Privacy policy

2. Purpose of processing

The data you provide through the contact form (first name, surname, company, phone, email, service of interest, company size and message) is used solely to respond to your enquiry, prepare the free review you have requested and, where applicable, manage the pre-contractual or contractual commercial relationship arising from that enquiry. It is not used for any other purpose, nor is it used for automated profiling, without your explicit consent. If you accept analytics cookies, we also process aggregate browsing data (page views, referrals, visit duration) through Google Analytics 4, solely to understand and improve site usage; this processing is always optional and revocable, see the cookie policy.

3. Legal basis

The legal basis for processing contact-form data is your consent (art. 6.1.a GDPR), given by ticking the privacy box and submitting the form, and the legitimate interest in handling your commercial contact request (art. 6.1.f GDPR) where a prior relationship with you already exists. The legal basis for analytics cookies is your consent (art. 6.1.a GDPR and art. 22.2 LSSI-CE), given or refused in the cookie panel and revocable at any time as easily as it was given.

4. Data retention

Contact-form data is kept for as long as an active or potential commercial relationship exists and, in any case, for the periods established by law to address any liabilities arising from the processing. Once those periods have elapsed, it is securely deleted or anonymised. Aggregate Google Analytics 4 data is kept for 2 months from the visit, that tool's default retention period (extendable up to 14 months from its settings).

5. Recipients and processors

Your data is not disclosed to third parties unless required by law. It may be accessed, as data processors under article 28 of the GDPR, by:

• Resend (Plus Five Five, Inc.): sends the emails generated by the contact form (internal notification and confirmation to the user).
• Google Ireland Limited / Google LLC: processes aggregate Google Analytics 4 browsing data, only if you accept analytics cookies.
• Cloudflare, Inc.: verifies that whoever submits the form is a person and not an automated program (Turnstile), without accessing the message content.
• Hosting and technical infrastructure providers necessary for the website to run.

6. International transfers

Some of the providers listed above are located outside the European Economic Area (EEA), which involves an international data transfer:

• Google (Google Analytics 4): Google LLC is certified under the EU-US Data Privacy Framework, recognised as an adequate safeguard by European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023.
• Resend (Plus Five Five, Inc., based in San Francisco, USA): processing takes place primarily in the United States. The transfer is covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), incorporated into its data processing agreement, and Resend is also certified under the EU-US Data Privacy Framework as an additional safeguard.

7. Your rights

You may exercise the following rights at any time by writing to info@lynkio.es, stating the right you wish to exercise and attaching a document proving your identity:

• Access: find out which of your data we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer necessary.
• Objection: object to a specific processing activity, including profiling.
• Restriction: ask us to temporarily restrict the use of your data.
• Portability: receive your data in a structured format to take it to another provider.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

8. Right to lodge a complaint

If you believe we have not processed your data in accordance with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es), the competent supervisory authority in Spain.

9. Data Protection Officer

Under article 34 of the LOPDGDD, entities that operate networks or provide electronic communications services must appoint a Data Protection Officer (DPO) when they process data on a large scale. At the current processing volume of Lynkio Networks, S.L. (commercial contact requests) that threshold is not reached, so no DPO has been appointed. This position is reviewed on an ongoing basis and will be updated as appropriate in line with the growth of the client base.