Privacy Policy

1. Responsible and contact

The data controller is ADVALUIT CONSULTING & TECHNOLOGY SLU, NIF B66251802, with address at Passeig Nadal, 2, 1-2, 08980 Sant Feliu de Llobregat, Barcelona, Spain, owner of the site entendoo.com. entendoo is its commercial name for this activity, not a separate legal entity.

For privacy inquiries and exercise of rights: gdpr@entendoo.com. For general information: info@entendoo.com. The address gdpr@entendoo.com is the privacy contact channel of the controller; Its name does not in itself imply the appointment of a data protection officer.

This policy refers to browsing the corporate website, requests for information and its management. If a contractual relationship or other processing for different purposes is initiated, the corresponding specific information will be provided.

2. What data we process

When you use the form we process your name, email, organisation if you indicate it, message and service or context of the query. We also record an application reference, language, date, version of the privacy information presented and proof of your choice. Internal management can incorporate the status of the query, the person responsible for handling it, and the notes necessary to resolve it.

If you write directly to our emails, we process the sender address and the relevant data and documents you include. Do not send passwords, copies of identification documents, health data or especially sensitive information for an ordinary information request.

Functionality and security require the processing of certain technical connection data and anti-abuse controls. The website does not incorporate visitor analytics, behavioral advertising or commercial browsing profiles. Administrative access is limited to authorized persons and has security logs. More information in the Cookie Policy.

3. What do we use them for and on what basis

Attend to your query and respond to you. We use the necessary data to understand what is requested, maintain communication and send acknowledgment of receipt. The basis for the information form is your consent, which you can withdraw at any time. The required fields allow you to identify the query and have a means of response; Without them we cannot process it through this channel.
Protect the service and prevent abuse. We apply security and traceability controls necessary to preserve the availability, integrity and confidentiality of the service, based on the legitimate interest of the person responsible in protecting their systems and users, with proportionate measures.
Comply with obligations and address rights or claims. We will process the data that is necessary to comply with applicable legal obligations and, where appropriate, to formulate, exercise or defend claims.

Submitting the form does not subscribe you to advertising, newsletters or commercial communications. We do not use consent to answer a query as authorization for these purposes. No decisions are made based solely on automated treatments that produce legal effects on you or significantly affect you, nor are commercial profiles created through this website.

4. How long do we keep the data

Information requests that do not lead to hiring are kept while they are being processed and up to 12 months after their closure. At the end of this period, identifying data that is no longer necessary is deleted or deleted. You can request deletion or withdraw your consent before, without prejudice to the conservation that must be maintained due to a legal obligation or to meet responsibilities.

If a consultation gives rise to a contractual relationship, your specific purposes, privacy information and legal deadlines will apply to that relationship. An incident, claim or retention obligation may justify maintaining only the necessary information, with restricted access and for the applicable period.

Encrypted backups are intended for incident recovery only. Snapshots from your own repository are subject to a 30 day rotation policy, with copy and restore controls before expiration. Information deleted from the system in use may temporarily remain on those copies; It is not used to process ordinary queries. Repository deletion does not necessarily result in immediate physical deletion in the provider's recovery systems: OneDrive for Business typically keeps deleted items in your trash for 93 days, unless otherwise configured, and their additional recovery procedures or legal retention obligations may apply. Access to these remains is restricted and their use is limited to recovery and applicable obligations. Applicable deletions must be reapplied before resuming a restored system. Messages kept in the mail are included in the controller's review and deletion procedures.

Temporary abuse controls are removed upon expiration. The minimum evidence of security, attention to rights and actions carried out is kept in a restricted manner for the time necessary to justify said actions and address any applicable responsibilities.

5. Who can access and providers

The requests are accessed by authorized personnel of the company who need to attend to them or manage the service. Technology providers may process data on behalf of the controller to provide hosting, mail, authentication, maintenance and backup copies. The infrastructure uses IONOS for hosting and Microsoft 365 for email, administrative access, and encrypted copy storage.

The processing by these providers is governed by the processing commissioning agreements and the data protection conditions applicable to the contracted services. We do not sell query data nor do we transfer it to other companies for their own advertising. They may be communicated to authorities, judicial bodies or other recipients when there is a legal obligation or it is necessary and legitimate to address a claim.

6. International treatments

Some international providers may carry out certain processing or allow access from outside the European Economic Area in accordance with the conditions applicable to their services. Where there is an international transfer, it must have an adequacy decision or the appropriate guarantees required by the GDPR, such as standard contractual clauses and, where appropriate, complementary measures.

You can request information about the recipients and the guarantees applicable to our treatment by writing to gdpr@entendoo.com. Choosing a European data center does not in itself guarantee that any operation of a provider is limited to that territory.

7. Your rights

You can request access, rectification, deletion, limitation or opposition and, where applicable, portability, by writing to gdpr@entendoo.com or the address of the person responsible. Identifies the request and indicates a means of response. If there are reasonable doubts about your identity, we will request only the additional information necessary; It is not necessary to send a copy of the DNI by default.

You can withdraw your consent through that same channel. The withdrawal does not affect the legality of the previous treatment. We will respond to requests without undue delay and, generally, within one month; If a legal extension occurs due to complexity or number of requests, we will inform you within the first month.

If you consider that the processing violates the regulations, you can file a claim with the Spanish Data Protection Agency, without prejudice to other corresponding means of protection. Contacting us beforehand can help us resolve the incident, but it is not a requirement to go to the authority.

8. Security and changes to this information

We apply technical and organisational measures to protect data, such as encrypted communications, restricted access, strong authentication of authorized personnel, separation of duties, and encrypted copies. No measure absolutely eliminates all risks; If you detect an incident, report it to gdpr@entendoo.com without including more information than necessary.

This policy will be reviewed when treatments or conditions change. The version and date of entry into force allow the applicable information to be identified. A change that requires new information or choice will be addressed before carrying out the corresponding treatment.