Privacy Policy

This Privacy Policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), and Law 34/2002 of 11 July on information society services and electronic commerce (LSSI-CE).

By providing us with your personal data, whether through the contact form, by email or by any other means, you declare that you have read and understood this Privacy Policy.

1. Data controller

  • Controller: Serhii Karnaukh
  • NIF / NIE: Y9948734Y
  • Address: Ronda Fort Roig 15-20, P2-7, Girona, 17007 (Spain)
  • Contact email: informatica@girona.services
  • Trade name / website: Sergii Informatica (informatica.girona.services)

In accordance with Article 4(7) of the GDPR, the controller is the person who determines the purposes and means of the processing of your personal data.

Data Protection Officer (DPO): we have not appointed a DPO, as none of the cases in which appointment is mandatory under Article 37 of the GDPR and Article 34 of the LOPDGDD applies. For any data protection matter you can write directly to informatica@girona.services.

2. For what purposes do we process your data?

We process the information you provide for the following purposes:

  • To respond to your enquiries and requests, for example those received through the contact form or by email.
  • To manage the hiring and provision of our services, including preparing quotes, performing the contract, invoicing and after-sales support.
  • To send you communications related to the contracted service (technical notices, renewals, incidents, changes to the service conditions).
  • To send you commercial offers and advertising about our services, only with your prior, express and informed consent.
  • To comply with our legal obligations, in particular tax, accounting and commercial obligations.
  • To ensure the security of the website (see section 9).

We do not create profiles or make decisions based solely on automated processing of your data that produce legal effects concerning you or similarly significantly affect you (Article 22 of the GDPR).

3. What data do we process?

Depending on your relationship with us, we may process the following categories of data:

  • Identification and contact data: first name and surname, email, telephone, company or business name.
  • Commercial relationship data: content of your enquiries, services requested or contracted, quotes.
  • Billing data: NIF/CIF, tax address, data necessary to issue and keep invoices.
  • Minimal technical data (IP address and date and time of access) recorded by the server for security purposes, as explained in section 9.

We do not request or process special categories of data (Article 9 of the GDPR), such as data concerning health, ideology, religion or ethnic origin. Please do not send them to us.

The data you provide must be truthful and up to date. You are responsible for informing us of any changes. If you provide us with data of third parties, you guarantee that you have their consent or another legal basis to do so.

The legal bases that legitimise the processing of your data, in accordance with Article 6(1) of the GDPR, are the following:

  • Consent (Art. 6(1)(a) GDPR): to respond to your enquiries when you contact us, and to send commercial communications. You may withdraw it at any time, without affecting the lawfulness of the processing carried out before its withdrawal (Art. 7(3) GDPR).
  • Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): to manage the hiring and provision of the services you request from us.
  • Compliance with a legal obligation (Art. 6(1)(c) GDPR): to meet the applicable tax, accounting and commercial obligations.
  • Legitimate interest (Art. 6(1)(f) GDPR): solely to ensure the security of our website and systems, after weighing that this interest does not override your rights and freedoms.

Commercial communications by electronic means are sent in accordance with Article 21 of the LSSI-CE, which requires your prior and express consent, or an existing contractual relationship regarding services similar to those contracted. In all communications we will offer you a simple and free way to unsubscribe.

Minors: this website and our services are aimed at adults and professionals. In accordance with Article 7 of the LOPDGDD, the processing of data of minors under 14 is lawful only with the consent of their parents or guardians. If you become aware that a minor has provided us with data without such consent, please let us know so that we can delete it.

Consequences of not providing the data: the data marked as mandatory in our forms are necessary to handle your request. If you do not provide them, we will not be able to process it.

5. How long do we keep the data?

  • Enquiries with no subsequent contractual relationship: we keep your data for the time necessary to handle your request and, afterwards, for a maximum of 12 months, unless you withdraw your consent earlier.
  • Customers: while the contractual relationship lasts and, once it has ended, for the limitation periods of possible liabilities arising from the relationship, which in general are five years for personal actions (Article 1964 of the Civil Code).
  • Tax and accounting documentation (invoices, books): for the period required by the applicable regulations, in general four years under Article 66 of Law 58/2003, General Tax Law, and six years under Article 30 of the Commercial Code.
  • Commercial communications: until you withdraw your consent or request to unsubscribe.

Once these periods have elapsed, your data will be blocked in accordance with Article 32 of the LOPDGDD, remaining available exclusively to judges, courts and Public Administrations for the limitation period of possible liabilities, and will subsequently be securely deleted.

