What data we process, what for and for how long
This policy explains how we process the personal data of people who visit this website or request a demo. How data protection works within the service, once you are a customer, is explained in privacy and security.
Last updated: 24 September 2026.
This is a translation for convenience. If it differs from the Spanish version, the Spanish version prevails.
Data controller
The Consulting Company OÜ, an Estonian company with registry code 14776626 and registered office at Sepapaja 6, Tallin, condado de Harju, PENDIENTE: código postal de Tallin Estonia. Email: hola@gestionsmart.es.
The service to Spanish customers is provided from its establishment in Spain, at calle Juan Rogelio Estarlich, número 1, piso 12, 46269 Tous (Valencia), with NIF 56010112Y. Because of that establishment, the competent supervisory authority is the Agencia Española de Protección de Datos (the Spanish Data Protection Agency).
No data protection officer has been appointed. For any question about your data, write to that email address.
Two roles that are worth keeping apart
On this website we are the controller. We decide what data we ask for in the form and what we use it for, and that is what this policy covers.
In the service we are the processor. When a business signs up with us, its customers’ data – the caller, their appointments, their requests – still belongs to that business, which decides what is done with it. We process it on the business’s behalf and following its instructions, under a data processing agreement signed before the first call comes in, as required by Article 28 of the General Data Protection Regulation (GDPR).
What data we process and for what purpose
| What data | Purpose | Legal basis | How long |
|---|---|---|---|
| Name, business, sector, phone, email, call volume and whatever you write in the free-text field of the demo form, together with the language of the page you send it from, so that we can reply in that language | Preparing the demo, replying to you and following up on the sale | Your consent when you send the form, and our legitimate interest in replying to people who ask us about the service (Article 6.1.a and 6.1.f of the GDPR) | One year from the last contact, if you do not sign up. If you do, they become part of the contractual relationship |
| The same data, when you write to us directly at hola@gestionsmart.es | Dealing with your enquiry | Legitimate interest in replying (Article 6.1.f of the GDPR) | One year from the last contact |
| Browsing data collected by analytics (pages viewed, where you came from, device type), only if you accept analytics cookies | Knowing which pages are useful and which are not, in order to improve them | Your consent (Article 6.1.a of the GDPR) | As set out in the cookie policy |
We do not make automated decisions or build profiles with this data, and we do not use it for third-party advertising.
Data we do not want to receive
The form is for talking about your business, not about your customers. Do not enter third parties’ personal data or health data in it. If we receive any anyway, we delete it as soon as we notice it.
Who else has access to your data
We do not sell or pass on your data. Only the providers we need for the website and email to work have access, each under its own data processing agreement:
- Google Ireland Limited, for hosting the website (Firebase Hosting) and, if you accept, for analytics (Google Analytics 4).
- PENDIENTE: proveedor de correo electrónico, to manage hola@gestionsmart.es.
International transfers. These providers may process data outside the European Economic Area, mainly in the United States. Those transfers are covered by the EU-U.S. Data Privacy Framework and, failing that, by the standard contractual clauses approved by the European Commission.
We may also disclose data to public authorities and the courts when the law requires us to.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given us without affecting the processing carried out before then. Write to us at hola@gestionsmart.es stating which right you wish to exercise; we may ask you for something that proves your identity. We will reply within one month.
If you believe we have not handled your request properly, you can lodge a complaint with the Agencia Española de Protección de Datos (calle Jorge Juan 6, 28001 Madrid, aepd.es). We would appreciate it if you told us first.
Security
We apply the technical and organisational measures of Article 32 of the GDPR: encryption of sensitive data in transit and at rest, credentials stored on the server and never sent back to the browser, access roles that separate who sees what, and a log of access to protected data. The details are in privacy and security.
Changes to this policy
If the processing changes, we update this page and its date. When the change is significant and we have your email address, we will tell you.