories of personal data processed
- Forms on this Website. The contact form, the service request and application forms and the withdrawal form send what you enter, when you press the button, through our hosting provider (Vercel) and our e-mail delivery provider (Resend) to our inbox. Depending on the form, that is your name, e-mail address, website address, your message, and your answers to the questions on the form (for example your goals, timing and budget for a done-for-you website). Nothing is sent as you type. The withdrawal form also sends you an e-mail receipt.
- E-mail list data. When you ask for a free download, you give us your e-mail address in a form on the Website, which your browser sends directly to Kit. Kit records your address, the form you used, the time of your request and the time you confirmed your address, and uses them to send you the confirmation, the download and the follow-up e-mails described in Section 4. Kit may also record whether you open or click the e-mails we send.
- Purchases. When you buy through Stripe's checkout, Stripe collects your name, e-mail address, billing address, card details and, if you give it, a tax ID. We receive your name, e-mail, billing address, what you bought, the amount, and any answer you give to a question at checkout. We never receive your full card number. Pro is bought on Circle's checkout, which uses Stripe in the same way.
- Delivering a service. What you send us so that we can deliver it: your website address, your call topic, your press release and the contact details in it, your answers about your business, and any material, logo or photos for a done-for-you website. If a service needs access to an account of yours (for example Google Search Console or your hosting), we ask you to add us as a user. We never ask for your passwords.
- Calls. Calls take place on the video-call service named in the invitation. We do not record calls unless we both agree beforehand. We may keep private notes of what was discussed.
- The Community. If you join, Circle holds your name, e-mail address, profile, and anything you post, for us. Joining and signing in happen on Circle's own domain.
- Correspondence. If you e-mail us, we process the content of that communication and your e-mail address in order to reply.
- Server log data. Vercel, as hosting provider, processes the technical data inherent to any request to the Website (IP address, browser, requested page) in order to deliver the Website and keep it secure.
- Video previews. Where a page shows a YouTube video, its preview image is loaded from YouTube's image server, which receives your IP address and browser details. No cookie is set. The player itself loads only when you press play (Section 6).
We do not ask for, and ask you not to send us, special categories of data (such as health information), passwords or card numbers.
4. Purposes and legal basis for processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing access to the Community and its contents | Performance of a contract (Art. 6(1)(b)) |
| Answering a service request or application, and preparing a quote or project scope at your request | Steps taken at your request before entering into a contract (Art. 6(1)(b)) |
| Taking payment for, and delivering, a paid service, including handling a withdrawal or a complaint | Performance of a contract (Art. 6(1)(b)) |
| Keeping invoices and accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Keeping a record of your order, your acceptance of our terms and our correspondence, to deal with a dispute or chargeback | Legitimate interest in establishing and defending legal claims (Art. 6(1)(f)) |
| Responding to correspondence sent to us | Legitimate interest in dealing with enquiries (Art. 6(1)(f)) |
| Maintaining server logs for security and abuse prevention | Legitimate interest in the security of our systems (Art. 6(1)(f)) |
| Sending you the free download you asked for, and the follow-up e-mails about our services that we tell you about when you sign up | Consent (Art. 6(1)(a)), given when you request the download and confirm your address, and your prior consent to commercial communications (Art. 21 LSSICE) |
| Keeping a record that you confirmed your address | Legitimate interest in being able to demonstrate consent (Art. 6(1)(f) and Art. 7(1)) |
No processing described in this Policy involves automated decision-making or profiling producing legal effects concerning you or similarly significantly affecting you, within the meaning of Article 22 GDPR.
5. Cookies
The Website does not currently set any cookies. Full details are in our cookie policy, adopted pursuant to Article 22(2) of Law 34/2002, of 11 July (“LSSICE”).
