Privacy policy

This is an English translation for information purposes. If there is any discrepancy, the Spanish version prevails.

This policy explains how we process the data of people who visit the Igneva website or contact us through the form or by email. It does not govern the data that a client asks us to process within a project: that processing is set out in the corresponding agreement.

Who processes your data?

The controller is IGNEVA SOLUTIONS, S.L., which operates under the Igneva brand.

For privacy queries or to exercise your rights you can write to hola@igneva.com.

What data do we collect?

• Contact and enquiry data. The form asks for your name and email, needed to respond to you, and lets you add an optional message. If you write to us by email, we also process the content of the conversation and the data you include, such as your company or your role.
• Origin of the contact. When you submit the form we may receive the address of the previous page provided by the browser, the path of the form and the campaign parameters contained in its URL. This data is linked to your enquiry so we know where it came from. It is not equivalent to a complete browsing history.
• Submission management data. We record its date, enquiry category, notification status and the identifiers needed to avoid duplicates and to keep a record of the privacy information that was available.
• Technical data. The connection requires processing your IP address. The form uses it to limit abusive submissions by means of a temporary key held in memory. Hosting, email delivery and service security may also require technical logs.

You do not need to include health data, passwords, identity documents or confidential third-party information to describe your enquiry. If the name or the email is missing from the form, we will not be able to process that submission; the message and the origin data are not mandatory to request contact.

What do we use it for and on what legal basis?

Handling enquiries and maintaining professional contact. Our legitimate interest is to reply to whoever writes to us and to assess a possible relationship between Igneva and their organisation. We use the data necessary for that purpose. When you act as a representative of a company, the basis does not become a contract with you merely because your company hires us.

Preparing or performing a contract with you. If you request a service for yourself as a sole trader or professional, we process the data necessary to take the pre-contractual steps you ask of us and, where applicable, to perform that contract.

Knowing where enquiries come from. Our legitimate interest is to assess which contact channels work. For this we use the origin linked to the submission, without adding an advertising identifier to follow you between visits. You can object to this processing.

Protecting the site and managing submissions. Our legitimate interest is to prevent abuse, avoid duplicates and detect incidents. For this we use the technical and management data necessary.

Complying with legal obligations. We process the data necessary to handle requests to exercise your rights, to demonstrate compliance with our data protection obligations and to keep the documentation required by the applicable rules. When it is necessary to bring or defend a claim, we will keep the relevant information on the basis of our legitimate interest in defending our rights.

We do not ask for consent for the processing based on these legal bases. The form contains an informative summary and a link to this policy before you send the enquiry.

Do we send you advertising?

Sending an enquiry does not subscribe you to a newsletter or authorise advertising campaigns. We use your contact details to respond to what you have asked us for. If we introduce commercial communications for another purpose, we will tell you about it and obtain consent where necessary.

Who else sees your data?

The people at Igneva who handle enquiries and the providers needed to deliver the service:

• Hetzner, for hosting the site and the contacts database.
• Resend (Plus Five Five, Inc.), to send the form notification to our mailbox. That notification includes your contact details, the message and the origin information.
• Google Workspace, to receive and manage corporate email and the conversation with you.

The contacts register and the mailbox are separate locations of your data. If there is an incident when saving the form, the application has temporary storage to recover the submission.

Providers process the data under the agreements that apply to their services and may use sub-processors. We may also disclose information to authorities when there is a legal obligation. We do not sell your data or give it to third parties for their advertising.

Does your data leave the European Union?

The hosting planned for this website and its contacts database is in Germany. This does not mean that all the data stays in the European Union: email services may involve processing in other countries.

Resend states that its main processing operations take place in the United States. Its data processing agreement incorporates the European Commission’s standard contractual clauses for the transfers to which they apply. Google describes the locations and transfer mechanisms of its services in its data processing addendum.

You can request, by writing to the contact email, information about the safeguards that apply to your data and a copy of them, with any protection required for third-party information.

How long do we keep it?

For enquiries that do not lead to a contract, we keep your contact details and your message for as long as there is still interest in a possible collaboration. We will deal with deletion requests without undue delay and will also delete the data when it is no longer necessary for that purpose. This applies to the contacts register and to email copies.

If we enter into a contract with you or your company, we keep the data necessary during the relationship and, afterwards, the documentation that must be kept to comply with legal obligations or to deal with liabilities. There is no single period for all data: for example, the Spanish Commercial Code sets six years from the last entry for the business documentation it regulates.

When deletion applies, we will delete the data from the active systems under our control. Data subject to a blocking obligation will be kept restricted for the corresponding legal period and destroyed when it ends. Backups do not return to ordinary use and are overwritten according to their retention cycle; if a backup is restored because of an incident, we will re-apply the deletion requests that are still enforceable.

For access and security logs, the planned period is fourteen days, unless it is necessary to keep information related to an incident or a legal obligation. The form’s temporary protection keys are renewed daily; they are not a permanent browsing identifier.

Do we make automated decisions about you?

We do not use the form to take decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you. Enquiries are handled by people.

There are automatic security and duplicate checks that may reject or limit a submission. If the form does not let you get in touch, you can write to hola@igneva.com.

What about cookies and tracking?

The website does not include behavioural advertising tools or advertising pixels. The form records the origin of that submission, without installing an identifier to follow you between visits. If we introduce technologies that require consent, we will inform you and ask for it before using them.

Links to external pages, such as professional profiles, lead to sites with their own privacy policies.

What rights do you have and how do you exercise them?

You can exercise them by writing to hola@igneva.com. Exercising them is free of charge, with the exceptions provided for in the regulations. We will only ask for additional information to verify your identity if there are reasonable doubts, and only to the extent necessary.

• Access. To know whether we process data about you and to obtain a copy and information about its processing.
• Rectification. To correct inaccurate data or complete incomplete data.
• Erasure. To request its deletion when the legal requirements are met.
• Objection. To object, on grounds relating to your particular situation, to processing based on legitimate interest. We will stop processing it unless we demonstrate compelling legitimate grounds that prevail or that are necessary to bring, exercise or defend claims. Objection to direct marketing does not require justifying a particular situation.
• Restriction. To ask us to restrict the use of the data in the cases provided for by law.
• Portability. To receive the data you have given us in a structured, commonly used and machine-readable format, and to transmit it to another controller, when the processing is automated and based on your consent or on a contract with you. It is not the same as access and does not apply in this way to processing based solely on legitimate interest.

If any processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of the earlier processing.

We will reply without undue delay and, at most, within one month of receipt. If the complexity or the number of requests requires an extension, we may extend the period by up to two further months, informing you of the extension and its reasons within the first month.

You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), through its online portal, or with the competent supervisory authority.

How do we protect the data?

The website uses HTTPS to encrypt the connection between your browser and the server. This does not mean that the message is unreadable to Igneva or for the providers involved in processing it.

We apply access controls and measures against abusive submissions. We limit the data used to what is necessary for each purpose. No measure can guarantee absolute security.

How do we record what we told you?

When we receive the form we record the version of this policy and a fingerprint of the informative summary linked to the submission. That fingerprint identifies the text of the summary and the version used; it does not contain proof that you have read the page and is not equivalent to consent.

If the informative text changes, we update its version. Earlier records keep the version they had linked to them.

What if this policy changes?

We will publish the new version and its date on this page. When a change significantly affects the processing of data we already hold, we will provide any relevant additional information before using the data for a new purpose and will ask for consent if necessary.