Privacy policy for Sunny Data

What data we process

• Contact form: name, company or organisation (optional), work email address and the content of your enquiry.
• Email correspondence: any data you include if you write to us directly.
• Technical data required to deliver and protect the site: IP address and browser data processed by our hosting and anti-abuse provider.
• Analytics data, only if you consent to it — see the cookie policy.

Why we process it

• To read your enquiry and reply to it, including preparing an initial assessment or a proposal.
• To keep a record of the commercial conversation while it is ongoing.
• To protect the form against automated abuse and spam.
• To measure aggregate website usage, only with your consent.

Legal basis

• Replying to your enquiry: pre-contractual measures taken at your request — article 6(1)(b) GDPR.
• Protecting the form against abuse and keeping the site secure: our legitimate interest — article 6(1)(f) GDPR.
• Analytics cookies: your consent — article 6(1)(a) GDPR, which you can withdraw at any time.

How long we keep your data

We keep enquiries for as long as the conversation is active and for up to twelve months afterwards, so that we can pick up the thread if you come back to us. After that they are deleted. If the enquiry leads to a contract, the associated data is kept for the periods required by commercial and tax law.

Who else has access

We do not sell or rent personal data, and we do not use it for automated decision-making or profiling. We use the following Google services to operate the website and handle enquiries:

• Firebase Hosting, Cloud Functions, App Check and reCAPTCHA Enterprise — website delivery, form processing and abuse protection, under the data-processing terms applicable to those services. The form function runs in the europe-west1 region.
• Google email services — delivery and management of the inbox that receives your enquiry, under the terms applicable to the account used by Sunny Data.
• Google Analytics — website measurement, only if you have accepted analytics cookies.

Data may also be disclosed to public authorities where we are legally required to do so.

International transfers

Our providers may process data on servers outside the European Economic Area. Where that happens, the transfer relies on recognised safeguards, including adequacy decisions, the EU-US Data Privacy Framework and standard contractual clauses. More information: Google’s data transfer frameworks.

Security

The site is served over HTTPS, the contact form is protected against automated submissions, and access to the inbox that receives enquiries is restricted and protected by two-factor authentication. No system is completely secure, so please do not send confidential information, credentials or special categories of data through the form.

Your rights

You may ask us for access to your personal data and for its rectification or erasure, and you may request restriction of processing, object to it or ask for portability. Write to the address above and we will respond within the time limits set by data protection law. You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos): www.aepd.es.

Changes to this policy

We may update this policy to reflect changes in the service or in the applicable rules. The version published on this page is always the one in force.