6. To which recipients is the data disclosed?

We do not disclose your data to third parties under any circumstances, except where there is a legal obligation, for example, in response to requests from the Tax Agency, law enforcement bodies, judges and courts or other competent authorities.

All data is processed internally by Sergii Informatica and stored on servers located in Girona, Spain. We do not carry out international transfers of data to third countries or international organisations (Chapter V of the GDPR).

Should we use in the future any provider that accesses personal data on our behalf (processor), we will do so by means of the corresponding contract in accordance with Article 28 of the GDPR and will update this policy.

7. What are your rights?

In accordance with Articles 15 to 22 of the GDPR and Articles 12 to 18 of the LOPDGDD, you may exercise the following rights:

  • Access (Art. 15 GDPR): to know whether we process your data and to obtain a copy of it.
  • Rectification (Art. 16 GDPR): to correct inaccurate or incomplete data.
  • Erasure or “right to be forgotten” (Art. 17 GDPR): to request that we delete your data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
  • Restriction of processing (Art. 18 GDPR): to request that we suspend the processing in the cases provided for by the regulation.
  • Portability (Art. 20 GDPR): to receive your data in a structured, commonly used and machine-readable format, and to transmit it to another controller.
  • Objection (Art. 21 GDPR): to object to the processing of your data, in particular processing for direct marketing purposes.
  • Not to be subject to automated individual decision-making (Art. 22 GDPR).
  • To withdraw your consent at any time (Art. 7(3) GDPR), as easily as you gave it.

How to exercise them: send an email to informatica@girona.services stating the right you wish to exercise and attaching a copy of your identity document, or another document proving your identity, to prevent third parties from accessing your data. You may also send your request in writing to the postal address given in section 1.

Response time: we will respond to your request without undue delay and, in any case, within one month of receiving it, extendable by two further months if necessary taking into account the complexity and number of requests (Article 12(3) of the GDPR). Exercising your rights is free of charge, unless the requests are manifestly unfounded or excessive.

Right to lodge a complaint: if you consider that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) in accordance with Article 77 of the GDPR and Article 63 of the LOPDGDD:

  • Website: www.aepd.es
  • Postal address: C/ Jorge Juan, 6, 28001 Madrid

We would appreciate it if, before going to the AEPD, you gave us the opportunity to resolve any issue by contacting us.

8. Cookies and tracking

This website does not use cookies of any kind. We do not install technical, preference, analytics or advertising cookies in your browser or on your device. Therefore, and in accordance with Article 22(2) of the LSSI-CE, it is not necessary to obtain your consent or display a cookie banner.

We do not track you. We do not use analytics, tracking, profiling or advertising tools that record your activity on our site. We do not collect browsing data for tracking purposes nor share information with third parties for such purposes. Nor do we use third-party resources (such as fonts, maps, videos or embedded social media buttons) that could transmit your IP address to other operators.

External links: this website may contain links to third-party pages. We are not responsible for their privacy policies or cookies; we recommend that you review them when you access them.

9. Server logs and security

As with any website, our server may automatically record minimal technical data about each visit (IP address, date and time, requested page and browser type). These logs:

  • are used exclusively to ensure the security and proper functioning of the site and to detect and prevent abuse or cyberattacks;
  • are processed on the basis of legitimate interest (Art. 6(1)(f) GDPR);
  • are not used to create profiles or for commercial or analytical purposes;
  • are kept for a maximum of 12 months and then deleted.

Security measures: in accordance with Article 32 of the GDPR, we apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration, including the use of encrypted connections (HTTPS), access control and the making of backups. In the event of a security breach that entails a risk to your rights and freedoms, we will notify the AEPD within 72 hours and, where the risk is high, we will inform you without undue delay (Articles 33 and 34 of the GDPR).

10. Commercial communications and unsubscribing

We will only send you commercial communications if you have given your express consent or if there is a prior contractual relationship and the communications relate to similar services (Article 21 of the LSSI-CE). You may withdraw your consent and unsubscribe at any time, free of charge, using the link or instruction included in each communication or by writing to informatica@girona.services.

Before sending commercial communications, we will consult the applicable advertising exclusion systems, in accordance with Article 23 of the LOPDGDD.

11. Changes to this policy

We may update this Privacy Policy to adapt it to legislative or case-law changes or to changes in our processing. The version in force will always be the one published on this page, indicating the date of the last update. If the changes are substantial, we will notify you by appropriate means.

12. Applicable law and jurisdiction

This Privacy Policy is governed by Spanish law and European data protection regulations. Without prejudice to your right to go to the AEPD, the courts and tribunals competent under the applicable regulations will have jurisdiction over any dispute arising from the processing of your data, and, if you are a consumer, those of your place of residence.