Privacy Policy
Last updated: 30/08/2026
1. Data controller
- Controller: [pendiente] (FlowITeam)
- Tax ID: [pendiente]
- Address: [pendiente]
- Contact email for exercising your rights: [email protected]
We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and the guarantee of digital rights (LOPDGDD).
2. What data we process and where it comes from
We only process the data you give us directly. We don't buy databases or build profiles on you.
2.1. Contact and brief form
- Name.
- Email address or phone number, depending on what you provide.
- Type of project and the message you write.
- Links to reference websites you choose to share.
- Files you attach (logo, presentation, documents): these may contain personal data or confidential information about your business. Please attach only what's necessary.
- Technical data linked to the submission: site language and the page the form was sent from.
- The estimate you configured in the calculator, so we can reply with context.
2.2. Browsing
If you accept analytics cookies, we collect aggregated usage statistics via Google Analytics 4, with the IP address anonymized. See our Cookie Policy.
Our infrastructure provider logs IP addresses on server logs for security purposes and to detect abuse.
3. What we use it for and the legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Responding to your enquiry and preparing a quote | Pre-contractual steps at your request (Art. 6.1.b) |
| Delivering the contracted service and billing for it | Performance of a contract (Art. 6.1.b) and legal obligation (Art. 6.1.c) |
| Cookies and audience measurement | Consent (Art. 6.1.a) |
| Site security and abuse prevention | Legitimate interest (Art. 6.1.f) |
| Keeping invoices and receipts on file | Legal obligation (Art. 6.1.c) |
We never use your data to send you marketing without your prior consent, and we don't make automated decisions that have legal effects on you.
4. Who else sees your data
We don't sell or share your data. To operate, we work with the following providers, who act as data processors under a contract compliant with Art. 28 GDPR:
- Hetzner Online GmbH (Germany) — servers hosting the site and database. Data hosted within the European Union.
- Cloudflare — content delivery network, certificates and protection against attacks. Acts as an intermediary for all site traffic.
- Google Ireland Ltd. — corporate email (Google Workspace), which we use to receive request notifications, and Google Analytics 4 if you accept analytics cookies.
- Telegram — we get an internal alert in a private group whenever a request comes in. That alert includes your name, the contact details you provided and your message. Attached files are never sent via Telegram: they stay on our server.
Some of these providers may process data outside the European Economic Area. In that case, the transfer is covered by the Standard Contractual Clauses approved by the European Commission or by an adequacy decision.
We may also share data with public authorities where required by law (for example, with the Spanish Tax Agency).
5. How long we keep it
- Enquiries that don't turn into a contract: up to 12 months from the last contact, so we can pick up the conversation again. After that, they're deleted.
- Files attached to the brief: deleted together with the enquiry, or sooner if you ask us to. They're kept in private storage, not accessible from the internet, and can only be downloaded by authorized staff.
- Clients: for the duration of the contractual relationship and, afterwards, for the statute-of-limitations period for claims arising from the contract.
- Billing and accounting records: 6 years (Art. 30 of the Commercial Code) and 4 years for tax purposes (General Tax Law).
- Analytics data: as set by Google Analytics 4, with a maximum of 14 months.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, as well as withdraw any consent you've given, without affecting the lawfulness of processing carried out before that.
How to do it: email [email protected] stating which right you want to exercise. To protect your data, we may ask you to verify your identity. We'll respond within one month at the latest.
Immediate deletion: if you simply want us to delete an enquiry and the files you attached, just ask by email; we'll do it straight away, no extra steps, and confirm it to you in writing.
If you feel we haven't handled your request properly, you can file a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).
7. Security
We apply technical and organizational measures appropriate to the risk: TLS encryption across the whole site, encrypted third-party credentials in our database, brief files stored outside the server's public folder, password-restricted access to the admin panel, and regular backups.
8. Minors
Our services are aimed at businesses and professionals. We don't knowingly collect data from anyone under 14. If you notice that a minor has given us their data, let us know and we'll delete it.
9. Changes to this policy
We may update this policy to reflect changes in the law or in our service. The date of the last update appears at the top.
This site is published in Spanish, English, Russian and Ukrainian. In case of any discrepancy between versions, the Spanish text prevails.