Privacy policy

This privacy policy governs how the personal data that users provide to us through this website is processed, in compliance with the Regulation (EU) 2016/679, of 27 April, General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018, of 5 December, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

We have no Data Protection Officer (DPO) as the conditions of art. 37 GDPR do not apply. For any question regarding data protection you may address the controller directly.

2. What personal data we collect

We only process data that you provide voluntarily or that is generated through browsing, grouped into the following categories:

2.1 Contact form data

• Identifying: first name and surname(s).
• Contact: email address and, optionally, phone number.
• Company (optional): name of company or organisation.
• Message content: the information you choose to include.

2.2 Email or phone communications data

• Content of correspondence, professional data you share and, if the commercial relationship is formalised, billing data (Tax ID, legal name, address).

2.3 Browsing and website usage data

• IP address, browser and device type, operating system, pages visited, session duration, traffic source.
• This data is collected by means of cookies and similar technologies; see the Cookie policy.
• When analytics or advertising, it is only processed with your explicit consent via the cookie banner.

2.4 Local storage (localStorage) strictly necessary

• pr_contact_state_<lang>: local storage of the multi-step contact form progress (only current step + pre-selected interest_type, TTL 24h). Strictly necessary for form operation; no PII persisted (name, email, phone, message). Auto-removed on submit, abandonment or TTL expiry.
• pr_scorecard_state_<lang>_v1: local storage of the B2B Acquisition Scorecard progress (chosen answers and result, computed entirely in your browser). Strictly necessary to let you continue the questionnaire if you reload the page. Contains no PII until you optionally choose to send yourself the summary by email. Removed on questionnaire restart or on send.

2.5 Interactive resources data (lead magnets)

• Contact: email address, only if you choose to request the summary by email. The resources (scorecard, checklist) are fully usable without providing any data.
• Resource result: for the B2B Acquisition Scorecard, the overall score (0-100), per-dimension scores and main bottleneck detected; for the checklist, the number of signals verified and the per-section counts. Only these result fields from the resource itself are stored, computed in your browser, and only if you request the summary.
• Technical metadata: resource identifier, source page, UTM traffic-source parameters, and a pseudonymised fingerprint of the IP address (SHA-256 hash, no plain-text IP), for anti-fraud security and attribution purposes.
• Notice acknowledgement record: version, language, URL and fingerprint (hash) of this privacy notice, the legal basis applied, and the time at which you confirm having read it (acknowledgement), to document the information provided before submission.

3. Purposes and legal basis of processing

No automated decisions are made and no profiling producing significant legal effects on the user is carried out.

4. Retention period

• AI assistant leads (chatbot): up to 90 days from capture, unless you request earlier deletion. See section 5 on processors Anthropic and Supabase.
• Interactive resource leads (scorecard, checklist): up to 90 days from capture, unless you request earlier deletion. See section 5 on processors Supabase and the transactional email provider (Resend). Anthropic is not involved.
• Automated web audit result: the generated report is kept for up to 30 days from generation (parameter AUDIT_RESULT_TTL_DAYS) and then deleted. The associated lead (email, URL and business name) follows the general 90 day retention of interactive resources.
• Non-contracted enquiries: up to 12 months from the last contact, unless you request earlier deletion.
• Clients (contractual relationship): during the relationship and once terminated, throughout the applicable legal periods, up to 6 years for commercial and accounting documentation (art. 30 of the Spanish Commercial Code) and up to 4 years for tax obligations (Spanish General Tax Law).
• Browsing data and cookies: according to the duration of each cookie indicated in the Cookie policy.
• Commercial communications: until the data subject withdraws consent or objects.

5. Recipients and processors

Your data will not be transferred to third parties except by legal obligation. As processors, the technology service providers that support us may access it, with whom we have signed (or will sign) the corresponding processor agreement in accordance with art. 28 GDPR:

6. International data transfers

When we use services from companies located outside the European Economic Area (mainly in the United States: Google, Meta), these transfers are carried out under the framework of the EU-US Data Privacy Framework (DPF), approved by the European Commission through Adequacy Decision of 10 July 2023, along with the corresponding Standard Contractual Clauses (SCCs) where necessary.

7. Your data protection rights

As the data subject, you have the following rights, which you may exercise free of charge:

• Access: to know what data we process about you.
• Rectification: to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to request that we delete your data.
• Objection: to processing based on legitimate interest or for direct marketing purposes.
• Restriction: to limit processing in certain circumstances.
• Portability: to receive data in a structured format and transmit it to another controller.
• Withdraw consent at any time, with no retroactive effect.

To exercise these rights, write to us at info@petitroig.com stating the right you wish to exercise and attaching a copy of your DNI/NIE or equivalent document. We will respond within a maximum period of one month (extendable to two months in complex cases).

If you consider that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the competent supervisory authority: the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid · www.aepd.es. In Catalonia, the Catalan Data Protection Authority (APDCAT) · apdcat.gencat.cat.

8. Security measures

We have implemented appropriate technical and organisational measures to ensure the confidentiality, integrity, availability and ongoing resilience of the systems that process your data, in accordance with art. 32 GDPR: encrypted connections (HTTPS/TLS), access control, regular backups, confidentiality agreements with processors and protocols for security breaches.

That said, no system is 100% infallible. If we detect a security breach that may affect your rights, we will notify you within a maximum period of 72 hours in accordance with art. 33 GDPR.

9. Minors

This website is aimed at an adult, professional audience. We do not knowingly collect data from minors under 14 years of age. If you are under 14, do not provide personal data without the consent of your parents or legal guardians. If we detect that we have received data from a minor without valid consent, we will delete it immediately.

10. Changes to this policy

We may update this policy to reflect legal, jurisprudential or business changes. When changes are substantial, we will inform you prominently on the website or, if there is an active contractual relationship, by email. The date of the last update appears at the top of this page.

For any query about this policy or to exercise your rights: info@petitroig.com.