Privacy policy

1. Data controller

The controller of the personal data collected through this website is:

• Lluís Soberats Sánchez, trading under the business name «Atalai».
• Spanish tax ID (NIF): 43189079R.
• Address: Carrer de Rosselló i Cazador, 7, 1B, 07004 Palma de Mallorca, Illes Balears (Spain).
• Email for any data protection matter: contacta@atalai.net.
• Website: https://atalai.net.

2. Scope of this policy

This policy explains what personal data is processed through https://atalai.net, for what purpose, on what legal basis, for how long, who else is involved and what rights you have. It applies equally to the three language versions of the site (Catalan, Spanish and English).

It does not apply to the third-party sites linked from here, which have their own policies.

All the data processed is data you provide yourself: nothing is obtained from external sources, no databases are bought and no profile is enriched with third-party information.

3. What data is processed

Depending on how you get in touch, the data processed is:

• Contact form (required): name and email address.
• Contact form (optional): phone, company and estimated budget. You can leave them blank and the form still submits.
• Message content: whatever you choose to tell me about your project or enquiry. Please do not include sensitive data (health, political opinions, trade union membership, etc.) or third-party data I do not need in order to reply.
• Subsequent correspondence: the messages we exchange by email, phone or WhatsApp after that first contact.
• Website usage data: if you accept measurement, statistical browsing data (pages viewed, time spent, device type, approximate location, language) linked to a cookie identifier, with the IP address anonymised.
• No payment data is collected through the website: invoicing, where applicable, is handled outside it.

4. Processing 1: enquiries through the contact form

Purpose: to receive your enquiry, reply to you, prepare a quote if you ask for one and keep the conversation going until the matter is closed.

Legal basis: your consent when you submit the form (art. 6.1.a GDPR) and, where what you are asking for is information or an offer with a view to contracting, the taking of steps at your request prior to entering into a contract (art. 6.1.b GDPR).

Consequence of not providing the data: name and email are essential in order to reply to you; without them the form will not submit. The optional fields only help to give a better-targeted answer.

Retention: if the enquiry does not lead to a working relationship, the data is kept for a maximum of twelve months from the last contact and is then deleted. If a professional relationship does begin, the periods in section 8 apply.

5. Processing 2: contact by email, phone or WhatsApp

Purpose: to handle enquiries arriving through these channels and to manage any professional relationship that begins (quotes, project follow-up, support and invoicing).

Legal basis: your consent when you initiate contact (art. 6.1.a GDPR), pre-contractual steps or performance of the contract (art. 6.1.b GDPR) and, for keeping invoices and supporting documents, compliance with commercial and tax obligations (art. 6.1.c GDPR).

A note on WhatsApp: the WhatsApp button on the site merely opens a conversation in your own app; by itself it sends no data to Atalai. If you choose that channel, the conversation takes place on the platform of WhatsApp Ireland Limited, subject to its own terms and privacy policy, over which the controller has no control. If you would rather avoid it, use email or the form.

Retention: for as long as the relationship lasts and, afterwards, according to the periods in section 8.

6. Processing 3: audience measurement (Google Analytics 4)

Purpose: to understand, in aggregate and statistical terms, how the site is used — which pages are read, for how long, from what kind of device — in order to improve it. It is not used for advertising, for building commercial profiles or for retargeting you.

Legal basis: your consent alone (art. 6.1.a GDPR and art. 22.2 LSSI-CE), given when you click «Accept» in the cookie banner. If you do not give it, or you decline, the measurement code is not even downloaded.

Tool: Google Analytics 4, measurement ID G-DWNDS8Z1QF, loaded via gtag.js. It is configured with IP anonymisation and with cookies flagged «Secure» and «SameSite=Lax».

Retention: measurement cookies expire two years after your last visit, or sooner if you delete them or withdraw consent. Aggregate reports remain in Google Analytics for the retention period configured on the property.

Withdrawing consent: you can change your mind at any time; the relevant section of the Cookie policy explains how.

7. Recipients and processors

Personal data is never sold, rented or transferred to third parties for commercial purposes. It is disclosed only to the entities that are essential in order to provide the service, which act as processors under a contract compliant with article 28 GDPR, and to public authorities where a legal obligation exists.

• DonDominio (Soluciones Corporativas IP, S.L.U.): hosting of the website and of the domain email, with servers located in Spain.
• FormSubmit (formsubmit.co): processes the contact form submission and delivers your message to the contacta@atalai.net mailbox. The message passes through its servers in order to be delivered.
• Google Ireland Limited and Google LLC: provide reCAPTCHA v2, which protects the form against automated submissions, and — only if you accept — Google Analytics 4.
• Tax and accounting advisers and financial institutions: only if invoicing actually takes place, and only with the data needed to issue and collect payment.
• Courts, tribunals and public authorities: where required by law.

