Privacy policy

This page is the second layer of the data protection information: the summary sits next to the form's button, and the detail is here. Two things happen here and nothing else: the contact form and, only if you accept it, the measurement of visits with Google Analytics.

Art. 11.1 of the LOPDGDD, which allows the basic information to be given when the data is collected, pointing to an electronic address that gives simple and immediate access to the rest. Art. 12.1 GDPR: concise, transparent, intelligible and easily accessible.

1. Who is responsible for your data

Email

info@demarchy.ai

No data protection officer has been appointed.

Art. 13.1 a) and b) GDPR. Art. 11.2 a) of the LOPDGDD.

2. What data we process

From the form, only what you type:

• a name, whichever you care to give us;
• an email address and a phone number, so we can reply;
• the text in which you tell us about your process.

If you are about to type someone else's data into that text, please don't: a first conversation does not need it.

From analytics, and only if you have accepted the cookies: which pages you see, for how long, from what kind of device, in which language, from which country and which site you arrived from. Google also collects your IP address to work out that approximate location, and does not show it to us. We see aggregate numbers, not people.

If you do not accept, none of that is collected, because Google's code is never even loaded.

Art. 13 GDPR, which governs data obtained from the data subject. The individual cookies and their lifetimes are in the cookie policy.

3. What we use it for

The form: to read your request, answer you through whichever means you gave us and, if it makes sense, arrange a call. You are not added to any mailing list, and we send no commercial messages you did not ask for.

Analytics: to find out whether this website is any use. How many people come in, which pages they read and which nobody reads. We did not know that until now, and a page cannot be improved without knowing it.

Art. 13.1 c) GDPR. Art. 11.2 b) of the LOPDGDD.

4. On what legal basis

The form: steps taken at your request before entering into a contract. You write to find out whether we can help and what it would cost, and that is what precedes a possible contract. This is article 6.1 b) GDPR, which makes processing lawful where it is "necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract".

Analytics: your consent, article 6.1 a) GDPR, the one you give or refuse in the cookie notice. You may withdraw it whenever you like, and withdrawing it does not affect what was processed while it stood.

The three fields of the form are needed in order to answer you: without them we cannot. Analytics is needed for nothing of yours: if you refuse it, the site works exactly the same and you lose no feature.

Art. 6.1 a) and b) GDPR. Art. 13.1 c), 13.2 c) and 13.2 e) GDPR: the existence of the right to withdraw consent, and whether you are obliged to provide the data.

5. How long we keep it

Your message lives in our mailbox and nowhere else: this website stores nothing you send. We keep it for one year from the last message between us, and then delete it. If a client relationship comes out of it, it is kept while that lasts and afterwards for the periods tax and commercial law require.

The analytics data is kept by Google, not by us. The cookies behind it expire after two years, and your browser cuts that down further: Chrome to 400 days, Safari to 7 if you do not come back.

Art. 13.2 a) GDPR: the storage period, or the criteria used to determine it.

6. Who else sees it

We neither sell nor give your data to anyone. Two of our suppliers handle it:

• Google, by two separate routes: the form becomes an email that arrives in our Google Workspace mailbox and stays there; and, if you accepted the cookies, Google Analytics collects and processes the visits.
• Cloudflare, because it serves this website and the form submission passes through its servers.

Both act as processors: they process the data on our behalf and on our instructions, under the written contract the GDPR requires.

Google LLC and Cloudflare, Inc. are United States companies and part of the processing happens there.

Art. 13.1 e) GDPR (recipients) and 13.1 f) (transfer to a third country and safeguards). Art. 28.3 and 28.9 GDPR: the processor is bound by a contract, which shall be in writing.

7. What you can require of us

You may ask us for access to your data, its rectification or erasure, the restriction of processing, the portability of the data, and you may object to the processing. And you may withdraw your consent to analytics whenever you like, from the cookie policy.

Write to info@demarchy.ai. It costs nothing and we answer within one month of receiving it. If we do not attend to you, or you dislike how we do it, you can complain to the Spanish Data Protection Agency: www.aepd.es.

Art. 13.2 b) GDPR (the rights), 13.2 c) (withdrawing consent) and 13.2 d) (complaint to a supervisory authority). Art. 12.3 GDPR (one month) and 12.5 (free of charge). Art. 11.2 c) of the LOPDGDD.

8. Automated decisions

There are none. A person reads your message and a person answers it. Nothing you tell us is used to score you, and of the analytics we see only totals: we build no profile of you and do not recognise you from one visit to the next.

Art. 13.2 f) GDPR.

9. Cookies

Which cookies there are, which need your permission, how long they last and how to change your answer, in the cookie policy.

Art. 22.2 of the LSSI.