Privacy Policy | Fortales

Last updated: September 19, 2026

At Fortales, we respect your privacy and are committed to handling your personal information responsibly and transparently.

This Privacy Policy explains how we collect, use, store, protect, and share personal information when you visit https://fortal.es, contact us, submit a project inquiry, or communicate with us about our services.

It also explains your rights regarding your personal information and how you can contact us about the way your information is handled.

1. Who We Are

Fortales is a web design and development agency operated by Samuel Santiago Baquero Jacome, an individual operating under the commercial name Fortales, based in Ecuador.

Throughout this Privacy Policy, "Fortales," "we," "us," and "our" refer to Samuel Santiago Baquero Jacome, the person responsible for determining how and why personal information collected through our website and business communication channels is processed.

Our contact information is:

Commercial name: Fortales

Data controller: Samuel Santiago Baquero Jacome

Business identification: RUC: 1724080989001

Legal address: Marcelina Nolivos 73, Quito, Ecuador

Telephone: +593984892528

Privacy contact email: privacy@fortal.es

Website: https://fortal.es

You can contact us using the information above if you have questions about this Privacy Policy or wish to exercise your personal data protection rights.

2. Information We Collect

We collect information that you voluntarily provide when contacting Fortales, submitting a project inquiry, requesting a quotation, or communicating with us about our services.

Depending on the nature of your inquiry, this information may include:

Your name and email address.
Your telephone number or WhatsApp contact information.
Your company or business name.
Your business website or other relevant online presence.
Information about your business, its objectives, and its digital needs.
Project descriptions, goals, requirements, and preferences.
Estimated project budgets and timelines.
Messages, questions, and other information you choose to share with us.
Records of our communications with you.
Your preferences regarding promotional communications, including any marketing authorization you provide.

Information received through other communication channels

In addition to our website forms, you may contact Fortales through our business email, WhatsApp Business, social media accounts, or telephone.

When you contact us through these channels, we may receive and process the information you provide, including your contact details, the content of your messages, and information relevant to your inquiry.

Communications conducted through third-party platforms, such as WhatsApp or social media services, may also be subject to the privacy policies and data-processing practices of those platforms.

Information collected automatically

Our website is hosted on Vercel.

When you access our website, Vercel may process technical information necessary to deliver website content, maintain infrastructure, and protect its services.

This information may include IP addresses, request timestamps, browser information, and other technical connection data.

Fortales does not currently use this information to create behavioral advertising profiles of website visitors.

We do not currently use website analytics, advertising pixels, or behavioral tracking tools.

Further information about cookies and browser storage is provided in Section 8.

3. How We Use Your Information

We process personal information for specific purposes associated with operating Fortales, responding to inquiries, and providing our services.

These purposes include the following.

Responding to inquiries

We use your contact information and the details you provide to answer your questions, respond to messages, and communicate with you about our services.

Understanding your project

When you submit a contact or discovery form, we use the information provided to understand your business, evaluate your requirements, and determine how Fortales may be able to assist you.

Preparing quotations and proposals

We may use your information to prepare project recommendations, quotations, proposals, and other communications related to a potential business relationship.

Managing prospective client relationships

We maintain a prospect management spreadsheet containing selected information about potential clients.

This allows us to organize inquiries, track proposal status, schedule follow-ups, and manage ongoing discussions about potential projects.

Providing contracted services

If you become a Fortales client, we may process information necessary to communicate with you, manage your project, deliver the agreed services, and fulfill applicable contractual and legal obligations.

Information that is no longer necessary for prospect management is removed from our prospect spreadsheet when you become a client.

Information necessary for the client relationship may be retained separately.

Sending promotional communications

Where you have provided valid authorization, we may use your contact information to send occasional communications about Fortales' services, new offerings, or promotional opportunities.

Promotional communications are optional and are separate from the communications necessary to respond to your inquiry or provide an agreed service.

Further information about promotional communications and your choices is provided in Section 9.

4. Legal Bases for Processing

We process personal information when an applicable legal basis permits us to do so.

The legal basis depends on the purpose for which the information is being processed.

