Back to Home

Privacy Policy

This Privacy Policy complies with the EU General Data Protection Regulation (GDPR — Regulation EU 2016/679), Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights Guarantee (LOPDGDD), and applicable European data protection legislation.

1. Data Controller

Workfactory Tech S.L.

Tax ID (CIF): B23950843

Registered Address: Calle Olof Palme, 28, 35010 Las Palmas de Gran Canaria, Spain

Commercial Registry: Las Palmas de Gran Canaria, Section 8, Sheet GC65392, Entry 1

Email: [email protected]

Website: https://workfactory.es

2. Personal Data We Collect

We collect personal data in the following circumstances:

a) Contact form

When a user submits the contact form on this website, the following data is collected:

  • Full name
  • Email address and/or phone number
  • Company or hotel name (optional)
  • Message content
  • IP address and browser user agent (collected automatically for security purposes)
  • Campaign attribution parameters (UTM), if present in the access URL

b) Demo request

When a user schedules a demo through our integrated booking system system, the data provided in the booking form (name, email, and any additional information supplied) is collected.

c) Job applications

When a person submits an application, we collect the information provided in the form, such as name, email, phone number, professional profile, GitHub username, process answers and CV, together with the job they applied for.

d) Electronic communications

Personal data provided to us by email or other means of communication will be processed for the purpose of responding to the enquiry or request received.

e) Website browsing

We use Vercel Analytics and PostHog to understand aggregated website usage and improve conversion. PostHog is configured without autocapture or session recording; it does not receive names, emails or form content, and it does not set cookies.

3. Purpose of Processing

Personal data is processed for the following purposes:

  • Responding to enquiries and requests received through the contact form or by email.
  • Managing demo requests for our product.
  • Managing job applications and recruitment processes.
  • Fraud prevention and security: verification via Cloudflare Turnstile to protect the form from non-human submissions.
  • Aggregated analysis: anonymously understanding how the website is used to improve its performance.
  • Campaign attribution: understanding which marketing channels generate interest (via UTM parameters temporarily stored in the browser's sessionStorage).

4. Legal Basis for Processing

  • Performance of pre-contractual steps (Article 6(1)(b) GDPR): to answer a contact request, manage a requested demo, or process a job application.
  • Consent of the data subject (Article 6(1)(a) GDPR): only when it is expressly requested for an additional purpose, such as commercial communications, through a separate voluntary option.
  • Legitimate interest (Article 6(1)(f) GDPR): for aggregated web analytics, campaign attribution, website security (Cloudflare Turnstile), and responding to unsolicited electronic communications.

5. Data Retention

  • Contact form data: retained for a maximum of 24 months from the last communication, unless there is an ongoing commercial relationship or a legal obligation to retain the data.
  • Application data: retained during the recruitment process and, unless required by law or separately authorised for longer retention, deleted when it is no longer necessary for the application.
  • Web analytics data: Vercel Analytics and PostHog receive only explicit, aggregated navigation and conversion events. Data is retained according to each provider's policy.
  • UTM parameters: stored in the browser's sessionStorage and automatically deleted when the browser tab or window is closed.
  • Security data (Turnstile): processed in real time by Cloudflare and not stored by Workfactory Tech S.L.

6. Recipients and Data Processors

Personal data is not transferred to third parties for commercial or marketing purposes. Data may be shared with the following processors, solely for the purposes described:

  • Railway (hosting and database): contact form data is stored on servers located in Amsterdam, the Netherlands (European Union). No transfers outside the EEA are made by this processor.
  • Workfactory Internal (internal management): secure storage of contact and demo requests inside our private network.
  • Resend (transactional email): internal notification delivery. US-based servers, covered by Standard Contractual Clauses.
  • Cloudflare (security — Turnstile): anti-fraud verification of the contact form. Processes the user's IP address. Globally distributed servers, covered by Standard Contractual Clauses.
  • Vercel (web hosting and analytics): serves the static pages of the website and provides anonymised analytics. US and global servers, covered by Standard Contractual Clauses.
  • PostHog (conversion analytics): receives explicit, aggregated navigation and conversion events. We use PostHog Cloud EU; it does not receive names, emails or form content.
  • Cloudflare (secure scheduling): availability publishing and demo booking through a protected service.

7. International Data Transfers

Some of the processors listed above may process data outside the European Economic Area (EEA), primarily in the United States. These transfers are carried out under:

  • EU Standard Contractual Clauses approved by the European Commission (Article 46(2)(c) GDPR), and/or
  • Adequacy decisions by the European Commission, where applicable (Article 45 GDPR).

Contact form data is primarily stored on Railway servers located in Amsterdam (EU), within the European Economic Area.

8. Your Data Protection Rights (GDPR)

Under the EU General Data Protection Regulation (GDPR) and Spanish LOPDGDD, you have the following rights:

  • Right of access (Article 15 GDPR) — know what data we hold about you.
  • Right to rectification (Article 16 GDPR) — correct inaccurate data.
  • Right to erasure (Article 17 GDPR) — request deletion of your data.
  • Right to restriction of processing (Article 18 GDPR).
  • Right to data portability (Article 20 GDPR).
  • Right to object (Article 21 GDPR).
  • Right to withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, please email us at: [email protected], stating your identity and the right you wish to exercise. We will respond within one month of receiving the request.

You also have the right to lodge a complaint with a supervisory authority, particularly in the EU Member State where you reside, work, or where an alleged infringement occurred. In Spain, the competent authority is the Agencia Española de Protección de Datos (AEPD): www.aepd.es

9. Data Security

Workfactory Tech S.L. implements appropriate technical and organisational measures to ensure the security and confidentiality of information, in accordance with GDPR requirements and current regulations. This includes:

  • Encryption of data in transit (HTTPS/TLS)
  • Data storage on servers within the EU (Railway, Amsterdam)
  • Access controls and authentication
  • Anti-fraud verification on forms (Cloudflare Turnstile)
  • Rate limiting to prevent abuse

10. Cookies and Similar Technologies

This website does not use tracking cookies or advertising cookies. No cookie consent is required under GDPR or the ePrivacy Directive.

The technologies used are:

  • Vercel Analytics: fully anonymised web analytics. No cookies are set and no unique identifiers are used. Individual users cannot be identified.
  • PostHog: web and conversion analytics using explicit events, without autocapture, surveys or session recording. It uses cookieless mode without persistent storage and does not receive data entered into the forms.
  • Cloudflare Turnstile: may set a strictly necessary technical cookie (cf_turnstile) when the user interacts with the contact form, solely for the purpose of verifying that the user is legitimate. This cookie is considered exempt from consent as it is strictly necessary for the security of the requested service.
  • sessionStorage (attribution): campaign parameters (UTM and advertising click IDs) are temporarily stored in the browser's session storage to attribute contact and demo requests. They do not persist between sessions and are deleted when the tab is closed.

11. Applicable Law and Jurisdiction

This Privacy Policy is governed by Spanish law, the EU General Data Protection Regulation (GDPR) and the LOPDGDD. Any disputes shall be subject to the Courts of Las Palmas de Gran Canaria, Spain, unless mandatory consumer protection laws require otherwise.

12. Changes to This Privacy Policy

Workfactory Tech S.L. may update this Privacy Policy to adapt it to legislative changes or changes in its activities. We will notify users of any changes by posting the updated policy on this page with a new "Last Updated" date.

Last Updated: October 2026
Data Controller: Workfactory Tech S.L., Las Palmas de Gran Canaria, Spain

Back to Home