PrivacyPolicy.

1. Who we are and how to reach us

This website and the services described on it are operated by:

In this policy, "we", "us", "our" and "DaveyBiz" mean the entity above. "You" means any person who visits this website, submits an application, books a call, or otherwise communicates with us.

We are the data controller (responsable del tratamiento) for the personal data described in this policy.

The GDPR is our baseline, wherever you are. Our contracting entity is incorporated in the United States, but our founder operates the business from Spain, and we market our services to people in the European Union and monitor website behaviour there through advertising tools. We are therefore subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") under both Article 3(1) and Article 3(2), together with Spanish Organic Law 3/2018 (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE). We apply the GDPR as our baseline standard for everyone. Where you are located in the United States, Canada, the United Kingdom, Australia or New Zealand, we also give you the additional rights described in Section 13.

Incorporating outside the European Union does not reduce these obligations, and we do not claim that it does.

Data Protection Officer (DPO). We have not appointed a DPO, as we are not required to do so under Article 37 GDPR. Privacy questions go to [email protected], which is monitored by the founder.

EU representative (Article 27 GDPR). Our founder and sole manager lives in Spain and directs this business from the Spanish operating address given above. We therefore treat that address as our place of establishment in the European Union, and Article 27 does not require us to appoint a separate EU representative. If that position changes, we will appoint one and name them here.

2. What this policy covers

This policy covers personal data we collect through:

• the website daveybiz.com and any subdomain or landing page we operate (including pages hosted at daveybiz.pages.dev while the site is in staging);
• the application form on our landing page and the qualification survey on the page that follows it;
• video playback on our pages;
• calls you book with us and the meetings we hold;
• email, WhatsApp, SMS and messaging exchanges with you;
• our advertising on Meta platforms (Facebook, Instagram) and any other advertising platform we may add;
• our client relationship, if you become a client.

It does not cover: third-party websites we link to; the privacy practices of social media platforms where you may have seen our content; or personal data belonging to your customers, which, if we process it while delivering services to you, we process as your processor under a separate written data processing agreement.

3. The personal data we collect

3.1 Data you give us

"Mandatory" means the form will not submit without it, or we cannot assess your application without it. You are not obliged to give it to us — but if you do not, we cannot process your application or provide the service.

3.2 Data we collect automatically

Cookies and similar technologies are explained in our separate Cookie Policy. Non-essential cookies — including all advertising and analytics cookies — are only placed after you consent through our cookie banner, where consent is legally required.

3.3 Data from third parties

Meta. When you arrive from one of our ads, we may receive campaign, ad set and ad identifiers, and aggregated conversion reporting. We do not receive your Facebook or Instagram password or your private messages.

Publicly available information. Before a call, we may look at your public social media profile and public website to prepare. We only look at what anyone can see without logging in or sending a connection request.

Payment provider. If you become a client, we receive confirmation of payment status and the last four digits of your card. We never receive or store your full card number.

3.4 Data we deliberately do not collect

We do not ask for, and ask you not to send us, any special category data under Article 9 GDPR — data about your health, race or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, sex life or sexual orientation. We also do not collect government ID numbers, full payment card numbers, or precise GPS location.

If you volunteer such information (for example by mentioning a health matter on a call), we will not record it in our systems and will delete it where it has been recorded.

Note on faith. Our marketing speaks about values, discipline and faith. We never ask you about your religion and we never record it, and no part of our advertising targeting is based on religious belief. If you choose to raise your faith with us in conversation, that is your choice and we do not file it.

3.5 Children

Our services are strictly for adults operating a business. This website is not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you are under 18, do not submit the form. If we learn that we hold data about a minor, we will delete it promptly. If you believe we hold data about a child, contact us at [email protected].

We do not sell or share the personal data of consumers under 16 for cross-context behavioural advertising, and we have no actual knowledge of collecting such data.