Precontractual measures requested by you

When you contact Fortales to request information, discuss a potential project, or obtain a quotation, processing certain personal information may be necessary to respond to your request and take steps toward a possible service agreement.

Performance of a contract

If you become a client, we may process personal information necessary to perform the agreed services, manage the contractual relationship, and fulfill our obligations to you.

Compliance with legal obligations

We may process or retain certain information when necessary to comply with applicable legal, accounting, tax, or other regulatory obligations.

Consent

Where consent is the applicable legal basis, we request your authorization for specific processing purposes.

For example, we may request your separate, optional authorization to receive promotional communications from Fortales.

You may withdraw your consent at any time by contacting us at privacy@fortal.es or using the applicable unsubscribe mechanism.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal or processing that is supported by another applicable legal basis.

We will not treat the submission of a contact or discovery form as automatic authorization to receive unrelated promotional communications.

5. How We Receive and Store Your Information

Fortales uses a limited number of services to receive inquiries, communicate with prospective clients, and maintain relevant business records.

Website forms and email delivery

When you submit a contact or discovery form, your information is transmitted using Resend, a third-party email delivery service.

Resend delivers the submitted information to our business email inbox, which is provided by Namecheap Private Email.

We use the information received to review your inquiry, communicate with you, and evaluate your project requirements.

Our website does not currently maintain a separate database of contact or discovery form submissions.

Prospect management spreadsheet

Relevant information from received inquiries is manually recorded in a Microsoft Excel spreadsheet stored through Microsoft OneDrive.

The spreadsheet contains selected information used to manage prospective client relationships, including:

Names and contact details.
Business names and websites.
Proposal status and relevant follow-up dates.
Marketing authorization status and date, where applicable.

We do not routinely copy complete form submissions into the prospect spreadsheet.

Access to information

Personal information is accessed by Fortales founders and authorized team members who require it for their responsibilities.

Our prospect spreadsheet is maintained through Microsoft OneDrive, and its sharing permissions are managed through that service.

We are implementing restricted sharing permissions to limit access to specifically authorized team members.

Access to our business email and other relevant accounts is protected using strong, unique passwords.

We do not publish our prospect database on our website or intentionally make its contents available to the general public.

6. How Long We Retain Your Information

We retain personal information for periods that correspond to the purposes for which it was collected, subject to applicable legal obligations and other justified retention requirements.

Different retention periods apply to prospect records, original communications, and client information.

Prospect spreadsheet records

If you contact Fortales but do not become a client, your prospect record is retained in our management spreadsheet for up to three months from the date of your original inquiry.

At the end of this period, we delete the prospect record, including the associated contact information and marketing authorization information.

If you become a client before the end of this period, we remove your prospect record and retain only the information necessary for the client relationship.

Original inquiry emails

Original inquiry emails may be retained in our business email system for up to one year from the date they are received.

This allows us to maintain a limited record of previous communications, respond to follow-up inquiries, and refer to relevant project discussions.

Retaining an original inquiry email does not mean that the sender remains an active prospect or is authorized to receive promotional communications.

Once the applicable retention period expires, the original inquiry email is deleted unless continued retention is necessary for an applicable legal obligation or another lawful and justified purpose.

Promotional communications

Marketing authorization associated with a prospect is retained only while the corresponding prospect record remains active, subject to withdrawal of consent.

When the prospect record reaches its three-month retention limit, the record is deleted and Fortales stops sending promotional communications to that person on the basis of that authorization.

Any original inquiry emails retained separately are not used to continue promotional communications after the prospect record has been removed.

If you withdraw your marketing authorization before the end of the retention period, we stop using your information for promotional communications.

Where necessary, we may retain a limited record of your withdrawal for the purpose of respecting your communication preferences and avoiding unauthorized future contact.

Client information

If you become a Fortales client, we retain information necessary to manage the contractual relationship, provide the agreed services, and comply with applicable legal obligations.

Client information may be subject to retention periods different from those applicable to unsuccessful inquiries.

The applicable period will depend on the nature of the information, the contractual relationship, and any relevant legal, accounting, or regulatory obligations.

Third-party systems and backups

Information may temporarily remain in technical logs, email delivery systems, or backups maintained by our service providers according to their applicable retention procedures.

