B2B website visitor identification in Spain

The Agencia Española de Protección de Datos (AEPD) is the national supervisory authority for private companies, alongside regional authorities in Catalonia, the Basque Country and Andalusia that cover their own public sectors. The AEPD is one of the most active regulators in the EU: it resolves a high volume of individual complaints, publishes detailed guides on cookies, legitimate interest and specific sectors, and makes its resolutions public, which gives companies an unusually clear picture of what it actually objects to in practice. For a private company website selling B2B, the AEPD and its published guidance — not just the GDPR text in the abstract — are the working reference. Spanish reviewers frequently cite a specific AEPD guide by name when asking questions, so being able to point to the relevant one shortens the conversation considerably.

It provides a genuinely useful anchor that most other member states' implementing laws do not have. Article 19 of the LOPDGDD addresses the processing of contact data belonging to individuals acting in their capacity as representatives of a legal entity, and treats processing carried out for the purpose of maintaining that business relationship as capable of resting on legitimate interest. That is directly relevant to B2B visitor identification and worth citing explicitly in a Spanish legal assessment. It is important to keep the scope accurate, though: Article 19 concerns business-contact data of named representatives, it is not a general licence to build individual visitor profiles, and it does not remove the need for transparency toward visitors or for carrying out a documented balancing test before relying on legitimate interest.

Article 22.2 of the LSSI-CE (Ley 34/2002) requires clear information and prior consent before storing or retrieving information on a visitor's device, unless doing so is strictly necessary for a service the visitor has explicitly requested. The AEPD's cookie guide is unusually detailed for a European regulator: it sets concrete expectations for banner layout, states plainly that rejecting cookies must be exactly as accessible as accepting them, and addresses grey areas such as continued browsing and pre-ticked boxes. lead.box identifies companies from network-level information rather than placing an advertising identifier or fingerprinting script on a visitor's device, so it does not fall within what that consent requirement targets — but the rest of your site's banner is still measured against the AEPD guide independently of this tool, and Spanish reviewers check that carefully.

Visitor data is processed in ISO-certified EU data centres, and the Art. 28 GDPR data processing agreement together with a versioned, named sub-processor list is published so a Spanish legal or procurement reviewer can complete their assessment before any commercial commitment is made. This matters in Spain specifically because the AEPD has been active on international transfer questions since Schrems II, and Spanish reviewers routinely ask where data lands as one of their first questions, well before discussing legal basis or retention. Being able to answer with an EU-only location, backed by a public sub-processor list rather than a promise made over a call, typically closes that line of questioning immediately and lets the conversation move on to the more substantive legitimate-interest assessment.

The LSSI-CE also imposes duties that Spanish reviewers frequently bundle into the same conversation even though they have nothing to do with privacy as such: an obligation to publish clear identifying information about the service provider (the aviso legal) on the website, and specific rules governing commercial communications sent by electronic means, including unsolicited email. A Spanish buyer evaluating a visitor-identification tool will often ask, almost in passing, whether your own site's legal notice is complete and whether any follow-up outreach your sales team plans to send respects those commercial-communication rules. Having both in order before the conversation starts avoids an unrelated compliance gap slowing down what is otherwise a straightforward data protection review focused on the tool itself.

Not typically for data protection purposes, but Spanish procurement teams frequently cross-check a vendor's registered details — company name, CIF tax identifier, registered address — against the Registro Mercantil as part of standard supplier due diligence, separately from the privacy assessment itself. This is routine Spanish business practice rather than a data protection requirement, and it usually runs in parallel with the AEPD-focused questions about legal basis, cookies and processing location. Larger Spanish organisations, particularly in regulated sectors, sometimes also want confirmation that no telecom-specific numbering or premium-rate rules apply, which is straightforward to answer since a company-level website identifier does not involve telephone numbering at all.

Spanish B2B sales teams commonly run on Salesforce, HubSpot or homegrown CRM setups paired with a dedicated commercial team that works relationship-led sales cycles, so a visitor-identification tool needs to feed that workflow rather than sit as a standalone report. lead.box surfaces identified companies through webhooks and CSV, Excel or JSON export, letting a Spanish sales operations contact route new company records into existing pipelines, assign them by territorio or cuenta, and trigger the same commercial follow-up used for other inbound signals. Because Spanish B2B relies heavily on warm, well-prepared outreach rather than cold volume, having a named company and its viewed pages available inside the CRM before the first call gives a commercial team a legitimate, locally relevant reason to reach out.

Yes. lead.box supports self-service management of team seats, data exports and cancellation, which matters in the Spanish market because procurement teams there are used to negotiating multi-year framework agreements for larger software purchases and often expect the same rigidity from every vendor by default. Being able to add seats as adoption grows, export everything collected at any time in CSV, Excel or JSON format, and cancel directly without going through a renewal negotiation gives a Spanish buyer a lower-risk way to trial the tool before committing budget through a formal procurement cycle. This flexibility is frequently the deciding factor for mid-market Spanish companies choosing to pilot a new data source rather than commit to it outright.