Privacy policy.

1. Data controller

The controller of the personal data processed through this website is:

Registered name

DIGENCY SL (trading name: Digency)

NIF

B26897082

Registered address

Via de Massagué, 26, 1º 2ª · 08202 Sabadell (Barcelona), España

Email

info@digency.es

Phone

+34 623 28 33 45

Companies Register details

[PENDIENTE: datos registrales]

No data protection officer has been appointed: given the type and volume of data we process, the law does not require one. For any question about your data, write to info@digency.es: it is the channel to use for everything explained here.

2. What data we process and where it comes from

We only process the data you give us or the data your visit generates technically. Channel by channel:

• Contact form: name, company, email, website (optional) and message, along with the date it was sent and the record that you accepted this policy.
• Quote form: name, email, phone and company (the last two optional), the service and the items you tick, your message, and the reference and date of the request.
• AI assistant: the messages you write in the chat, the answers it generates and the page of the website you are on as you write. If you leave a contact detail so we can call you, we treat it as an enquiry.
• WhatsApp: if you press the button and write to us, our number receives your phone number, your profile name and whatever you tell us.
• Email and phone: whatever you send to info@digency.es or tell us over the phone.
• Browsing: technical data generated by any visit (IP address, browser, operating system, pages viewed, date and time) in the server logs; and, only if you accept analytics cookies, pseudonymised usage statistics. The detail is in the cookie policy.
• Blog: reading it requires no data at all. There are no comments and no subscription.
• Clients and suppliers: contact, contractual and invoicing data of the companies we work with and of their contact people.

We do not ask for special categories of data (health, beliefs, religion, trade union membership, sexual orientation). We ask you not to include them in your messages or in the chat, nor data about other people without their permission.

3. What we use the data for and on what legal basis

Each type of processing has its purpose and its legal basis, under article 6 of Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 (LOPDGDD, the Spanish data protection act):

• Answering your enquiry or quote request and, if it fits, preparing a proposal and carrying on the commercial conversation. Basis: pre-contractual steps taken at your request (art. 6.1.b) and, in the contact form, your consent when you tick the box (art. 6.1.a).
• Running the AI assistant and answering what you ask. Basis: your consent, which you give by using it (art. 6.1.a); stopping using it withdraws that consent.
• Dealing with you on WhatsApp when you choose to write to us there. Basis: pre-contractual steps taken at your request (art. 6.1.b).
• Providing the services contracted, invoicing them and meeting our tax, accounting and commercial obligations. Basis: performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c).
• Keeping the website secure, detecting abuse and resolving technical incidents using the server logs. Basis: our legitimate interest in protecting our systems (art. 6.1.f).
• Measuring use of the website with Google Analytics. Basis: your consent in the cookie banner (art. 6.1.a GDPR and art. 22.2 LSSI-CE).
• Sending you information about our services. Only if you have asked us to (consent, art. 6.1.a) or if you are already a client and it concerns services similar to those contracted (art. 21.2 LSSI-CE), always with a simple way to unsubscribe in every message. We do not send newsletters to anyone who has not asked for them.

We do not build profiles with legal effects and we take no automated decisions about you (see section 8). We do not sell your data.

4. How long we keep the data

• Enquiries and quote requests: while we handle your request and any commercial conversation that follows. If it does not turn into a job, one year at most from the last contact, unless you ask us to delete it sooner.
• Conversations with the assistant: we do not store them on our servers. The conversation lives only in your browser while the tab is open and is deleted when you close it; each message is sent, together with the rest of the conversation, to Anthropic so the answer can be generated. Anthropic keeps the inputs and outputs of its API for the limited period set out in its commercial terms and does not use them to train its models. If you leave a contact detail in the chat, the retention period for enquiries applies.
• WhatsApp messages, emails and calls: as long as we need to deal with you, with the same periods as enquiries or, if there is a job, as client data.
• Client and supplier data: for as long as the relationship lasts and, afterwards, blocked for the limitation periods of our legal liabilities: as a general rule, six years for accounting and commercial records (art. 30 of the Código de Comercio, the Spanish commercial code) and four years for tax records (art. 66 of the Ley General Tributaria, the Spanish general tax act).
• Server logs: only as long as needed to diagnose incidents and detect abuse; after that they are deleted or anonymised.
• Usage statistics: for as long as your consent lasts. Google Analytics cookies last for the period stated in the cookie policy.