Where deletion is required, we take appropriate steps to address the relevant information in the systems under our control and through our service providers, subject to applicable law and technical limitations.

7. Third-Party Service Providers and International Processing

Fortales uses third-party services to operate its website, receive communications, and maintain business information.

These services may process personal information on our behalf or as part of providing their respective services.

Our current providers include:

Vercel

Vercel hosts the Fortales website and provides the infrastructure necessary to deliver its content to visitors.

As part of providing these services, Vercel may process technical information associated with website requests, infrastructure operations, and security.

Resend

Resend is used to transmit contact and discovery form submissions to our business email inbox.

As part of this process, Resend processes information contained in the submitted messages.

Namecheap Private Email

Namecheap Private Email provides our business email service.

Information received through website forms and direct email communications is processed and stored through this service.

Microsoft

We use Microsoft Excel and OneDrive to organize and store selected information relating to prospective clients.

Microsoft processes this information as part of providing its spreadsheet and cloud storage services.

Other communication platforms

When you contact us through WhatsApp Business or social media, the relevant platform may process information associated with your communication according to its own privacy policy and applicable service arrangements.

We do not sell your personal information to advertisers or data brokers.

We do not share prospect information with unrelated third parties for their independent promotional activities.

We may disclose information when required by applicable law, a valid legal process, or a competent authority.

International processing

Fortales operates from Ecuador. However, the third-party services we use may process or store personal information using infrastructure located outside Ecuador.

This may occur when information is transmitted through Resend, stored through Microsoft OneDrive or Namecheap Private Email, processed through Vercel, or communicated through third-party messaging platforms.

International processing is associated with the operation of our website, business communications, prospect management, and related services.

Where applicable, we will ensure that international transfers or processing arrangements comply with Ecuadorian data protection requirements and that appropriate legal mechanisms and safeguards are in place.

8. Cookies, Analytics, and Tracking

Fortales does not currently use cookies, local storage, or session storage to store visitor preferences or track browsing behavior.

We do not currently use:

Website analytics services.
Advertising pixels or behavioral tracking tools.
Third-party advertising cookies.
Visitor profiling systems.
Browser storage for persistent website preferences.

Our website does not currently use Vercel Analytics or Vercel Speed Insights.

The absence of these technologies does not prevent our hosting provider from processing technical connection information necessary to deliver and operate the website.

If we introduce cookies, analytics, or other tracking technologies in the future, we will update this Privacy Policy and implement any additional notices or consent mechanisms required by applicable law.

9. Promotional Communications and Your Choices

Fortales may occasionally send information about its services, new offerings, or promotional opportunities to individuals who have authorized us to contact them for these purposes.

Promotional communications are separate from the messages necessary to respond to a requested inquiry, prepare a quotation, or manage an existing client relationship.

How marketing authorization is obtained

Where consent is required, we request it through a separate, optional checkbox on our website forms.

The checkbox explicitly identifies email and WhatsApp as the communication channels for which authorization is requested.

The checkbox is not selected by default.

You may submit an inquiry or request a quotation without authorizing promotional communications.

Communication channels

Where you have authorized us to do so, we may send promotional communications through email or WhatsApp, according to the authorization you provided.

We do not interpret authorization for email and WhatsApp communications as automatic permission to send promotional messages through unrelated channels.

Promotional messages through social media direct messages are sent only where the individual has explicitly authorized that form of communication.

Recording marketing authorization

Where you authorize promotional communications through our website forms, we record your authorization status and the date it was provided in our prospect management spreadsheet.

This information is used to manage your communication preferences and distinguish authorized promotional contact from ordinary project-related correspondence.

Withdrawing authorization

You may withdraw your authorization to receive promotional communications at any time.

You can do so by:

Replying to a promotional message and requesting that we stop contacting you.
Contacting us at privacy@fortal.es.
Using the unsubscribe mechanism included in an email, where available.

When we receive your withdrawal request, we stop sending promotional communications covered by that authorization.

Withdrawing authorization does not prevent us from communicating with you when necessary to respond to an ongoing inquiry, manage an existing project, or fulfill applicable contractual or legal obligations.

