Privacy policy
Last updated
What we collect through this website, why, who handles it, how long we keep it, and what you can ask us to do with it.
1. Who is responsible for your data
The data controller is Evolutia Asesores S.L., CIF B-[XXXXXXXX], registered office [registered office address]. For anything to do with your personal data, write to [privacy email address].
Data protection officer: [data protection officer, if appointed].
2. What we collect, and why
| When | What we collect | Why | Legal basis |
|---|---|---|---|
| You send the contact form | Your name and email address; optionally your company, where the parent company is based, how many people you have in Spain, which situation describes you, and your message. | To reply to you, and to prepare a proposal if you ask for one. | Steps you ask us to take before a possible contract (Art. 6(1)(b) GDPR). |
| Alongside the form | The page you sent it from, the page that brought you to our site (address only, never its query), any campaign tags or partner referral code in the link you followed, and which service the link was about. | To know which pages and partners bring enquiries, and to credit a partner who referred you. | Our legitimate interest in understanding and running our business (Art. 6(1)(f) GDPR). |
| You subscribe to our monthly email | Your email address, and the same page and link details as above. | To send you the monthly email until you unsubscribe. | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. |
| You visit any page | Technical data your browser sends: IP address, browser and device type, the page requested and the time. Our analytics count visits without cookies and without identifying you. | To deliver the website, keep it secure, and see which pages are read. | Our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR). |
We do not use your data for automated decision-making or profiling, and we never sell it. We do not knowingly collect data from anyone under 14.
If you become a client, the personal data we handle for you, including your employees’ payroll data, is governed by your engagement letter and a written data processing agreement, not by this page.
3. Who handles your data for us
We use a small number of service providers, each bound by a data processing agreement and acting only on our instructions:
- Supabase stores the messages sent through our forms, in [Supabase project region, e.g. EU (Frankfurt)].
- Vercel Inc. hosts this website and provides our cookie-free analytics.
- Google serves the fonts this website uses, which means your browser sends your IP address to Google when it loads them.
- [email provider] delivers our email, including our replies to you.
We also disclose data where the law requires it, for example to the tax authorities or to the regulators that supervise our professions, and, under anti-money-laundering law, when we take on a client.
4. Transfers outside the European Economic Area
Vercel and Google are based in the United States and may process some data there. Where that happens, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses. Messages sent through our forms are stored in the EU.
5. How long we keep it
- Enquiries that don’t lead to an engagement: [X] months after our last exchange, then deleted.
- Enquiries that become clients: for the life of the engagement, then for as long as the law requires us to keep client records: in general six years under the Commercial Code, four years for tax purposes, and ten years for anti-money-laundering records.
- Monthly email: until you unsubscribe.
- Technical logs: for the short periods our hosting provider keeps them for security.
6. Your rights
You can ask us, at any time and free of charge, to:
- tell you what personal data we hold about you and give you a copy (access);
- correct anything that is wrong (rectification);
- delete it, where we no longer need it or have no legal reason to keep it (erasure);
- limit how we use it while a question is resolved (restriction);
- stop using it on the basis of our legitimate interest (objection);
- send it to you or another provider in a usable format (portability);
- withdraw consent you have given, without affecting what we did before.
Write to [privacy email address]. We may ask you to confirm your identity. We will reply within one month, or tell you within that month if we need longer.
If you are not satisfied with our answer, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es), or to the data protection authority where you live.
7. Security
We protect personal data with access controls, encrypted connections and limited, need-to-know access within the firm. The database behind our forms accepts new messages from the website but cannot be read, changed or deleted from it.
8. Changes to this policy
If we change how we handle personal data, we will update this page and its date. For significant changes affecting people whose data we already hold, we will tell them directly.