Privacy Policy

Who processes the data

The data controller for data submitted through the website is the Amiscon team. Mailing address: Av. d’Aragón, 30, 8th floor, 46021 Valencia, Spain. Contact address for any data-related questions and requests — [email protected].

The client contract is signed by the group legal entity that matches the project’s jurisdiction; its details are stated in the contract itself. This does not affect the processing of data received through the site: the controller is the team listed above.

We have not appointed a separate Data Protection Officer (DPO): under Art. 37 GDPR this is required for large-scale systematic monitoring or processing of special categories of data, and we do neither. The team handles data requests at [email protected], and a person replies, not an autoresponder.

What data is collected

Below is the full list. Not “including” and not “including, but not limited to”: if something is not in the table, it is not in the system either.

The bottom three rows of the table work only with your consent. Until you respond to the banner, Google and Meta tags do not load on the page at all — not “they load but don’t set cookies,” but they are physically absent from the markup. You can verify this in a minute in developer tools, the Network tab.

Why this data is needed and the legal basis

On legitimate interest for spam and security, we have to say it plainly: here we weighed our benefit against your privacy and decided in our favor. The balancing test came out like this. IP and user-agent do not reveal anything about you beyond what any server on the internet already sees; we keep them for a short time; the alternative is a CAPTCHA, which collects noticeably more about the visitor and loads a third-party script on every page load. If you disagree with this assessment, you have the right to object — see the section on rights.

We do not run mailings: there is no subscription on the website, and the address you leave in a request is not added to any mailing list.

How long the data is stored

Before the deadline — at your request. There is one exception: what we must retain under accounting law is not deleted before its retention period ends, and we will say that directly in our reply rather than stay silent.

Who the data is shared with

We do not sell data or share it for someone else’s advertising. Access is limited to service providers without whom the website and email correspondence would not work. Full list:

A form submission along with the click ID may be sent to the ad dashboard as a conversion — so the platform learns to bring in similar customers. In that case, it sends the click identifier and the deal event, not your name, email, or task description: the ad system doesn’t need them, and we don’t share them.

Separately: data may be disclosed upon a mandatory request from a government authority if it is lawful and properly issued. We verify such a request, not comply with the first letter we receive.

Transfer outside the EEA

Some vendors from the table above are U.S. companies. Where processing goes beyond the European Economic Area, it relies on one of the mechanisms in Chapter V GDPR: an EU Commission adequacy decision (for U.S. companies — the EU–US Data Privacy Framework) or the EU Commission’s Standard Contractual Clauses.

In plain terms: your data does not go where you would have no rights left. If a provider falls outside reasonable bounds, we either move to standard contractual terms or change the provider.

How the data is protected

The measures are proportionate to the risk, as required by Art. 32 GDPR, and these are concrete steps, not a statement of intent:

• All website and API traffic uses HTTPS; there is no open HTTP.
• Access to the requests database is limited to employees who need it for their work, using named user accounts.
• The form is protected from automated submissions with a hidden honeypot field and a fill-speed check, not a third-party CAPTCHA that would collect more about you than we do.
• Resubmitting the form does not create a duplicate request: each submission has its own idempotency key.
• A request is saved to the database before emails are sent — so a mail provider rejection does not result in a silent loss of the submission.
• We do not ask for more data than needed: a phone number is optional, and the form’s internal fields do not go into the database at all.

If a breach does happen and it threatens your rights, we will notify the supervisory authority within 72 hours, as required by Art. 33 GDPR, and inform you if the risk is high. If you notice an incident before we do, email [email protected] — we’ll address it immediately.

Your rights

Under GDPR, you have the right to:

• get a copy of your data and see exactly what we have (Art. 15);
• correct inaccurate data (Art. 16);
• request deletion (Art. 17);
• restrict processing (Art. 18);
• object to processing based on legitimate interests — for example, to storing IP addresses for spam protection (Art. 21);
• receive your data in a machine-readable format and transfer it to another controller (Art. 20);
• Withdraw consent for analytics and ads in one click — with the “Cookie settings” button in the footer of any page. Withdrawal does not affect the lawfulness of processing before withdrawal, but it stops it going forward and clears the tags from your browser.

To exercise any right, email [email protected]. No separate form, registration, or explanation is required — an email from the address you previously gave us is enough.

We will respond within one month, as required by Art. 12(3) GDPR. If the request is complex and a month isn’t enough, we will notify you within the same period and state the new deadline — the rules allow an extension of up to two more months, and you can’t use it silently. The request is free of charge.

If the email does not come from the address used in the conversation, we will ask you to confirm your identity. This is not bureaucracy: giving data to someone other than the person who provided it is a data breach in itself.

Complaint to the supervisory authority

If you are not satisfied with our response, you have the right to contact a data protection supervisory authority. For our place of registration, this is the Agencia Española de Protección de Datos, aepd.es. You can also file a complaint with the authority in your EU country or where the alleged violation took place — it’s your choice.

We ask, but do not require, that you write to us at [email protected] first: most issues are resolved by email in a couple of days, while a complaint can take months. Contacting us is not a mandatory prerequisite for filing a complaint.

Automated solutions and profiling

We do not make decisions that produce legal or other significant effects for you and are based solely on automated processing (Art. 22 GDPR). Who sees an ad is not such a decision: it does not restrict you in any way.

This should be said plainly, not hidden behind general wording. If you agreed to marketing cookies, Google and Meta ad platforms assign you to audiences under their own rules — that is profiling, and they do it, not us. We do not build our own profiles, and we do not buy or sell lists. Refusing the marketing category stops this transfer; you can also adjust ad delivery on the platforms’ side, in your Google account and in Meta ad settings.

The only automation related to your request is spam filtering: a form submitted faster than a human can physically do it is flagged as spam. It is not deleted and remains visible in the admin panel, and an employee makes the decision. If your request still did not get a response, email us — we’ll handle it manually.

Children

The website is intended for company representatives and is not meant for children. We knowingly do not collect data from people under 16; if such data reached us by mistake, write to us — we will delete it.

Document changes

If the way we process data changes — analytics appears, a new data recipient is added, or a new entry is stored in your browser, — we will update this document and change the date at the top of the page. Material changes will be described as a separate item, not buried in the text.

Changes that affect what we asked your consent for do not take effect right away: we ask for consent again, and the old consent stops applying. We will not silently expand its scope.