4. Why we process your data, and our legal basis

Under the GDPR, we must have a lawful basis for every processing activity. Here they are.

4.1 To assess your application and talk to you about working together

What: reviewing your form and survey, scoring whether you fit, contacting you to book and hold a qualification call, following up about that call, preparing and sending a proposal.

Legal basis: Article 6(1)(b) GDPR — steps taken at your request prior to entering into a contract. You asked us to assess you; this is us doing that.

4.2 To provide the services, if you become a client

What: delivering the agreed services, managing the engagement, communicating with you and your team, reporting on results, calculating revenue share.

Legal basis: Article 6(1)(b) GDPR — performance of our contract with you.

4.3 To send you marketing emails and messages

What: educational content, case studies, reminders about your application, and offers for our services, by email, SMS or WhatsApp.

Legal basis: Article 6(1)(a) GDPR — your consent, given by ticking the marketing box on our form. Under Article 21 of Spanish Law 34/2002 (LSSI-CE), we need your prior consent before sending commercial communications by electronic means. For existing clients, we may also send you information about services similar to those you already bought, on the basis of Article 6(1)(f) and the existing-relationship exception in LSSI Article 21.2.

You can withdraw consent at any time — click "unsubscribe" in any email, reply STOP to any SMS, reply STOP to any WhatsApp message, or email us. Withdrawing marketing consent does not affect your application or your contract.

How we ask. We collect this consent through a separate, unticked box on the form. Submitting your application by itself is not consent to receive marketing from us, and we do not treat it as such.

4.4 To measure and improve our advertising

What: understanding which ads and pages bring applications, building audiences to find similar people, excluding people who already applied, and measuring conversions — including through the Meta Pixel and Meta's Conversions API.

Legal basis: Article 6(1)(a) GDPR — your consent, collected through our cookie banner, together with Article 22.2 LSSI for the storage of and access to information on your device.

4.5 To understand how our website is used

What: aggregate analytics — how many people reach the page, how far they scroll, how much of the video they watch, where they drop off.

Legal basis: consent for any analytics that uses non-essential cookies or similar identifiers. Where we use strictly aggregated, cookieless measurement that cannot identify you, we rely on Article 6(1)(f) — our legitimate interest in knowing whether our website works.

4.6 To run, secure and defend our business

What: keeping records, preventing fraud and abuse of our forms, protecting the site against attacks, enforcing our Terms, and establishing, exercising or defending legal claims.

Legal basis: Article 6(1)(f) GDPR — our legitimate interests in operating a secure business and protecting our legal position. We have assessed that this does not override your rights, because the data involved is limited to what is necessary and is not used to make decisions about you other than security decisions.

4.7 To comply with the law

What: issuing and keeping invoices, accounting and tax records, responding to lawful requests from authorities, and keeping proof of consent.

Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation, in particular Spanish tax, accounting and commercial law.

4.8 Automated decision-making and profiling

We use a simple scoring step on your application: answers such as audience size, current revenue and readiness to start help us decide who we speak to first. This is not a decision made solely by automated means. A human — Dave or a member of his team — reads every application before any decision is taken, and no legal or similarly significant decision about you is made automatically. You can always ask us to reconsider and to explain why your application was not taken forward.

We do profile website visitors for advertising purposes through the Meta Pixel, but only with your cookie consent, and that profiling does not affect your application.

5. Who we share your data with

We do not sell your personal data for money. We do share it with the service providers we need to run the business. Each is bound by a written contract that meets Article 28 GDPR and may only use your data on our instructions.

We do not use Google Analytics. Website and funnel analytics come from GoHighLevel and from Panda Video's player statistics only.

We may also disclose personal data:

• to professional advisers (lawyers, accountants, insurers) where necessary and under duty of confidentiality;
• to courts, regulators or public authorities where we are legally required to, or where it is necessary to establish or defend legal claims;
• to a buyer or successor if we sell or reorganise the business, under confidentiality obligations and subject to this policy;
• with your explicit consent, for anything else — for example, if you agree to appear in a testimonial.

Testimonials. We only publish your name, photo, video, handle or results with your separate written permission, and you can withdraw that permission at any time by emailing us. We will remove the testimonial from material we control within a reasonable time; we cannot recall copies others have already downloaded or screenshotted.

We keep this list current. If a provider in this list changes — a different CRM, a different video host — we update this table and the "Last updated" date above.

6. Meta Pixel, Conversions API and advertising

Because we advertise on Facebook and Instagram, we want to be explicit about this.

What we use. We use Meta's Business Tools on this website: the Meta Pixel (a small piece of code in the page) and, where enabled, the Conversions API (a server-to-server connection). Together they tell us, in aggregate, which of our ads led to applications.

What is sent to Meta. When these tools are active, Meta receives: the event that happened (for example, page view, video play, form submission), the URL you were on, your IP address, your browser user agent, and the Meta browser cookie _fbp or click identifier fbclid where present. Where we use the Conversions API for conversion matching, we may also send hashed (irreversibly scrambled) versions of your email address and phone number so Meta can match the conversion to an ad click. We do not send Meta the content of your survey answers, and we do not send any special category data.

Why. To measure whether our advertising works, to avoid showing ads to people who have already applied, and to find people with similar profiles.

Legal position. For some of this processing, Meta and we act as joint controllers within the meaning of Article 26 GDPR, and the allocation of responsibilities between us is set out in Meta's Controller-to-Controller Addendum, available in Meta's Business Tools Terms. Meta processes the data it receives for its own purposes as described in the Meta Privacy Policy. We are the point of contact for your rights in respect of the data we collect on this site; you may also exercise rights directly against Meta.

Your control.

• Before consent: these tools do not run. The pixel is blocked until you accept advertising cookies in our banner.
• To change your mind: open the cookie settings link in our footer and withdraw consent. The pixel stops firing and the cookies are removed.
• At Meta: you can control how your activity off Meta's products is used for your ads in Settings → Accounts Centre → Your information and permissions → Your activity off Meta technologies, and in Ad preferences.
• Industry opt-outs: youradchoices.com (US), youronlinechoices.eu (EU), optout.aboutads.info.
• Global Privacy Control: our site honours the GPC browser signal as a valid opt-out of sale/sharing.

If you are a California resident: our use of the Meta Pixel for advertising is treated as "sharing" personal information for cross-context behavioural advertising under the CCPA/CPRA. You have the right to opt out, and you can do so using the "Do Not Sell or Share My Personal Information" link in our footer or by enabling GPC. We do not sell personal information for monetary consideration.

7. International transfers

We are established in Spain. Some of our providers are outside the European Economic Area, mainly in the United States and Brazil. That means your personal data may be transferred to, and processed in, countries whose data protection laws differ from those in the EEA.

When we transfer personal data outside the EEA, we rely on one or more of the following, in this order of preference:

1. an adequacy decision of the European Commission — including the EU-US Data Privacy Framework for providers that are certified under it;
2. the European Commission's Standard Contractual Clauses (Decision 2021/914), together with a documented transfer impact assessment and, where needed, supplementary technical and organisational measures;
3. your explicit consent, or another derogation under Article 49 GDPR, in the limited cases where neither of the above is available.

For transfers from the United Kingdom, we use the UK International Data Transfer Addendum to the Standard Contractual Clauses, or the UK IDTA.

Honest note on the EU-US Data Privacy Framework. The EU-US adequacy decision was in force at the date of this policy. It is, however, subject to a pending appeal before the Court of Justice of the European Union (Case C-703/25 P, Latombe) and to political pressure following developments in the independence of US oversight bodies. We therefore maintain Standard Contractual Clauses as a parallel safeguard with our US providers, so that transfers remain lawful if the adequacy decision is annulled or withdrawn. We will update this policy if the position changes.

