Privacy policy

Section 1Data controller

The controller of the personal data collected through this website is oscarcabreragonzalez IoT Studio, located at Paul Krugerstraat, Vlissingen (Zeeland), the Netherlands.

For any question regarding this policy or the exercise of your rights, you can contact us through the form on the contact page. [Template: add the controller's email and, where applicable, the Chamber of Commerce (KvK) registration number.]

Section 2Data we collect

We only process the data you voluntarily provide through our forms (contact, information request, newsletter subscription and service forms):

• Identification and contact data: first and last name, company and email address.
• Content of the enquiry: the message or information you choose to include.
• Minimal technical security data: to prevent automated submissions and form abuse, we temporarily process an encrypted version (hash) of your IP address. We do not store it in clear text or use it to identify you.

We do not collect special categories of data or carry out profiling for advertising purposes.

Section 3Purpose and legal basis

We process your data for the following purposes and on the following legal bases (Art. 6 GDPR):

• Handling your request or enquiry and sending you a technical proposal — basis: consent and/or pre-contractual measures at the request of the data subject.
• Managing the newsletter subscription, if you request it — basis: consent, with double confirmation (double opt-in) and unsubscription available at any time.
• Ensuring the security of the forms (fraud prevention and automated submissions) — basis: legitimate interest.

Section 4Data retention

We keep your data for as long as necessary to handle your request and, thereafter, for the legally required periods. Newsletter subscription data are kept until you withdraw your consent (unsubscribe). Technical security data are kept only for the minimum time necessary for their purpose and are deleted automatically.

Section 5Recipients and disclosures

We do not disclose your data to third parties unless legally required. We may rely on technology providers (for example, web hosting or email) acting as processors under contract and with the safeguards of Art. 28 GDPR.

Section 6Location map and third parties

The map on the contact page is our own illustration served from our server. Visiting it does not load any external map service, no third-party cookies are installed and your IP address is not shared with anyone.

Our forms do not use external verification services either: the CAPTCHA is our own (see section 7).

Section 7Information security

We apply technical and organisational measures to protect your data. Our forms include our own anti-automation verification, without external services (an image CAPTCHA with an audio alternative, single-use, cryptographically signed and expiring after 5 minutes), rate limiting of submissions per address and server-side validation, so that protection does not depend solely on the user's browser.

Section 8Your rights

You may at any time exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw any consent given. To do so, contact us through the form. You also have the right to lodge a complaint with the competent supervisory authority; in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Section 9International transfers

We do not carry out international data transfers: we process your data within the European Economic Area. If in the future a provider were to involve a transfer, it will be reported here and the safeguards provided for in Chapter V of the GDPR will be applied.

Section 10Changes to this policy

We may update this policy to adapt it to regulatory changes or to our services. The current version will always be the one published on this page. [Template: state the effective date and version number.]