Privacy policy

1. Data controller

The controller for the processing described in this policy is:

Owner

Emilio Pérez Rey (sole trader)

Trading name

Ademas Software

Tax ID (NIF)

53128807A

Email

info@ademasestudio.es

No data protection officer has been appointed. For any privacy question, write to info@ademasestudio.es.

2. What data we process, why and for how long

2.1 Enquiries and requests for quotes

• When: if you email us or send us a WhatsApp message.
• Data: name, contact details, company and whatever you tell us in your message.
• Purpose: to reply to you and, if you ask, to prepare a proposal.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, for general enquiries, our legitimate interest in answering those who contact us (Art. 6(1)(f) GDPR).
• Retention: while we handle your enquiry and, if it does not lead to a business relationship, no longer than 12 months after the last contact.

2.2 Customers and suppliers

• Data: contact details of the people we deal with and billing data.
• Purpose: to manage the contract, invoicing and accounting.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c) GDPR).
• Retention: for the duration of the relationship and, afterwards, for the periods required by tax and commercial law.

2.3 Web server logs

• Data: IP address, date and time, page requested, response code and browser used.
• Purpose: to keep the website running and protect it against abuse and attacks.
• Legal basis: our legitimate interest in the security of the website (Art. 6(1)(f) GDPR).
• Retention: 30 days, unless needed to investigate a specific security incident.

We do not send marketing communications to anyone who has not asked for them, we do not create profiles and we do not take automated decisions that affect you.

3. Data we process on behalf of our customers (including WhatsApp Business)

When a business customer engages us to manage its WhatsApp Business channel or other systems, we process the messages and data of its customers as a processor (Art. 28 GDPR): only on its instructions and under a signed data processing agreement.

In that case the business customer is the controller. If you are a customer of that business, you can contact it to exercise your rights; if you write to us instead, we will pass your request on without delay.

We only access the data that the business authorises through Meta's official permissions. We do not use it for our own purposes, we do not sell it, we do not share it and we do not use it to train artificial intelligence models.

How to request deletion of your data

4. Recipients

We do not disclose your data to third parties unless required by law. To provide our services we rely on the following providers, who act as processors under the agreement required by Article 28 GDPR:

• Microsoft Ibérica, S.R.L.: email and office software (Microsoft 365).
• CLOUDI NEXTGEN, S.L. (Clouding.io): server hosting in Spain.

WhatsApp Business (Meta). WhatsApp Business is provided by Meta Platforms Ireland Ltd. directly to whoever uses that channel (us or the business customer), under its own terms and privacy policy; Meta does not act as our processor. If you communicate with us or with a business customer via WhatsApp, Meta processes certain data under those terms.

5. International transfers

We give priority to providers that process data within the European Economic Area. If any provider processes data outside it, it does so with the safeguards of Chapter V GDPR, such as a European Commission adequacy decision or standard contractual clauses.

6. Your rights

You can request access to your data, its rectification or erasure, restriction of processing, object to it and ask for portability. Where processing is based on your consent, you can withdraw it at any time without affecting processing carried out before.

To exercise them, write to info@ademasestudio.es with the subject “Data protection”, stating which right you are exercising and a way for us to verify your identity. We will reply within one month, extendable by two further months in complex cases, as provided for in the GDPR.

If you believe we have not handled your request properly, you can lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es).

7. Security

We apply technical and organisational measures appropriate to the risk: encrypted connections, restricted access to systems, backups and regular security updates.

8. Changes to this policy

If we change this policy, we will publish the new version on this page with its date. If the change is significant and we have your contact details, we will let you know.

Version 1.1 · in force since 5 November 2026