Once those periods are over, the data is deleted or anonymised. While it is blocked it is kept solely at the disposal of public authorities, judges and courts.

5. Who we share the data with

We do not sell or pass on your data to third parties for their own purposes. It is processed on our behalf, under a data processing agreement (art. 28 GDPR) and only as far as necessary, by these providers:

WhatsApp is a different case: it does not act on our behalf. If you choose to write to us there, WhatsApp Ireland Limited (grupo Meta) processes your data as an independent controller, under its own privacy policy, and may transfer it to the United States under its own safeguards.

We may also disclose data to public authorities, judges, courts or law enforcement when a law requires it, and to our advisers (tax, accounting or legal) and banks, only as far as needed to invoice and to meet legal obligations.

6. International transfers

Some providers are outside the European Economic Area or may transfer data outside it:

• Anthropic (United States), for the AI assistant. The transfer relies on the standard contractual clauses approved by the European Commission, built into its data processing agreement. Anthropic does not use the content of the conversations to train its models.
• Google (Google Analytics), only if you accept analytics cookies. Google Ireland Limited may transfer data to Google LLC, in the United States, relying on the EU-US Data Privacy Framework and on standard contractual clauses.
• WhatsApp (Meta), if you write to us on WhatsApp, as an independent controller and under its own safeguards.

The website database (Supabase) is hosted in Ireland, inside the European Union. You can ask us for more information about these safeguards at info@digency.es.

7. Your rights

You have the right to:

• Access: know what data of yours we process and get a copy of it.
• Rectification: correct anything inaccurate or incomplete.
• Erasure: have us delete it when it is no longer needed or you withdraw your consent.
• Restriction: have us stop using it, while keeping it, in the cases set out in the GDPR.
• Portability: receive the data you gave us in a structured, commonly used format, or have us send it to another controller.
• Objection: object to processing based on legitimate interest and, at any time, to receiving commercial messages.
• Withdraw your consent at any time, without affecting anything processed beforehand.
• Not be subject to automated decisions with legal effects or that affect you significantly.

How to exercise them. Write to info@digency.es saying which right you want to exercise and attaching a copy of your DNI (Spanish ID card) or an equivalent means that lets us check it is you; we will use it for nothing else. You can also send it by post to Via de Massagué, 26, 1º 2ª · 08202 Sabadell (Barcelona), España. We reply within one month, extendable by two further months if the request is complex, and if we cannot meet it we will tell you why.

Complaints. If you believe we have not handled your data or your request properly, you can lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency): www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid. We would rather you told us first, so we can try to sort it out.

8. AI assistant and automated decisions

The website assistant generates answers automatically with a language model from Anthropic. It works like this: what you write is sent, through our server, to the Anthropic API, which returns an answer based on the information on the website and on your question. Anthropic acts as a data processor and its commercial terms rule out using those conversations to train its models.

The assistant takes no decisions about you: it does not filter requests, it does not set prices and it does not decide whether we work with you. The range on the quote page is an indicative arithmetic calculation based on what you tick. Any proposal, price or decision is made and reviewed by a person on the team.

A practical tip: treat the chat as a conversation with a stranger. Do not write health data or other special categories of data, passwords, bank details or other people's data.

9. Children under 14

The website and its services are aimed at companies and professionals, not at children. We do not knowingly collect data from children under 14, who should not use the forms or the assistant. If you believe a child has sent us data, email us at info@digency.es and we will delete it.

10. Security

We apply technical and organisational measures suited to the type of data we process: an encrypted connection (HTTPS) across the whole website, password-protected access to the admin panel limited to the team, providers with contractual safeguards, backups, and access to the data restricted to whoever needs it to deal with you. No system is infallible: were there a breach affecting your data, we would notify the Agencia Española de Protección de Datos (Spanish Data Protection Agency) and, where appropriate, you, as the GDPR requires.

11. Changes to this policy

We may update this policy when the website, the providers or the applicable rules change. We will publish the version in force here, with its date, and if the change significantly affects how we handle your data we will let you know by a reasonable means.