Privacy policy

Data controller

Legal name

SotaBytes S.L.

Spanish tax ID (NIF)

B67875302

Registered address

Plaza Universitat 3, 08007 Barcelona, Spain

Privacy contact

[email protected]

Basic privacy information

Controller

SotaBytes S.L., Spanish tax ID B67875302.

Purpose

Respond to your enquiry and handle steps before a possible contract; prevent misuse of the form.

Legal basis

Pre-contractual steps requested by you and legitimate interests for other professional enquiries and form security.

Recipients

Hosting and email providers needed to handle the enquiry; authorities where legally required.

Rights

You may request access, rectification, erasure and other applicable rights by emailing [email protected].

The data we process

We collect your name, email address, company if provided and the message you enter. The server also receives your IP address and the technical information needed to handle the request and protect the form.

Name, email and message are required to process the enquiry. Company is optional. Without the necessary information we cannot process the form; you can contact us directly by email. Do not include sensitive personal data, passwords or confidential information about other people.

Purposes and legal bases

We use the information to answer enquiries about our services and, at your request, prepare for a possible contract. The proposed basis for these pre-contractual steps is Article 6(1)(b) GDPR.

For other professional enquiries and form security, the proposed basis is SotaBytes S.L.’s legitimate interest in maintaining the communication you requested and preventing abuse, under Article 6(1)(f) GDPR. This must respect your rights and interests.

The checkbox records that you have read this information; it does not authorise advertising. This form does not include subscriptions or automated marketing messages.

Retention

Enquiries will be retained for as long as needed to handle and follow up on them. Once closed, they will be deleted when there is no longer a justified need to retain them, except where records must be kept to meet legal obligations or address potential claims. If a contract is entered into, the necessary data will be handled in that context.

The form does not create a database of messages. When delivery is activated, content will pass through the hosting provider’s mail service and the Office 365 mailbox. Retention and deletion of email, backups and hosting logs must be coordinated with those services.

Verification codes are valid for five minutes. Attempt counters and duplicate controls use hashes and short validity periods. Expired technical entries are no longer used and are removed when requests are processed again; this does not mean provider logs or backups are immediately erased.

Providers, disclosures and international transfers

The planned setup uses Webempresa to host the website and handle outgoing mail, and Microsoft 365 to receive and manage enquiries at [email protected]. Cloudflare manages DNS; any access to website traffic will depend on whether its proxy is enabled and on the selected configuration.

Providers accessing personal data to supply these services must do so under the applicable data protection arrangements. Data may also be disclosed to authorities where legally required.

We do not assert that all processing takes place exclusively within the European Economic Area. Before publication, the contracted entities, locations, subprocessors and any international transfer mechanism and means of obtaining information about its safeguards must be confirmed. This remains subject to review against the actual service terms.

Your rights

You can email [email protected] or write to the controller’s registered address to request access, rectification, erasure, restriction, objection and, where applicable, data portability. State the right you wish to exercise and the information needed to locate your enquiry. If there are reasonable doubts about your identity, proportionate additional information may be requested.

Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. If any additional processing were based on consent, you could withdraw it without affecting the lawfulness of earlier processing.

If you believe your rights have not been properly addressed, you may complain to the Spanish Data Protection Agency (AEPD): www.aepd.es.

Sessions, captcha and artificial intelligence

The form uses a necessary session cookie named sotabytes_contact to associate verification codes and tokens with your browser. The captcha is generated on the hosting itself and does not send data to an external verification provider. The form includes no analytics or advertising cookies. The optional chat has its own storage mechanisms, described in the Cookie policy.

Although SotaBytes uses AI in its software development process, this contact form does not integrate AI tools or make automated decisions with legal effects on people who contact us. Security rules may reject requests; if this happens you can email [email protected].

Optional Tawk.to chat

The chat is separate from the form. Tawk.to loads only if you accept the optional chat category in the general cookie panel. You may decline and use the form or [email protected]. Your choice is stored in the browser for up to 180 days; you can change it in “Cookie settings”.

The chat interface and pre-chat form are offered in Spanish on both website language versions. Name and email are required before starting; company is optional. SotaBot identifies itself as an AI assistant. A person may join manually when available. There is no automatic human handover or timed automatic ticket creation. For human assistance, email [email protected]. AI availability depends on the service and the free plan credits; continuous assistance or a response deadline is not guaranteed.

Loading the service sends Tawk.to technical information such as your IP address, browser and visited page, and may use cookies and storage to maintain the connection and recognise visits. If you chat, your messages and supplied contact details are processed to handle your enquiry through AI, human assistance or email follow-up. We do not automatically copy website form fields into chat.

Optional loading and storage require your prior acceptance. The legal bases stated in this policy apply to handling your enquiry according to its purpose. Automated decisions with legal or similarly significant effects are not intended; AI provides guidance and allows you to request human assistance. Do not enter passwords, identity documents, sensitive personal data or confidential information about others.

You can disable chat in “Cookie settings”. If already loaded, the page reloads to stop it; save any form text first. Withdrawal does not delete conversations or previous storage: clear website and Tawk.to data in your browser and exercise your rights at [email protected]. Withdrawal does not affect prior lawful processing.

Tawk.to is the planned chat and AI provider. Before publication, review its processor terms, entities, subprocessors (including AI providers), locations and international transfer safeguards. Exclusive processing in the EEA is not assumed. References: https://www.tawk.to/privacy-policy/ and https://www.tawk.to/data-protection/dpa-data-processing-addendum/. Conversation, ticket and AI data retention must be defined and applied in the dashboard; verified automatic deletion is not asserted.

The website form still targets [email protected] and does not create Tawk.to tickets. The mailbox is not automatically forwarded to Tawk.to. Any future ticketing integration will be reflected here before activation.