6. Recipients of personal data
We do not sell, rent, or otherwise disclose your personal data to third parties for their own marketing purposes. The following recipients process personal data on our behalf (processors), or in their own right where shown:
| Recipient | Role | Data processed |
|---|---|---|
| Vercel Inc. | Processor. Hosting of the Website and its forms | Server logs; form submissions in transit |
| Kit (ConvertKit, LLC) | Processor. E-mail list, delivery of free downloads and follow-up e-mails | E-mail address, form used, sign-up and confirmation times, and whether you open or click our e-mails |
| Resend, Inc. | Processor. Delivery of form submissions and receipts | What you enter in a form |
| Google (Google Workspace) | Processor. Our e-mail inbox and documents | Correspondence, form submissions, and the documents we prepare for you |
| Stripe Payments Europe, Limited | Processor for payments; independent controller for fraud prevention and its own legal obligations | Name, e-mail, billing address, card details, tax ID if given |
| Circle Systems, Inc. | Processor for the Community; controller of its own platform account data under its own policy | Account details and community content |
| ABNewswire | Independent controller of its distribution service, press release buyers only | Your press release and the contact details in it, which are published |
| The video-call service named in the invitation | Provider of the call, call buyers only | Name, e-mail, and your audio and video during the call |
| YouTube (Google LLC) / Vimeo, Inc. | Independent controller | IP address when a preview image loads; cookies once you press play |
We may also disclose data where the law requires it, for example to the Spanish tax authority, or to our tax adviser for the purpose of keeping our accounts.
7. International data transfers
Several recipients in Section 6 are established in, or use service providers in, the United States or other countries outside the European Economic Area. Each such transfer relies on the EU-US Data Privacy Framework where the recipient is certified under it, or otherwise on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, as applicable to that recipient at the time of transfer.
A press release is sent so that it is published worldwide; that is the purpose of the service you ask for (Article 49(1)(b) GDPR). A copy of the relevant safeguard can be requested at the address in Section 14.
8. Data retention periods
- Server logs: retained by Vercel for a limited, rolling period, after which they are deleted in the ordinary course of Vercel's own retention practice.
- Community account data: retained for the duration of your membership, and deleted when you close your account or ask us to, save where retention is required to comply with a legal obligation.
- E-mail list: retained until you unsubscribe or ask us to delete your data. After you unsubscribe we keep your address and the date only so that we do not e-mail you again, and the record of your consent for as long as we may need it to show that we had it.
- Enquiries and applications that do not lead to a purchase: deleted within twelve months of our last exchange.
- Purchases: invoices, payment records and the record of your order and acceptance of our terms are kept for six years, as Spanish commercial and tax law requires.
- What you send us to deliver a service: kept while we deliver it and for as long as you might reasonably come back to us about it, and no longer than the purchase records above.
- Access to your accounts: we remove ourselves, or ask you to remove us, once the service is delivered, unless you ask us to keep access for ongoing work.
9. Rights of data subjects
In accordance with Articles 15 to 22 GDPR and Articles 12 to 18 LOPDGDD, you may exercise, in respect of the personal data we hold about you, the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection, and the right not to be subject to a decision based solely on automated processing.
Where processing is based on your consent (Section 4), you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. Every e-mail we send to our list contains an unsubscribe link, and using it withdraws your consent to further e-mails.
Requests may be sent to info@builtwithskills.com, identifying yourself and the right you wish to exercise. We will respond within the one-month period established by Article 12(3) GDPR, extendable by two further months in cases of particular complexity, of which you would be informed within the first month. No fee is charged for the exercise of these rights, save in the exceptional circumstances contemplated by Article 12(5) GDPR.
10. Security measures
We have adopted the technical and organisational measures reasonably available to an operation of this size to protect personal data against unauthorised access, loss, or alteration, consistent with our obligations under Article 32 GDPR. Data held on third-party platforms is additionally subject to the security measures adopted by those providers.
11. Minors
The Website, the Community and our services are directed at adults engaged in, or intending to start, a business activity. Consistent with Article 8 GDPR and Article 7 LOPDGDD, they are not directed at, and we do not knowingly collect personal data from, individuals under sixteen years of age. Where we become aware that we have inadvertently collected such data, it will be deleted without undue delay.
12. Amendments to this Policy
We may amend this Policy to reflect changes in our processing activities or in applicable law. Any amendment will be published on this page with an updated revision date. Where an amendment materially affects the processing of your data, we will take reasonable steps to notify you directly, in addition to publishing the revised Policy.
13. Supervisory authority and complaints
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The competent authority in Spain is the Agencia Española de Protección de Datos (AEPD), Calle Jorge Juan, 6, 28001 Madrid. We would however ask that you contact us in the first instance, so that we may address your concern directly.
14. Contact
Any query concerning this Policy or the processing of your personal data should be directed to info@builtwithskills.com.