CAENES
Let's talk

Privacy and Cookie Policy

Your data is yours. Here we explain, with no fine print and no beating around the bush, what information we process, why, for how long and who we share it with. This document complies with Regulation (EU) 2016/679 of 27 April (GDPR), Ley Orgánica 3/2018, de 5 de diciembre (LOPDGDD) and Ley 34/2002, de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI-CE).

1. Data controller

The controller responsible for processing your personal data is:

For any matter relating to your data, write to the email above with «Data protection» in the subject line. A real person replies, not an automated form.

2. What data do we process?

We only process the data you give us or that is generated during your relationship with us:

  • Identification and contact data: name, company, email and phone number you give us in the contact form, by email or when hiring a service.
  • Contractual and billing data: when you are a client or supplier.
  • Content of your communications: what you tell us about your project or enquiry.
  • Browsing data: information about how you use the site, collected through cookies and only if you give your consent (see section 9).

We neither request nor process special categories of data (health, ideology, religion, etc.). Please do not send us that kind of information.

3. For what purpose do we process your data?

  • To answer your enquiries and prepare the quotes you request.
  • To manage the contractual relationship and provide the services you hire, including their follow-up.
  • To handle the administrative, accounting and tax duties arising from that relationship.
  • To send you, only if you authorise it, our newsletter and communications about our own services. You can unsubscribe at any time.
  • To analyse in aggregate how the site is used in order to improve it, through statistical cookies and with your consent.
  • To comply with the legal obligations that apply to us.

4. What is the legal basis (grounds for processing)?

  • Your consent (art. 6.1.a GDPR): to answer enquiries through the forms, send you commercial communications and enable non-essential cookies.
  • Performance of a contract (art. 6.1.b GDPR): to provide and manage the services you hire.
  • Compliance with a legal obligation (art. 6.1.c GDPR): for tax, accounting and commercial obligations.
  • Legitimate interest (art. 6.1.f GDPR): to keep the site secure and improve our services, always in a proportionate way and respecting your rights.

Providing us with your data is voluntary, but some of it is necessary in order to assist you or provide the service. If you do not give it to us, we may not be able to handle your request.

5. How long do we keep your data?

  • Enquiries and contacts: while we handle your request and, if no relationship comes about, up to 1 year after the last contact.
  • Clients and suppliers: throughout the relationship and, once it ends, for the legally required periods (at least 6 years for tax, accounting and commercial obligations).
  • Newsletter and commercial communications: until you unsubscribe or withdraw your consent.
  • Browsing data (cookies): depending on the lifetime of each cookie; your consent choice is kept for 12 months (see section 9).

When it is no longer needed, we block your data during the legal limitation periods and then delete it securely.

6. Who do we share your data with?

We do not sell or transfer your data to third parties. It is only processed, on our behalf and under a data processing agreement (art. 28 GDPR), by the technology providers we need in order to operate:

  • Google Workspace (Google Ireland Ltd.): email, calendar, document storage and office software we use to manage our relationship with you.
  • Brevo (Sendinblue SAS, with servers in the European Union): platform for sending the newsletter, transactional emails and managing forms and subscriptions.
  • Google Site Kit and Google Analytics 4 (Google Ireland Ltd.): site usage analytics and statistics, only if you accept statistical cookies.
  • Hosting and maintenance providers for the website.
  • Tax, accounting and employment advisors and banking institutions, when necessary to fulfil the contract or the law.
  • Public authorities and courts, when there is a legal obligation to disclose it.

Some of these providers (for example, Google) may process data outside the European Economic Area. In those cases we apply the safeguards set out in the GDPR: adequacy decisions, the EU-U.S. Data Privacy Framework and/or the standard contractual clauses approved by the European Commission.

7. What are your rights?

You can exercise the following rights at any time:

  • Access: to know whether we process your data and obtain a copy of it.
  • Rectification: to correct inaccurate or incomplete data.
  • Erasure («right to be forgotten»): to ask us to delete your data when it is no longer necessary.
  • Objection: to object to processing based on legitimate interest or to direct marketing.
  • Restriction: to request that we restrict processing in certain cases.
  • Portability: to receive your data in a structured, commonly used format, or to have us send it to another controller.
  • To withdraw consent at any time, without this affecting the lawfulness of the processing carried out beforehand.

To exercise them, write to us at [email protected], identifying yourself (enclose a copy of your DNI —national ID— or an equivalent document) and stating which right you wish to exercise. We will reply within a maximum of 1 month (extendable by 2 more in complex cases).

If you believe we have not handled your request properly, you have the right to lodge a complaint with the supervisory authority: the Spanish Data Protection Agency (AEPD) (www.aepd.es).

8. Security of your data

We apply appropriate technical and organisational measures to ensure a level of security suited to the risk: encryption in transit (HTTPS), access control, regular backups, data minimisation and activity logs. All staff with access to personal data are bound by a duty of confidentiality.

9. Cookie Policy

9.1. What are cookies?

Cookies are small text files that a website stores in your browser. They let the site remember information about your visit (language, preferences, previous browsing) and, in some cases, measure its use. We use our own cookies (managed by this site) and third-party cookies (managed by an external domain, such as Google, subject to its own privacy policy).

9.2. Types of cookies we use

We group them into four categories, the same ones you can enable or disable in our cookie banner:

  • Necessary: essential for the site to work (session, security, load balancing). They also store your cookie choice in the damos_consent cookie, kept for 12 months. As they are strictly necessary, they do not require consent and cannot be disabled.
  • Preferences: they remember your choices, such as language, region or visual mode. They require your consent.
  • Statistics: they help us understand how the site is used in an aggregated and anonymous way. Here we use Google Analytics 4 through Google Site Kit (cookies of the _ga and _ga_* type). They require your consent.
  • Marketing: they let personalised content or ads be shown and measured on and off the site (for example, Google remarketing or social media pixels). They only load if you give your consent; if you do not, they are not activated.

9.3. How to manage or withdraw your consent

The first time you visit the site, a banner appears where you can accept all, reject or customise cookies by category. Your choice is saved for 12 months.

You can change or withdraw it whenever you want by clicking the floating «🍪» button in the bottom corner of the site. Until you accept, statistical and marketing cookies stay blocked (we apply Google Consent Mode).

You can also delete or block cookies from your browser settings. Here are the official guides:

If you block all cookies, some features of the site may not work properly.

10. Changes to this policy

We may update this policy to adapt it to regulatory, technical or operational changes. We recommend reviewing it from time to time. If the change is significant, we will let you know through the usual channels.

Last updated: July 2026.