Back to Home

Privacy Policy

This Privacy Policy complies with the EU General Data Protection Regulation (GDPR — Regulation EU 2016/679), Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights Guarantee (LOPDGDD), and applicable European data protection legislation.

1. Data Controller

Workfactory Tech S.L.

Tax ID (CIF): B23950843

Registered Address: Calle Olof Palme, 28, 35010 Las Palmas de Gran Canaria, Spain

Commercial Registry: Las Palmas de Gran Canaria, Section 8, Sheet GC65392, Entry 1

Email: [email protected]

Website: https://workfactory.es

2. Personal Data We Collect

We collect personal data in the following circumstances:

a) Contact form

When a user submits the contact form on this website, the following data is collected:

  • Full name
  • Email address and/or phone number
  • Company or hotel name (optional)
  • Message content
  • IP address and browser user agent (collected automatically for security purposes)
  • Campaign attribution parameters (UTM), if present in the access URL

b) Demo request

When a user schedules a demo through our integrated booking system (Cal.com), the data provided in the booking form (name, email, and any additional information supplied) is collected.

c) Electronic communications

Personal data provided to us by email or other means of communication will be processed for the purpose of responding to the enquiry or request received.

d) Website browsing

We use Vercel Analytics, a web analytics tool that collects only aggregated and anonymised data about website usage. No individual users are identified and no tracking cookies are set.

3. Purpose of Processing

Personal data is processed for the following purposes:

  • Responding to enquiries and requests received through the contact form or by email.
  • Managing demo requests for our product.
  • Fraud prevention and security: verification via Cloudflare Turnstile to protect the form from non-human submissions.
  • Aggregated analysis: anonymously understanding how the website is used to improve its performance.
  • Campaign attribution: understanding which marketing channels generate interest (via UTM parameters temporarily stored in the browser's sessionStorage).

4. Legal Basis for Processing

  • Consent of the data subject (Article 6(1)(a) GDPR): by submitting the contact form or scheduling a demo, the user expressly consents to the processing of their data for the stated purpose.
  • Legitimate interest (Article 6(1)(f) GDPR): for aggregated web analytics, campaign attribution, website security (Cloudflare Turnstile), and responding to unsolicited electronic communications.

5. Data Retention

  • Contact form data: retained for a maximum of 24 months from the last communication, unless there is an ongoing commercial relationship or a legal obligation to retain the data.
  • Web analytics data: Vercel Analytics does not store personal data. Aggregated data is retained according to Vercel's policy.
  • UTM parameters: stored in the browser's sessionStorage and automatically deleted when the browser tab or window is closed.
  • Security data (Turnstile): processed in real time by Cloudflare and not stored by Workfactory Tech S.L.

6. Recipients and Data Processors

Personal data is not transferred to third parties for commercial or marketing purposes. Data may be shared with the following processors, solely for the purposes described:

  • Railway (hosting and database): contact form data is stored on servers located in Amsterdam, the Netherlands (European Union). No transfers outside the EEA are made by this processor.
  • Pipedrive (CRM): commercial contact management. Pipedrive operates servers in the EU (Germany) and the US. International transfers are covered by EU Standard Contractual Clauses (Article 46(2)(c) GDPR).
  • Resend (transactional email): internal notification delivery. US-based servers, covered by Standard Contractual Clauses.
  • Cloudflare (security — Turnstile): anti-fraud verification of the contact form. Processes the user's IP address. Globally distributed servers, covered by Standard Contractual Clauses.
  • Vercel (web hosting and analytics): serves the static pages of the website and provides anonymised analytics. US and global servers, covered by Standard Contractual Clauses.
  • Cal.com (scheduling): demo booking management. Data entered by the user in the booking form is processed by Cal.com in accordance with its own privacy policy.

7. International Data Transfers

Some of the processors listed above may process data outside the European Economic Area (EEA), primarily in the United States. These transfers are carried out under:

  • EU Standard Contractual Clauses approved by the European Commission (Article 46(2)(c) GDPR), and/or
  • Adequacy decisions by the European Commission, where applicable (Article 45 GDPR).

Contact form data is primarily stored on Railway servers located in Amsterdam (EU), within the European Economic Area.

8. Your Data Protection Rights (GDPR)

Under the EU General Data Protection Regulation (GDPR) and Spanish LOPDGDD, you have the following rights:

  • Right of access (Article 15 GDPR) — know what data we hold about you.
  • Right to rectification (Article 16 GDPR) — correct inaccurate data.
  • Right to erasure (Article 17 GDPR) — request deletion of your data.
  • Right to restriction of processing (Article 18 GDPR).
  • Right to data portability (Article 20 GDPR).
  • Right to object (Article 21 GDPR).
  • Right to withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, please email us at: [email protected], stating your identity and the right you wish to exercise. We will respond within one month of receiving the request.

You also have the right to lodge a complaint with a supervisory authority, particularly in the EU Member State where you reside, work, or where an alleged infringement occurred. In Spain, the competent authority is the Agencia Española de Protección de Datos (AEPD): www.aepd.es

9. Data Security

Workfactory Tech S.L. implements appropriate technical and organisational measures to ensure the security and confidentiality of information, in accordance with GDPR requirements and current regulations. This includes:

  • Encryption of data in transit (HTTPS/TLS)
  • Data storage on servers within the EU (Railway, Amsterdam)
  • Access controls and authentication
  • Anti-fraud verification on forms (Cloudflare Turnstile)
  • Rate limiting to prevent abuse

10. Cookies and Similar Technologies

This website does not use tracking cookies or advertising cookies. No cookie consent is required under GDPR or the ePrivacy Directive.

The technologies used are:

  • Vercel Analytics: fully anonymised web analytics. No cookies are set and no unique identifiers are used. Individual users cannot be identified.
  • Cloudflare Turnstile: may set a strictly necessary technical cookie (cf_turnstile) when the user interacts with the contact form, solely for the purpose of verifying that the user is legitimate. This cookie is considered exempt from consent as it is strictly necessary for the security of the requested service.
  • sessionStorage (attribution): campaign parameters (UTM) are temporarily stored in the browser's session storage. This data is not personal, does not persist between sessions, and is deleted when the tab is closed.

11. Applicable Law and Jurisdiction

This Privacy Policy is governed by Spanish law, the EU General Data Protection Regulation (GDPR) and the LOPDGDD. Any disputes shall be subject to the Courts of Las Palmas de Gran Canaria, Spain, unless mandatory consumer protection laws require otherwise.

12. Changes to This Privacy Policy

Workfactory Tech S.L. may update this Privacy Policy to adapt it to legislative changes or changes in its activities. We will notify users of any changes by posting the updated policy on this page with a new "Last Updated" date.

Last Updated: June 2026
Data Controller: Workfactory Tech S.L., Las Palmas de Gran Canaria, Spain

Back to Home