Data protection

1. Controller

1.1 Data Protection Officer (DPO)

ITECTS ONE S.L. is not required to appoint a Data Protection Officer, as neither the conditions of Art. 37 GDPR nor those of Art. 34 of the Spanish LOPDGDD (Organic Law 3/2018) are met. If you have any questions regarding data protection, please contact info@itects-one.es.

2. Types of data processed & purposes

2.1 When visiting the website (server logs)

When you access our website, the server automatically collects the following information and temporarily stores it in log files:

• IP address of the device
• Date and time of access
• URL/filename of the requested resource
• Referrer URL
• Browser used, and where applicable operating system & device type

Purposes: Ensuring the technical provision, stability and security of the website as well as fraud and attack detection.

Legal basis: Art. 6(1)(f) GDPR (legitimate interests).

2.2 Contact (contact form/email)

When you contact us via the form or by email, we process the information you provide (e.g. name, email address, message content) solely to handle your request. The form submission is transmitted via TLS-encrypted connection; the incoming message is then processed and answered in our Google Workspace mailbox (see section 3).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps/contract performance) or Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

3. Hosting, email & recipients

We use the following service providers for operation and communication:

• Hosting/deployment: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (infrastructure/edge network); data transfers to third countries may occur.
• Email: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Gmail/Google Workspace). Transfers to group companies outside the EU (in particular the USA) may occur.

We have contracts and appropriate safeguards in place with our providers (in particular EU Standard Contractual Clauses, Art. 46 GDPR) to ensure an adequate level of protection.

4. Disclosure of data

Personal data are only disclosed insofar as necessary to fulfil the purpose, where there is a legal obligation, consent has been given, or our legitimate interests prevail.

5. Storage periods

Server log files are usually deleted automatically after 14 days. Contact enquiries are stored until they have been finally processed and, where statutory retention obligations exist, in accordance with the statutory periods.

6. Your rights

• Access to the personal data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a supervisory authority. In Spain, this is for example the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid, https://www.aepd.es/.

7. Transfers to third countries

Where data are transferred to countries outside the EU/EEA (in particular the USA) in connection with the use of Vercel or Google, such transfers are based on appropriate safeguards, in particular the EU Standard Contractual Clauses (Art. 46 GDPR). Where necessary, additional measures are taken to protect the data.

8. Data security

This website uses TLS encryption (SSL/TLS). You can recognise an encrypted connection by the ‘https://’ prefix and the padlock symbol in your browser’s address bar.

9. Obligation to provide data

Providing log data is technically necessary for the operation of the website. Entering data in the contact form is voluntary; however, without this information we may not be able to respond to enquiries.

10. Changes to this privacy notice

We update this privacy notice when necessary due to technical changes or legal requirements.

Last updated: 30/06/2026