Marketing retention

We do not retain unsuccessful prospects indefinitely for promotional purposes.

When a prospect record is deleted after its three-month retention period, the associated marketing authorization is also removed, and promotional contact based on that authorization ends.

Original inquiry emails retained separately are not used to reestablish marketing contact without an appropriate legal basis.

10. Security of Your Information

Fortales takes measures to protect personal information against unauthorized access, disclosure, alteration, loss, or misuse.

Our current practices include using strong, unique passwords for relevant business accounts and limiting the handling of prospect information to authorized founders and team members.

We use established third-party providers for website hosting, email delivery, business communications, and cloud storage.

We are also implementing more restrictive OneDrive sharing permissions to limit access to our prospect spreadsheet to specifically authorized individuals.

We review our information-handling practices as our business and technical requirements evolve.

Although no electronic storage or transmission system can guarantee absolute security, we aim to maintain safeguards appropriate to the nature of the information we process.

If a personal data security incident occurs, we will assess the incident and take the actions required by applicable law, including any applicable notification obligations.

11. Your Personal Data Protection Rights

Under Ecuadorian data protection law, you have rights regarding the personal information we process about you.

Depending on the circumstances and applicable legal requirements, these rights include:

Access

You may request information about the personal data we hold about you and how it is processed.

Rectification and updating

You may request the correction or updating of personal information that is inaccurate or incomplete.

Deletion

You may request the deletion of your personal information where the applicable legal conditions are met.

Objection

You may object to certain processing activities where permitted by applicable law.

Suspension of processing

You may request the suspension or limitation of certain processing activities in circumstances established by law.

Withdrawal of consent

You may withdraw consent previously provided for processing activities based on that consent.

Data portability

You may request the portability of your personal information where the applicable legal requirements are met.

Rights concerning automated decisions

You may exercise applicable rights relating to decisions based exclusively on automated processing, including profiling.

How to exercise your rights

To exercise your rights, contact us at:

privacy@fortal.es

Please describe the request you wish to make and provide the information reasonably necessary for us to identify the relevant personal data.

We may request additional information where necessary to verify your identity and protect your personal information from unauthorized disclosure.

We will review and respond to your request within the time limits established by applicable law.

Where a request cannot be fulfilled in whole or in part, we will explain the applicable reasons where required by law.

Certain information may need to be retained when continued processing is required or permitted by an applicable legal obligation or another valid legal basis.

12. Automated Decision-Making and Profiling

Fortales does not currently use automated decision-making or profiling systems to make decisions about website visitors or prospective clients that produce legal or similarly significant effects.

Project inquiries and potential business relationships are evaluated through our ordinary internal review and communication processes.

If we introduce automated processing activities that materially affect individuals' rights or the handling of their personal information, we will update this Privacy Policy and provide any additional information required by applicable law.

13. Children's Privacy

Our website is publicly accessible but is not specifically directed toward children.

Fortales provides web design, development, and related digital services primarily intended for businesses and individuals seeking professional services.

We do not intentionally collect personal information from children for marketing purposes.

If we become aware that personal information relating to a child has been collected or processed in circumstances that require additional safeguards or authorization, we will take appropriate steps in accordance with applicable law.

If you believe that a child has submitted personal information through our website inappropriately, please contact us at privacy@fortal.es.

14. Information About Other Individuals

Our contact and discovery forms are intended for individuals submitting legitimate business inquiries or requesting information about our services.

If you provide personal information about another individual, such as a business partner, colleague, or company representative, you should ensure that you are authorized to share that information and that doing so complies with applicable law.

Please avoid including unnecessary personal information about third parties in your inquiries.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our website, services, business operations, data-processing practices, or applicable legal requirements.

When we make changes, we will update the "Last updated" date at the beginning of this document.

Where required by law, we will provide additional notice or request new authorization before implementing changes that materially affect the processing of your personal information.

The current version of this Privacy Policy will remain available on our website.

16. Questions, Requests, and Complaints

If you have questions about this Privacy Policy, wish to exercise your personal data protection rights, or would like additional information about how Fortales handles your information, please contact us using the following details: