1. Data Controller
The data controller responsible for the processing of personal data described in this Privacy Policy is:
Quantrova Tech SL
Calle Balandro 39, 28042 Madrid, España
Email: quantrovatechsl@gmail.com
Website: https://quantrova-tech.com
For data protection inquiries, rights requests, or complaints relating to processing carried out by Quantrova Tech SL, contact the controller using the email address above. We will respond within the time limits prescribed by applicable law.
2. Scope & Categories of Data Subjects
This Privacy Policy applies to personal data processed by Quantrova Tech SL in connection with:
- visits to quantrova-tech.com (the "Site");
- submission of inquiries through the Site contact form;
- direct correspondence by email regarding our services; and
- operation, security, and maintenance of the Site.
The following categories of data subjects may be affected:
| Data subject category | Description |
|---|---|
| Website visitors | Individuals who browse the Site, including those who do not submit a form or otherwise identify themselves. |
| Inquiry contacts | Individuals who submit a contact form, send email, or otherwise provide identifying information to request information about our services. |
| Business representatives | Employees, contractors, or agents of a company who communicate with us on behalf of that organization. |
| Prospective clients | Individuals engaged in pre-contractual discussions, proposals, or scoping prior to execution of a separate written agreement. |
Processing undertaken under a separate client services agreement is governed by that agreement and any associated data processing terms, in addition to this Policy where applicable.
3. Categories of Personal Data
Depending on your interaction with the Site, we may process the following categories of personal data:
- Identity and contact data: name, email address, company name, job title (if provided), and message content submitted via forms or email.
- Technical and usage data: IP address, browser type and version, device type, operating system, referring URL, pages viewed, session duration, and approximate geographic location derived from IP address.
- Cookie and preference data: cookie identifiers, consent choices, and stored preference settings where applicable.
- Communication records: correspondence content, timestamps, and metadata relating to inquiries and follow-up communications.
- Security and log data: server logs, access records, and diagnostic information generated in the ordinary course of operating and securing the Site.
We do not intentionally collect special categories of personal data (as defined in Article 9 GDPR) through the Site. Do not submit such data unless necessary and with appropriate legal basis.
4. Purposes & Legal Bases for Processing
Where the General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights (LOPDGDD) apply, we process personal data on the following bases:
| Purpose | Data involved | Legal basis (GDPR Art. 6) |
|---|---|---|
| Responding to inquiries and providing requested information | Identity, contact, communication content | Art. 6(1)(b) — steps prior to entering into a contract at the data subject's request |
| Preparing proposals, quotes, and pre-contractual communications | Identity, contact, business context, communication records | Art. 6(1)(b) — pre-contractual steps; Art. 6(1)(f) — legitimate interest in evaluating commercial opportunities |
| Operating, maintaining, and securing the Site | Technical, security, and log data | Art. 6(1)(f) — legitimate interest in secure and reliable website operation |
| Storing and honoring cookie consent preferences | Cookie and preference data | Art. 6(1)(a) — consent, where required; Art. 6(1)(f) — legitimate interest for strictly necessary cookies |
| Understanding aggregate usage to improve Site performance and content | Technical and usage data (aggregated or pseudonymized where feasible) | Art. 6(1)(a) — consent for non-essential analytics cookies; Art. 6(1)(f) — legitimate interest in limited technical measurement where consent is not required |
| Compliance with legal obligations and response to lawful requests | Any data category as required | Art. 6(1)(c) — legal obligation |
| Establishing, exercising, or defending legal claims | Relevant records as necessary | Art. 6(1)(f) — legitimate interest in legal protection |
Where processing is based on legitimate interests, you have the right to object under the conditions set out in Section 9. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
5. Cookies & Similar Technologies
The Site uses cookies and similar storage technologies. A cookie is a small text file placed on your device. We classify cookies as follows:
You may control cookies through the consent banner presented on first visit, by revisiting your browser settings, or by contacting us. Blocking some cookie categories may affect Site features. For further detail on associated personal data processing, see Sections 3 and 4 of this Policy.
6. Processors & Subprocessors
We do not sell personal data. We engage third-party processors who process personal data on our documented instructions and subject to appropriate contractual safeguards, including data processing agreements where required by GDPR Article 28.
Categories of processors and subprocessors currently involved in Site operations include:
- Hosting and infrastructure providers: storage, delivery, and operation of the Site and related server logs.
- Email and communication providers: transmission and delivery of messages sent to or from quantrovatechsl@gmail.com and inquiry notifications.
- Content delivery and security services: performance optimization, TLS termination, and protection against abuse where deployed.
Processor identities and service locations may change as our infrastructure evolves. We require processors to implement appropriate technical and organizational measures and to process data only for specified purposes. A list of material subprocessors may be provided upon written request where required by contract or law.
We may also disclose personal data where required by applicable law, court order, or competent authority, or where necessary to protect the rights, property, or safety of Quantrova Tech SL, our users, or others.
7. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, unless a longer period is required or permitted by law.
| Data category | Typical retention period | Basis |
|---|---|---|
| Contact form and inquiry data | Up to 24 months from last meaningful contact, unless a client relationship continues | Pre-contractual and business correspondence; erasure upon request where no overriding legal basis exists |
| Active client correspondence | Duration of engagement plus up to 6 years thereafter | Contract performance, limitation periods, and legal claims |
| Cookie consent records | Up to 12 months, or as required to demonstrate valid consent | Regulatory accountability and consent management |
| Server and security logs | Typically 30 to 90 days; extended where needed for incident investigation | Security monitoring, abuse prevention, and system integrity |
| Aggregated or anonymized analytics | Retained without identifiable linkage where technically feasible | Legitimate interest in understanding Site performance |
Upon expiry of the applicable retention period, data is deleted or irreversibly anonymized using commercially reasonable methods, unless further retention is mandated by law.
8. Security Measures
We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction. Measures are proportionate to the nature of the data and the risks involved, and include, at a high level:
- Access control: role-based permissions limiting access to personal data to personnel and contractors with a legitimate operational need.
- Least privilege: administrative and service accounts granted minimum permissions required for their function.
- Encryption in transit: use of TLS (HTTPS) for data transmitted between your browser and the Site.
- Infrastructure hardening: patching, monitoring, and configuration practices applied to hosting and application components.
- Vendor management: contractual security requirements imposed on processors handling data on our behalf.
No method of transmission or electronic storage is completely secure. While we take reasonable steps to safeguard personal data, we cannot guarantee absolute security. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you and the competent supervisory authority as required by applicable law.
9. Your Rights Under GDPR
If you are located in the European Economic Area or otherwise subject to GDPR, you have the following rights in relation to your personal data, subject to applicable conditions and exceptions:
- Right of access (Art. 15): obtain confirmation as to whether we process your data and receive a copy.
- Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
- Right to erasure (Art. 17): request deletion where grounds apply (for example, data no longer necessary or consent withdrawn).
- Right to restriction (Art. 18): request limitation of processing in specified circumstances.
- Right to data portability (Art. 20): receive data you provided in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means.
- Right to object (Art. 21): object to processing based on legitimate interests, including profiling; object at any time to processing for direct marketing.
- Right to withdraw consent: where processing is consent-based, withdraw consent without affecting prior lawful processing.
- Right not to be subject to solely automated decisions (Art. 22): where applicable, not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
How to exercise your rights: Submit a written request to quantrovatechsl@gmail.com with the subject line "Data Protection Request." State the right you wish to exercise and provide sufficient information to verify your identity. We will respond without undue delay and within one month, extendable by two further months where necessary due to complexity or volume. We may request additional information to confirm identity before fulfilling a request.
10. Supervisory Authority
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
As Quantrova Tech SL is established in Spain, the competent authority for complaints relating to our processing is:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, España
Website: www.aepd.es
We encourage you to contact us first so we may address your concern directly. Filing a complaint does not preclude other administrative or judicial remedies.
11. International Data Transfers
Some processors and subprocessors used to operate the Site or deliver email may be located outside the European Economic Area (EEA), including in countries that have not received an adequacy decision from the European Commission.
Where personal data is transferred to such countries, we implement appropriate safeguards as required by GDPR Chapter V, which may include:
- Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented by additional measures where required following transfer impact assessments;
- binding corporate rules, where applicable; or
- another lawful transfer mechanism recognized under applicable data protection law.
You may request further information about applicable safeguards by contacting us at quantrovatechsl@gmail.com.
12. Children's Privacy
The Site and our business services are directed at professionals and organizations. We do not knowingly collect personal data from individuals under 16 years of age.
If you are a parent or guardian and believe that a child under 16 has provided personal data to us, contact us at quantrovatechsl@gmail.com. Upon verification, we will take reasonable steps to delete such data from our active systems unless retention is required by law.
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in our processing activities, legal requirements, or Site functionality. Material changes will be indicated by updating the "Last updated" date at the top of this page.
Where required by law, we will provide additional notice (for example, a prominent Site notice or direct communication) before changes take effect. Continued use of the Site after the effective date of an updated Policy constitutes acknowledgment of the revised terms, except where further consent or action is required by law.
We recommend reviewing this page periodically. Prior versions may be made available upon request.
14. Contact
For questions regarding this Privacy Policy, processing activities, or data protection rights, contact:
Quantrova Tech SL
Calle Balandro 39, 28042 Madrid, España
Email: quantrovatechsl@gmail.com