Last updated: 20 October 2026 · Version 1.1
This policy explains how JAMP Web Solutions processes personal data when you visit our websites, buy or use our software, connect our plugins to Google, Meta or TikTok, or work with us as a client.
1. Who we are
Controller: IOANNIS PASSALIDIS, sole trader (autónomo), trading as JAMP Web Solutions. NIF Z5585289C. Calle Monte de Piedad 5, 18010 Granada, Spain. Email: info@jamp.gr.
We are a one-person business and have not appointed a Data Protection Officer, as the law does not require one for our activity. All privacy requests go to info@jamp.gr.
2. Summary
- Our plugins run on your own website. Your store’s orders, customers and advertising data stay on your server.
- When our plugins talk to our servers, they send only what is needed for licensing and updates (licence key, site address, version numbers).
- When you connect Google, Meta or TikTok through our service, we use the access only to perform the functions you ask for in the plugin. We do not sell data, we do not use it for advertising, and we do not use it to train AI models.
- On our websites, Google Analytics and Google Ads cookies are used only if you accept them in the cookie banner. We do not sell data.
3. What we process, why, and on what legal basis
3.1 Website visitors (jamp.gr, plugins.jamp.gr)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address, browser, pages requested (server logs) | Security, preventing abuse, fixing errors | Legitimate interest (Art. 6(1)(f) GDPR) | 30 days |
| Name, email, message (contact form) | Answering your enquiry; spam protection with our own checks on our server (no third-party service, no cookies); messages flagged as spam are kept for 30 days and then deleted automatically | Pre-contractual steps / legitimate interest (Art. 6(1)(b), (f)) | Up to 2 years after the last contact, unless it becomes a client relationship |
| Visit statistics and advert measurement with Google Analytics 4 and Google Ads (pages viewed, referrer, device, approximate location, ad clicks and conversions; pseudonymous identifiers in cookies) | Understanding which pages and products interest visitors; measuring and improving our adverts (including remarketing) | Consent (Art. 6(1)(a) GDPR, Art. 22.2 LSSI-CE), withdrawable at any time via “Cookie settings” | Analytics data 14 months; cookies as listed in the Cookie Policy |
| Cookies | See Cookie Policy |
3.2 Customers of our software (plugins and modules)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, billing country, order details | Selling the licence, invoicing, tax | Contract and legal obligation (Art. 6(1)(b), (c)) | As required by tax law (in Spain, generally 4–6 years) |
| Licence key, site URL, plugin, WordPress/WooCommerce/PHP version, site language | Activating and validating the licence, delivering updates, compatibility, support | Contract (Art. 6(1)(b)) | While the licence is active + 90 days |
| Support messages and attachments | Providing support | Contract (Art. 6(1)(b)) | Up to 3 years after the ticket is closed |
Payments are processed by Lemon Squeezy (Lemon Squeezy LLC, a Stripe company), which acts as Merchant of Record: it is the seller of record, collects the payment, issues the receipt and handles sales tax/VAT. Lemon Squeezy processes your payment data as an independent controller under its own privacy policy. We never see your full card details.
3.3 Connecting Google, Meta or TikTok (“Connect” buttons in our plugins)
Some plugins let a store owner connect their own Google Ads, Google Merchant Center, Meta (Facebook/Instagram) or TikTok advertising accounts.
- What we receive: an authorisation (OAuth token) for the accounts you choose, and the basic profile information the platform returns (account name, account IDs, email of the connecting user).
- What it is used for: only for the functions you activate in the plugin, for example reading campaign performance, sending conversions, or managing customer lists for audiences.
- Where the tokens are stored: on your website, encrypted. Our servers only relay the connection and, for Google Ads, add our developer token to the request. We do not keep copies of the tokens, and we do not log the content of the requests or responses.
- Customer lists and conversions: if you use features such as Customer Match or Conversions API, email addresses and phone numbers are hashed (SHA-256) on your website before they are sent. They pass through our servers only in that hashed form and are not stored.
- Revoking access: you can disconnect at any time from the plugin settings, or directly in your Google, Meta or TikTok account settings. See also our Data Deletion instructions.
Google API Services: Limited Use. JAMP Web Solutions’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Google user data for advertising, we do not sell it, we do not allow humans to read it except with your explicit consent for support, for security purposes or where the law requires it, and we do not use it to develop, improve or train generalised AI or machine-learning models.
For this processing, the store owner is the controller of their store’s customer data and JAMP Web Solutions acts as processor. The terms are set out in our Data Processing Agreement.
3.4 Clients of our services (development, hosting, Google Ads management)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Contact and billing details of the client and its contacts | Contract, invoicing, communication | Contract and legal obligation | Duration of the contract + legal retention periods |
| Data in websites we host or maintain for clients | Providing the service | We act as processor under the DPA | As instructed by the client |
4. Who we share data with
We use a small number of service providers (sub-processors). The current list is at jamp.gr/subprocessors. The main ones are: – Contabo GmbH (Germany): servers that host our websites and services. – Lemon Squeezy LLC (USA): sales, payments, licence keys (independent controller, see 3.2). – Google Ireland Ltd / Google LLC: Google Analytics and Google Ads on our websites, only with your consent; Google acts as processor for analytics and as independent controller for advertising purposes. – Google, Meta, TikTok: only when you choose to connect your accounts, and only towards your own accounts. – Our tax adviser (gestor) in Spain: invoices, as required by law.
We do not sell personal data.
5. International transfers
Some providers are located outside the European Economic Area (for example Lemon Squeezy and Google LLC in the USA). Where this happens, the transfer is based on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
6. Your rights
You can ask us to access, correct or delete your data, to restrict or object to processing, or to receive your data in a portable format. Where processing is based on consent, you can withdraw it at any time. Write to info@jamp.gr; we answer within one month.
If you are not satisfied, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or to the authority of your country of residence.
7. Security
We use encrypted connections (TLS), access with keys and two-factor authentication, separate system users per service, encrypted off-site backups and the minimum data necessary.
8. Children
Our services are intended for businesses and are not directed at children under 16.
9. Changes
We will publish any changes on this page with a new date. If the changes are significant, we will inform active customers by email.
In case of discrepancy between language versions, the Spanish version prevails.