You can ask us for a copy of the safeguards we rely on for a specific transfer by emailing [email protected].

8. How long we keep your data

At the end of the applicable period we delete the data or anonymise it so that it can no longer be linked to you. Where deletion is technically impracticable — for example in backups — we isolate the data and delete it on the normal backup cycle.

9. How we protect your data

We take appropriate technical and organisational measures under Article 32 GDPR, including:

• encryption in transit (HTTPS/TLS across the whole site, enforced by our CDN) and encryption at rest with our providers;
• access control — only Dave and the specific team members who need it can see application data, each with their own account;
• multi-factor authentication on the CRM, email and hosting accounts;
• written data processing agreements with every provider that touches personal data;
• data minimisation — we do not ask for data we do not need, and we do not store card numbers or ID numbers;
• separation of marketing data from client delivery data where practicable;
• periodic review of who has access, at least annually and whenever someone leaves the team.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Spanish Data Protection Agency (AEPD) within 72 hours as required by Article 33 GDPR, and we will notify you directly without undue delay where the risk to you is high, as well as any other regulator whose law applies to you.

10. Your rights under the GDPR

If the GDPR applies to you, you have the right to:

How to exercise them. Email [email protected] with the right you want to exercise. We may need to ask for information to confirm your identity — we will only ask for what is proportionate, and we will not create a new ID record. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. Exercising your rights is free; we may charge a reasonable fee only for manifestly unfounded or excessive repeat requests.

Your right to complain. You can complain to the Spanish supervisory authority:

You may also complain to the supervisory authority of your EU country of residence or workplace. UK residents may complain to the Information Commissioner's Office, ico.org.uk. We would appreciate the chance to resolve it with you first, but you do not have to come to us before going to a regulator.

11. Marketing communications, WhatsApp and SMS

We only send marketing by email, SMS or WhatsApp with your prior consent, collected through a separate, unticked box.

Every marketing email contains a one-click unsubscribe link that works without logging in.

To stop SMS, reply STOP. To stop WhatsApp, reply STOP or block the number.

You can also email [email protected] and we will remove you from everything.

We will keep sending you service messages about an active application or contract — confirming your call, sending a proposal, invoicing you — because those are not marketing. If you want those to stop too, tell us and we will close your application.

We do not share your email, phone number or WhatsApp number with other companies for their marketing.

WhatsApp. If you give us your WhatsApp number, we will use WhatsApp to contact you about your application. WhatsApp is operated by Meta and your use of it is governed by Meta's own terms and privacy policy. If you would rather not be contacted on WhatsApp, say so and we will use email only.

12. Calls and recordings

If we hold a qualification call or a client call with you:

• We will always tell you at the start if we intend to record, and we will ask for your consent. You can say no, and the call will go ahead unrecorded.
• Recordings and any transcript are used only to avoid re-asking you questions, to brief the team who would work with you, and to improve how we run calls.
• We do not publish any part of a call without your separate written permission.
• Recordings are deleted after the period in Section 8.

Note: recording a call without the knowledge of all parties is unlawful in Spain and in several US states, Canada, Australia and New Zealand. We ask every time.

13. Additional rights by region

13.1 California (CCPA / CPRA)

Categories of personal information we have collected in the last 12 months, by reference to the CCPA categories:

Sources, purposes and retention are in Sections 3, 4 and 8.

Sale and sharing. We do not sell personal information for monetary consideration. We do "share" identifiers and internet activity with Meta for cross-context behavioural advertising, as described in Section 6. We do not use or disclose sensitive personal information for purposes that would trigger the right to limit, so we do not offer a separate "Limit the Use of My Sensitive Personal Information" link.

Your rights: to know and access; to delete; to correct; to opt out of sale/sharing; to non-discrimination for exercising your rights; and to appeal a refusal.

