Who the controller is
The controller of the personal data we collect on this website and in our relationship with clients is:
- Owner: Eric Herreros
- Tax ID (NIF): [PENDIENTE: NIF]
- Address: Calle Pisa, 17, 07011 Palma
- Privacy email: hola@solvosoftwares.com
- Data protection officer: [PENDIENTE: confirm whether a data protection officer has been appointed; if not, delete this line]
When you write to us using the form
Purpose: to answer your request and, if you ask us to, prepare a proposal for you.
Data: name and email; company and phone number if you provide them (they are optional); the service you are interested in and the project description; and, if you indicate them, your approximate budget and timeline.
Legal basis: your consent, which you give by ticking the privacy box (Art. 6(1)(a) GDPR), and taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
Retention: until your request has been dealt with and, if we do not end up working together, for a maximum of 12 months from the request. If you become a client, it is processed as client data (next section).
Fields without the “optional” label are needed to reply to you. If you are writing on behalf of your company, we only need your business contact details.
We also keep the date of submission and the version of this policy you accepted, so that we can demonstrate your consent (Arts. 6(1)(c) and 7(1) GDPR), for the same period as the rest of the form data.
Email confirmation: when we receive your request, we send you an automatic email to confirm it, in the language of the page. It only contains your first name in the greeting (if you write it with letters only) and the service, budget and timeline you chose (never what you write in the description), and we send it to manage your request (Art. 6(1)(b) GDPR).
So that nobody can use the form to write to other people’s addresses, we send at most one confirmation every 24 hours to each address and three to the addresses of the same domain (except large email providers such as Gmail or Outlook). To keep count, our submission-limit service stores pseudonymised codes derived from your email address and its domain, never the address itself, which are deleted automatically after 24 hours. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
AI-drafted reply (if enabled): to reply to you sooner, when we receive your request an artificial intelligence model (Claude, by Anthropic) writes an internal draft reply and some notes for our team (a summary, what we still need to know and whether it looks like spam or something we do not do). We only send it your first name, your company if you give it, the service, the project description, the budget and timeline you choose and the language of the page; never your email address or phone number, and before sending it we automatically remove any email addresses and phone numbers we detect in the description and the company name, and the surnames you write in the name field. The draft and the notes are not sent to you: they only go to our team, a member of which reviews them and decides what to reply, so you never receive a reply written by the AI alone, and no decision about you is made by automated means. We do this to manage your request (Art. 6(1)(b) GDPR).
Where we store your request: as well as reaching us by email, it is stored in the database of the internal dashboard we use to handle it (Supabase, with servers in Ireland, in the EU), together with the date of submission, the version of this policy you accepted, the language and the page of the website you sent it from (and, if the address of that page shows it, the advertising campaign you came from), and the internal draft reply and its notes for our team if they have been written. Only the members of our team who handle requests can access that dashboard, with their own user account and a second authentication factor, and it is kept for the same period stated in the retention paragraph.
“We’ll call you” form
If you ask us to call you, we process your name, your phone number, the service you are interested in and, if you choose one, your preferred time slot.
We only use them to call you and talk about what you need. The legal basis is your consent, which you give by ticking the box and can withdraw at any time by writing to us.
We keep them for 12 months from the request, unless you contract a service. If you do not provide them, we cannot call you, but you can call us on +34 676 88 15 74.
We also store your request in the database of our internal dashboard (Supabase, with servers in Ireland, in the EU), with the date, the version of this policy you accepted, the language and the page of the website you sent it from (and, if the address of that page shows it, the advertising campaign you came from), for the same period, and only the members of our team who handle requests can access it.
When you write to us on WhatsApp or by email, or call us
We process the data you give us (your name, your phone number or email address and what you tell us) to reply to you and, if you ask us to, to prepare a proposal. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and, if you are only asking a question, your consent when you write to us (Art. 6(1)(a) GDPR).
We keep them until your enquiry is resolved and, if we do not end up working together, for a maximum of 12 months. If you hire us, they are processed as client data (next section).
WhatsApp is a service of WhatsApp Ireland Limited (Meta group), which processes your messages under its own terms and privacy policy. If you prefer not to use it, email or call us.
When you are a client
Purpose: to prepare and manage the contract, communicate with you during the project, invoice and comply with our accounting and tax obligations.
Data: contact details, details of your company’s contact person, billing and payment details, and project communications.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).
Retention: for as long as the relationship lasts and afterwards for the statutory periods: 6 years for accounting records (Art. 30 of the Spanish Commercial Code) and 4 years for tax purposes (Art. 66 of the Spanish General Tax Act).
Form protection and technical logs
To stop mass and automated submissions, each form accepts at most 5 submissions every 10 minutes and 10 every 24 hours from the same IP address, plus a maximum number of requests per day from everyone combined. To keep count, our submission-limit service (Upstash Redis, with servers in Ireland) does not store your IP address but a pseudonymised code derived from it, which is deleted automatically 24 hours after the last submission at the latest. If that service fails, the count is kept with the IP address in the server’s temporary memory, for the same time and, at most, until the server restarts. We do not store the IP address itself in any database or write it to the website’s logs.
