Legal
Data processing terms
When you publish a website with Tsurito, its visitors leave personal data with us: their internet address while we serve them a page, and their name, email address and message when they write to you through the contact form. Under the GDPR, you are the controller of that data, and we are your processor. These terms, as Article 28 of the GDPR asks, say what we do with it for you. They are part of our Terms of service, and you accept them when you publish. If these terms and the Terms of service say different things about personal data, these terms win.
Who is who
You, the owner of the website, are the controller. You decide what your website asks of its visitors and what you do with what they send you.
We, Miguel Angel Avalos Fernandez, self-employed, trading as AVALSYS, at Av. Ernest Lluch 32, TecnoCampus Mataró-Maresme TCM 3, 08302 Mataró, Spain, are the processor. We process the data of your visitors only to serve your website and to pass their messages to you.
What we process for you
| Processing | Whose data | Which data | For how long |
|---|---|---|---|
| Serving the pages of your website | Its visitors | Internet address and browser details, while a page is served | Only while the page is served; Cloudflare's network keeps its short address records under its own terms |
| Counting page views, and visitor numbers if you switch them on | Its visitors | The website, the address and path of the page, and the totals; counted without cookies and without keeping who visited | Totals stay with your website |
| Checking that a form is filled in by a person | Its visitors | The check made by Cloudflare's Turnstile | Only while the check runs |
| Passing the messages of your contact form to you | The people who write to you | Their name, email address and message | Only while the message is sent; we keep a monthly count |
We do not process special categories of data for you on purpose. If a visitor writes something of that kind in a message, it goes to you as the rest of the message.
Your instructions
We process this data only on your instructions. Your instructions are these terms, the Terms of service, and what you choose in the application: which contact address receives the messages, whether visitor numbers are on, and whether the website is published at all. We do not use your visitors' data for anything of our own. If we believe an instruction breaks the law, we tell you.
What we promise
- Confidentiality. The only person who works on the service is bound to keep it confidential.
- Security. We take the measures described on our Security page: everything travels encrypted, accounts and the administration pages are protected, and the data lives with the processors named below under their own safeguards. We may improve these measures, never lower them.
- Help with requests. If a visitor asks you about their data, we help you answer within the limits of what we keep, which is little: their messages are with you, not with us.
- Breaches. If personal data of your visitors is lost, changed or seen by someone who should not, we tell you without undue delay after we learn of it, with what we know and what we are doing.
- Information. We give you the information you reasonably need to show that this processing follows the GDPR, and we answer your questions at hello@tsurito.com. We answer first in writing. If that is not enough for you or your supervisory authority, an inspection is possible once a year, with four weeks' notice, at a time agreed with us and at your cost.
Who helps us
We use other companies to do this work. They are listed, with what they do, which data they see and where, on the page Who helps us run the service, which is part of these terms. Each of them is bound by a contract with the same duties as ours, and transfers outside the European Union rest on the safeguards named there. We tell you by email at least 30 days before a processor is added or replaced. If you object to the change, you can take your website off the internet or cancel its subscription before the change applies, and nothing more is charged.
When it ends
This processing ends when your website goes off the internet, when you delete it, or when your account is deleted. At that point the little we keep of your visitors' data goes with the website, as our Privacy policy says, unless the law asks us to keep something. Before that, you can download a copy of your website in the application at any time. Your visitors' messages are already yours, in your inbox.
Your side
You make sure your website tells its visitors who you are and what you do with what they send you, and that you have a lawful basis for it. Each website carries its own legal pages for this, and you complete them with your details. You also make sure that you may give us the data you ask your visitors for.
These terms are made in English. If a translation of them differs from the English text, the English text applies.
Questions about these terms go to hello@tsurito.com.
Last updated: 1 October 2026.