Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. What Data We Collect

We collect personal data only when you voluntarily provide it through our contact form or when you interact with our website. This may include:

• Full name and professional title
• Business email address
• Company name and sector
• Project description and message content
• Country or region of operation
• Anonymous usage data via analytics cookies (only if you consent)

3. Purpose and Legal Basis

We process your data for the following purposes and on the following legal bases:

• Responding to enquiries — Legitimate interest and pre-contractual relationship (Art. 6.1.b GDPR)
• Commercial communications — Your explicit consent (Art. 6.1.a GDPR)
• Analytics cookies — Your explicit consent via the cookie banner (Art. 6.1.a GDPR)
• Legal compliance — Legal obligation (Art. 6.1.c GDPR)

4. Cookies

Our website uses cookies. You can accept or reject non-essential cookies through the banner displayed on your first visit. Your preference is stored locally in your browser.

• Essential cookies — Required for the website to function. Always active.
• Analytics cookies (Google Analytics) — Help us understand how visitors use the site. Only activated with your explicit consent.

You can withdraw your consent at any time by clearing your browser's local storage or adjusting your browser settings.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Contact enquiries are retained for a maximum of 3 years, after which they are securely deleted.

6. Data Sharing

We do not sell, rent or trade your personal data to third parties. Data may be shared with:

• Netlify — Website hosting and form processing (USA, adequacy decision / SCCs)
• Google Analytics — Anonymous web analytics, only if you consent (USA, adequacy decision / SCCs)
• Microsoft 365 — Email management (EU data centres)

All third-party processors are bound by data processing agreements and operate in compliance with GDPR.

7. Your Rights

Under the GDPR and Spanish data protection law (LOPDGDD), you have the right to:

• Access — Request a copy of the personal data we hold about you
• Rectification — Request correction of inaccurate or incomplete data
• Erasure — Request deletion of your data ("right to be forgotten")
• Restriction — Request that we limit processing of your data
• Portability — Receive your data in a structured, machine-readable format
• Objection — Object to processing based on legitimate interest
• Withdraw consent — Withdraw any consent given at any time

To exercise any of these rights, please contact us at info@ces-projects.com. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. Our website is served exclusively over HTTPS with a valid SSL certificate.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated revision date. We encourage you to review this page periodically.

Contact

For any questions regarding this Privacy Policy or your personal data, please contact us at info@ces-projects.com.