How to exercise: use the "Do Not Sell or Share My Personal Information" link in our footer, enable Global Privacy Control in your browser, or email [email protected]. We verify requests by matching the details you give us against our records and, for deletion, by confirming from the email address on file. An authorised agent may act for you with written permission that we can verify. We will not discriminate against you — our prices and our service do not change because you exercised a right.

13.2 Other US states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island or another state with a comprehensive privacy law, you have broadly equivalent rights: to confirm and access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale and certain profiling. You also have the right to appeal if we refuse a request — reply to our refusal and we will reconsider within the time your state's law allows, and tell you how to contact your Attorney General if you remain unsatisfied. We honour universal opt-out mechanisms including Global Privacy Control. We do not process sensitive data, so no separate consent mechanism is needed for it.

13.3 Canada (PIPEDA, and Quebec Law 25)

We collect, use and disclose personal information with your knowledge and consent, for the purposes identified in Section 4, limited to what a reasonable person would consider appropriate. You have the right to access your personal information and to challenge its accuracy. We are accountable for personal information transferred to a third party for processing, and we use contractual means to give it comparable protection — including where it is processed outside Canada, where it may be accessible to foreign courts and authorities.

You may complain to us first at [email protected] and then to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Quebec residents additionally have rights of de-indexing and portability and the right to be informed of automated decisions; our privacy contact in Section 1 is the person responsible for the protection of personal information.

13.4 Australia (Privacy Act 1988 and the Australian Privacy Principles)

We handle personal information in line with the APPs. We collect it directly from you, for the purposes in Section 4, and we will not use it for an unrelated secondary purpose without your consent or another APP 6 ground. We do not use government identifiers. We disclose personal information to overseas recipients in the countries listed in Section 5 (principally the United States, Ireland, Spain and Brazil), and we take reasonable steps under APP 8 to ensure they handle it consistently with the APPs. We do not use or disclose personal information for direct marketing without a lawful basis under APP 7, and every message gives you a simple way to opt out.

You can request access and correction under APP 12 and 13 by emailing [email protected]. If you are not satisfied with how we handled your complaint, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

13.5 New Zealand (Privacy Act 2020)

We collect personal information directly from you for the lawful purposes in Section 4, we tell you why at the point of collection, and we do not collect it unfairly or unreasonably intrusively (IPPs 1–4). We take reasonable steps to keep it accurate and secure (IPPs 5, 8) and to delete it when no longer needed (IPP 9). Before disclosing personal information outside New Zealand, we satisfy ourselves under IPP 12 that the recipient is subject to comparable safeguards, by contract where necessary. You have the right to access and correct your information under IPPs 6 and 7.

Complaints: [email protected], and then the Office of the Privacy Commissioner (privacy.org.nz).

13.6 United Kingdom

The UK GDPR and the Data Protection Act 2018 apply to our processing of UK residents' data on substantially the same terms as set out above. Your rights are the same as in Section 10, and your supervisory authority is the Information Commissioner's Office (ico.org.uk).

14. Links to other sites and social media

Our pages link to third parties — for example our Instagram profile, a scheduling page, or a payment page. Once you follow a link you are on their site, under their privacy policy, and this policy no longer applies. We are not responsible for their practices, and we encourage you to read their policies. We do not embed social media "like" or "share" buttons that load third-party code before you consent.

15. Changes to this policy

We may update this policy as our business, our tools or the law change. When we do:

• we update the "Last updated" date and the version number at the top;
• for material changes — a new purpose, a new category of recipient, a new legal basis, or a change that affects your rights — we will give you prominent notice on the website and, where we hold your contact details and the law requires it, by email, before the change takes effect;
• where a change requires your consent, we will ask for it rather than assume it.

We keep previous versions and will provide one on request.

16. Contact

Questions, requests or complaints about privacy:

We aim to reply within 5 working days, and in any event within the statutory deadline that applies to your request.

Related pages: Cookie Policy · Terms and Conditions · Earnings Disclaimer