Privacy Policy of Rossol

1. Data controller

This Privacy Policy explains how Rossol collects, uses, stores and protects the personal data of people who visit this website or get in touch through it.

The data controller is:

• Controller: Rossol
• Tax ID: Z1789409Z
• Address: Avenida Central 46 12594, Oropesa del Mar, Castellón de la Plana
• Contact email: contacto@rossol.me

To exercise your rights or for any data protection query, you can write to us at:

• contacto@rossol.me

2. Scope of this policy

This policy applies only to this corporate website. It does not cover the data processing carried out by the products in the Rossol portfolio, each of which operates on its own domain and publishes its own privacy policy.

Nor does it cover the processing Rossol carries out as a supplier within a project commissioned by a client. In those cases the relationship is governed by the services agreement and, where applicable, by the corresponding data processing agreement.

3. What data we process

This website requires no registration and creates no user accounts. The only personal data processed is the following:

3.1. Data you provide in the contact form

• Name.
• Work email address.
• Company (optional field).
• The type of need selected.
• The stage the project is at.
• The content of the message you write.
• Confirmation that you have accepted this privacy policy.

3.2. Technical data arising from browsing

• IP address, used temporarily to limit the number of form submissions and prevent abuse. It is not stored in the clear: only a derived value is kept, from which the original address cannot be recovered.
• Server logs recording the date, the requested path and the response code, generated automatically for the maintenance and security of the service.
• A technical session identifier, required to protect the form against fraudulent submissions.

3.3. Data we do not process

• We carry out no cross-site tracking and build no behavioural profiles.
• We use no advertising or third-party cookies.
• We process no special categories of data, and we ask you not to include any in the form message.

4. Why we use the data and on what legal basis

We do not use your data to send you unsolicited commercial communications, nor do we add it to any mailing list.

4.1. Responding to your enquiry

• Purpose: to read your message, assess whether we can help and reply to you, including any follow-up communication needed to clarify the proposal.
• Legal basis: your consent, given by ticking the box and submitting the form (article 6(1)(a) GDPR).

4.2. Preparing a possible contractual relationship

• Purpose: to prepare a proposal if your enquiry progresses.
• Legal basis: pre-contractual steps taken at your request (article 6(1)(b) GDPR).

4.3. Security and abuse prevention

• Purpose: to limit automated form submissions, detect incidents and keep the site secure.
• Legal basis: our legitimate interest in protecting the service against abuse (article 6(1)(f) GDPR).

4.4. Compliance with legal obligations

• Purpose: to meet the requirements applicable law may impose on the controller.
• Legal basis: compliance with a legal obligation (article 6(1)(c) GDPR).

5. How long we keep the data

Once these periods have elapsed, the data is deleted or duly blocked.

• Messages received through the form are kept for as long as needed to handle the enquiry and, if it does not lead to a contractual relationship, for a reasonable period in order to evidence the exchange.
• If the enquiry leads to a contractual relationship, the data is kept for its duration and thereafter for the limitation periods set by commercial and tax law.
• The value derived from the IP address used to rate-limit form submissions is kept temporarily and is deleted automatically when the limiting period expires.
• Technical server logs are kept for a limited period for security and maintenance purposes.

6. Who can access your data

We do not sell or disclose your personal data to third parties for commercial purposes.

In order to provide the service, certain suppliers access the data as processors, always under contract and following our instructions:

Website hosting

• OVHcloud, which hosts the infrastructure this website runs on, with servers located in Spain.
• It has incidental access to the data stored on the server, including the messages received and the technical logs.

Email delivery

• Amazon Web Services, through its Amazon Simple Email Service (Amazon SES), which delivers the email generated by the contact form.
• It processes the name, email address and message content during delivery. The service is configured in the us-east-1 region, located in the United States.

Corporate mailbox

• Squarespace, provider of the domain and of the mailbox where messages sent from the form are received and stored.
• It is an entity established in the United States, so the email is stored outside the European Economic Area.

7. International transfers

Website hosting is provided from servers located in Spain, within the European Economic Area.

The email generated by the contact form, however, does involve an international data transfer: it is delivered through a service configured in the United States and stored in a mailbox provided by a company also established in the United States. This affects the name, email address and message content you send us.

These transfers rely on the safeguards set out in Chapter V of the General Data Protection Regulation, in particular the standard contractual clauses approved by the European Commission and, where the provider is certified under it, the EU-US Data Privacy Framework, together with any supplementary measures each provider has in place.

If you would rather not use the form for this reason, you can write to us directly at contacto@rossol.me, or request detailed information about these transfers at that same address.

8. Your rights

As the data subject, you may exercise the following rights at any time:

• Access: to know what data of yours we process.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to ask us to delete your data when it is no longer necessary.
• Objection: to object to processing based on our legitimate interest.
• Restriction: to ask us to restrict the processing in the cases provided for by law.
• Portability: to receive your data in a structured, commonly used format.
• Withdrawal of consent: to withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

9. How to exercise your rights

To exercise any of these rights, write to contacto@rossol.me stating which right you wish to exercise. We may ask you to prove your identity before handling the request.

We will respond within the time limits laid down by data protection law.

If you believe the processing of your data does not comply with the rules, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), without prejudice to contacting us first to try to resolve the matter.

10. Data security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration. Among others, the site is served over an encrypted connection, the form is protected against automated submissions, and access to the messages received is restricted to the people who must handle them.

No system can guarantee absolute security, but we review our measures to keep them appropriate to the risk of the processing.

11. Minors

This website is aimed at professionals and businesses and is not intended for minors. We do not knowingly collect data from minors. If we find that we have received data from a minor without the corresponding authorisation, we will delete it.

12. Automated decision-making

We do not take decisions based solely on the automated processing of your data that produce legal effects concerning you or similarly significantly affect you.

13. Changes to this policy

We may update this Privacy Policy to reflect legal changes or changes in how the site works. The version in force is always the one published on this page, and the date of the last revision is shown at the top of the document.

If a change were to substantially affect the processing of data already collected, we would inform you through the available contact channels.

14. Contact

For any question about this policy or about the processing of your personal data, write to us at:

• contacto@rossol.me

15. Cookies and web analytics

We do not use advertising, marketing or third-party cookies, and we do not track you across sites.

To measure site usage we use a self-hosted, first-party web analytics tool (Umami) that records visits in an aggregated and anonymous way. It uses no cookies, does not build profiles or identify individual users, and this data is not shared with third parties.

Only strictly necessary technical cookies required for the site to function may be used, exempt from consent under applicable law.