8. Retention periods

Data is not kept indefinitely. The periods applied are:

• Enquiries that do not lead to a professional relationship: up to twelve months from the last contact.
• Client data during the relationship: for as long as it lasts and no erasure is requested.
• Commercial and accounting records: six years from the last entry, under article 30 of the Spanish Commercial Code.
• Records with tax relevance: four years, under article 66 of the Spanish General Tax Act.
• Data kept to handle potential liabilities: for the limitation period of the relevant claims; it is then deleted or anonymised.
• Cookies and browser storage: the specific periods are listed in the Cookie policy.

9. International data transfers

Hosting of the website and of the email is in Spain, within the European Economic Area, so it involves no international transfer.

Google's services (reCAPTCHA and, if you accept, Analytics) and the form provider, FormSubmit, may on the other hand involve access to data from the United States.

For Google, the transfer relies on the EU-U.S. Data Privacy Framework, as Google LLC is among the certified entities, a framework the European Commission considers to provide an adequate level of protection in its adequacy decision of 10 July 2023; in addition, Google applies the standard contractual clauses approved by the European Commission.

For the form submission, if the provider processes data outside the European Economic Area, the transfer relies on the European Commission's standard contractual clauses under article 46.2.c GDPR.

In any case, the data leaving the European Economic Area is limited to what is strictly necessary for the form and the anti-spam check to work. If you would rather your data did not pass through these providers, write directly to contacta@atalai.net instead of using the form.

10. Automated decisions and profiling

No decisions are taken based solely on automated processing that produce legal effects or significantly affect you, and no profiling is carried out with your data, within the meaning of article 22 GDPR.

The form's anti-spam check (reCAPTCHA) only determines whether the sender is a person or an automated program: it does not assess your profile, your creditworthiness or any other personal characteristic.

11. Your rights

Data protection law grants you the following rights:

• Access: to know whether your data is being processed and to obtain a copy of it together with information about the processing.
• Rectification: to correct inaccurate data or complete incomplete data.
• Erasure («right to be forgotten»): to ask that data be deleted when it is no longer necessary, you withdraw consent or it has been processed unlawfully.
• Objection: to object to the processing on grounds relating to your particular situation.
• Restriction of processing: to ask that data be kept but not used while a challenge or a request is being resolved.
• Portability: to receive the data you provided in a structured, commonly used format, or to have it transmitted to another controller where technically feasible.
• Withdrawal of consent: to withdraw it at any time, as easily as you gave it, without affecting the lawfulness of processing carried out before the withdrawal.
• Not to be subject to automated decisions, as stated in the previous section.

12. How to exercise your rights and where to complain

To exercise any of these rights, simply write to contacta@atalai.net with «Data protection» in the subject line, stating which right you wish to exercise and the email address you originally contacted from. You will only be asked to prove your identity if there is reasonable doubt as to who is making the request.

Exercising these rights is free of charge. Requests are answered within one month of receipt, extendable by a further two months if the request is complex, in which case you will be told about the extension and its reasons (article 12 GDPR).

If you believe your request has not been handled properly, or that the processing infringes the law, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, which is the competent supervisory authority. You may also contact the controller first to try to resolve the matter.

13. Security measures

Technical and organisational measures appropriate to the risk are applied, in accordance with article 32 GDPR. These include:

• The whole site is served over HTTPS only, with forced redirection from HTTP and an HSTS policy, so form data travels encrypted.
• Security headers on the server: a Content Security Policy limiting permitted origins, protection against page framing, blocking of MIME type sniffing, a restrictive referrer policy and the disabling of camera, microphone, geolocation and payments.
• Minimisation: only name and email are required; phone, company and budget are optional. The site creates no user accounts and stores no passwords.
• The email address is not published in plain text in the page source, to reduce automated harvesting.
• Protection of the form against automated submissions through reCAPTCHA and a hidden honeypot field.
• Mailbox access protected with dedicated, unshared credentials.
• No measure offers absolute security; if a breach occurred that posed a high risk to your rights, you would be notified in accordance with article 34 GDPR.

14. Minors

The services offered through this website are aimed at businesses, professionals and adults. The site is not intended for minors and their data is not knowingly collected.

Under article 7 of the Spanish LOPDGDD, children under fourteen should not send data through the form without the consent of whoever holds parental responsibility or guardianship. If data from a minor is found to have been received in those circumstances, it will be deleted immediately.

15. Changes to this policy

This policy may be updated if the services, the providers or the applicable law change. The version in force is always the one published on this page, with the last-updated date shown in the header.

If any change substantially affected processing based on your consent, it would be requested again before being applied.