Separately, the hosting provider (Vercel) keeps its own technical logs of each visit (IP address, date and time, page requested and browser) so that the website works and is secure, for 1 day.
Legal basis for both: our legitimate interest in keeping the website available and secure (Art. 6(1)(f) GDPR).
Website usage statistics
Only if you accept analytics cookies, we measure which pages are visited with Google Analytics, with your IP address anonymised.
Data: pages visited, device and browser, analytics cookie identifiers and the anonymised IP address.
Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). You can withdraw it at any time from “Cookie preferences”, in the website footer.
Retention: the analytics cookies, as stated in the cookie policy; in Google Analytics, the data from each visit is deleted after 2 months.
Data of our clients’ customers
When, to build or maintain a project, we access data for which our client is the controller (for example, the contacts in their CRM), we are not the controller of that data but a data processor (Art. 28 GDPR). We only process it on their instructions and under a signed data processing agreement. If your data falls into this category, exercise your rights with the company that is the controller.
What we do not do with your data
To be clear:
- We do not use it to send you advertising. If we ever wanted to, we would ask for your separate consent.
- We do not sell it or pass it on to third parties, except where required by law.
- We do not make automated decisions or create profiles with it.
Who else has access to your data
We do not pass your data on to third parties except where required by law (for example, to the Spanish Tax Agency or to banks to collect payments). To provide the service, we use providers acting as data processors, under contract and only on our instructions:
- Website hosting and its technical logs: Vercel Inc. (USA). [PENDIENTE: confirm the server region, accept their data processing agreement (DPA) and the safeguard for transfers: EU-U.S. Data Privacy Framework or standard contractual clauses]
- Sending form notifications, the confirmation of your request and internal draft replies by email (the last two, if enabled): Resend, Inc. (USA). [PENDIENTE: confirm participation in the EU-U.S. Data Privacy Framework or standard contractual clauses]
- Form submission limit (the pseudonymised codes of the IP address and of the email address and its domain for the confirmation, for 24 hours at most): Upstash Redis, by Upstash, Inc. (USA), with servers in Ireland (EU). [PENDIENTE: accept or sign their data processing agreement (DPA) and confirm the safeguard for transfers: EU-U.S. Data Privacy Framework or standard contractual clauses]
- Writing internal draft replies with artificial intelligence (if enabled; only the data listed in “When you write to us using the form”, never your email address or phone number): Anthropic, PBC (USA), under its data processing agreement, which includes the European Commission’s standard contractual clauses for the transfer to the USA. Under its commercial terms, it may not use this data to train its models. [PENDIENTE: confirm that its data processing agreement (DPA) is accepted with its commercial terms, which Anthropic entity contracts with EEA customers, how long it keeps API data and whether it participates in the EU-U.S. Data Privacy Framework]
- Database of the internal dashboard we use to manage form requests, their internal draft replies and client data: Supabase, with servers in Ireland (EU). [PENDIENTE: confirm which Supabase entity contracts with us and in which country it is based, accept their data processing agreement (DPA) and confirm the safeguard for transfers if their support staff access data from outside the EEA: EU-U.S. Data Privacy Framework or standard contractual clauses]
- Receiving and managing requests (automation or CRM connected to the form): [PENDIENTE: provider and server location, or delete if not used].
- Email we use to reply to you: [PENDIENTE: company email provider].
- Accounting and invoicing: [PENDIENTE: accountant or invoicing software, or delete if not applicable].
- Web analytics, only if you accept it: Google Ireland Limited and Google LLC (Google Analytics).
Transfers outside the European Economic Area
Some providers may process data outside the European Economic Area. When this happens, the transfer is based on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, if the provider participates in it) or on the standard contractual clauses approved by the Commission.
[PENDIENTE: confirm, for each provider in the list above, whether there is a transfer and which safeguard applies]
Your rights
At any time and free of charge, you can exercise your rights of:
- Access: knowing what data of yours we process.
- Rectification: correcting any data that is inaccurate.
- Erasure: asking us to delete it.
- Objection and restriction of processing.
- Portability: receiving it in a structured format.
- Not being subject to automated decisions.
How to exercise your rights
Write to us at hola@solvosoftwares.com stating which right you wish to exercise. We will reply within one month. You can withdraw your consent at any time, without affecting the processing carried out before.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
Minors
This website is aimed at businesses, professionals and adults. We do not process data of children under 14 without the consent of their parents or guardians (Art. 7 of the Spanish Data Protection Act, LOPDGDD).
Security
We apply technical and organisational measures appropriate to the risk: communications with the website are encrypted (HTTPS), the form is protected against automated submissions, and only the people who need to deal with the messages can access them.
Changes to this policy
If we change how we process your data, we will update this page and its date. If the change is significant, we will point it out clearly on the website.