Обробка даних

This page explains how we process personal data you send through the website. Read it with our Privacy Policy.

For client projects, we sign a separate Data Processing Agreement (DPA) with each client. Email esa@esadex.com to request our standard DPA.

1. The only processing activity on this site

This website has a single personal-data entry point: the contact form on the Contact page. No other form, login, comment system, checkout or account mechanism exists.

2. Record of processing

Purpose

To answer your enquiry and, where relevant, define a potential project.

Categories of data subjects

• Prospective clients and their representatives who voluntarily contact us.

Categories of personal data

• Identification: name
• Contact: work email
• Professional: company name (optional)
• Project metadata: project type, budget range
• Free text: the message you send us

We do not intentionally collect special-category data (health, political opinions, biometrics, etc.). Please do not include such information in your message.

Legal basis (Art. 6 GDPR)

Your consent, given by submitting the form.

Recipients

• ESADEX staff on a need-to-know basis.
• Google: acts as processor to deliver the message to our inbox.
• GoDaddy: acts as processor to host this website.

All processors are bound by a DPA and operate within the EU / EEA.

International transfers

None. All processing takes place inside the EU / EEA.

Retention

Up to 24 months from the date of your last message. If the enquiry leads to a commercial engagement, we move the data to our client records and apply the relevant legal retention periods.

Security measures

• TLS encryption in transit.
• Access control with least-privilege.
• Audit logging of admin access to the inbox.
• Periodic review of processors and their security posture.

3. Your rights

You can exercise your rights of access, rectification, deletion, restriction, objection and data portability by emailing esa@esadex.com. We will respond within 30 days.

You can also file a complaint with the Spanish Data Protection Agency (AEPD) if you believe your rights have been violated.

4. Breach notification

If a personal-data breach is likely to create a risk to your rights, we will notify the AEPD within 72 hours as required by Art. 33 GDPR. If the risk is high, we will also notify affected people without undue delay.

5. Contact

Privacy and data-processing questions: esa@esadex.com.