1. Who is responsible for your data
- Controller: Atalaya Ventures S.L. (trading as Atalaya Consulting)
- VAT number: ES-B65855173
- Registered office: Carrer Sant Esteve 1-3, Bloc 2 Esc F, Bjs 1 · 17230 Palamós · Girona · Spain
- Email: admin@atalaya-consulting.com
This policy explains what personal data we collect through atalaya-consulting.com, why we collect it, how long we keep it and what rights you have. It is written under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on data protection and the guarantee of digital rights.
2. What we collect, and why
This website has one form, on the contact page. We do not run a shop, a newsletter, a booking system or a customer area, and we do not create user accounts.
| What | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form | Name, email address, subject and the content of your message | To read your enquiry, answer it and, where relevant, prepare a proposal | Your consent, given by ticking the box on the form (art. 6.1.a GDPR) | While we deal with your enquiry, and afterwards for as long as any commercial relationship lasts. If nothing comes of it, we delete the message. |
| Analytics | Browsing data collected by Google Analytics 4, with a truncated IP address | To understand in aggregate how the site is used and improve it | Your consent, given through the cookie banner (art. 6.1.a GDPR) | Up to 14 months, as configured in Google Analytics |
| Server logs | IP address, date, requested page and user agent | To serve the website, keep it available and prevent abuse | Our legitimate interest in operating and securing the site (art. 6.1.f GDPR) | The retention period of our hosting provider |
Providing your data is voluntary, but the fields marked as required on the form are necessary to reply to you: without a name and an email address we cannot answer. We ask you not to send us confidential information, credentials or system access details through the form.
3. Who else processes your data
We do not sell your data and we do not share it with third parties for their own purposes. We do use these service providers, which act as processors on our behalf:
- Google Ireland Limited (Firebase Hosting and Cloud Functions) — hosting and delivery of this website. It processes the requests your browser makes, the contact form submission on its way to our inbox, and the associated server logs.
- Resend — the transactional email service that delivers your enquiry to our inbox. It processes the content of the form for the sole purpose of sending that message.
- Microsoft 365 — our corporate mailbox, where the enquiry is received and where our reply to you is written.
- Google Ireland Limited — also Google Analytics 4, and only if you accept analytics cookies.
Some of these providers may process data outside the European Economic Area. Where that happens, the transfer is covered by the Standard Contractual Clauses approved by the European Commission and, where applicable, by the EU–US Data Privacy Framework.
4. Your rights
You have the right to:
- Ask whether we are processing personal data about you, and obtain a copy of it.
- Have inaccurate data corrected, or have your data deleted.
- Ask us to restrict the processing of your data in certain circumstances.
- Object to the processing on grounds relating to your particular situation.
- Receive your data in a structured, commonly used format and have it sent to another controller.
- Withdraw your consent at any time. Withdrawing it does not affect the lawfulness of what we did before you withdrew it.
To exercise any of these rights, write to admin@atalaya-consulting.com with “Data protection” in the subject line, or to Atalaya Ventures S.L., Carrer Sant Esteve 1-3, Bloc 2 Esc F, Bjs 1 · 17230 Palamós · Girona · Spain. We may ask you to identify yourself before acting on the request.
If you believe your rights have not been properly respected, you can complain to the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.
5. Security
The site is served entirely over HTTPS and the form is submitted to our own endpoint, not to a third-party form service. We apply technical and organisational measures appropriate to the risk, and we keep the amount of personal data we hold to the minimum needed to answer you.
6. Cookies
This site uses cookies only for analytics, and only after you accept them. There is no advertising, no remarketing and no social network tracking. The detail is in our cookie policy.
7. Changes to this policy
We update this policy whenever what the website does changes. The date at the top of the page always shows the current version.