Privacy policy
Data controller
CAPTIA INGENIERÍA, S.L.U. (CAPTIA Tech) · Tax ID (CIF) B88043088 · Avenida de las Nieves, 37, Bloque A, Planta 1, Oficina E, 28935 Móstoles (Madrid, Spain) · hola@captiatech.com. CAPTIA has not appointed a Data Protection Officer, as this is not legally required; for any data protection query, please write to the address above.
How we collect your data
We collect your data when you voluntarily fill in the contact form on the home page: the fields you complete (such as name, email, company and the details of your inquiry) are submitted through Deftform, the form tool we use, and reach CAPTIA. There are no hidden fields, and we collect nothing beyond what you type.
You can also contact us directly by email or WhatsApp; in that case the data does not go through the form — we receive it directly through whichever channel you choose.
The floating “Free assessment” button lets you open our Automation Radar without leaving this site: an in-house tool hosted at radar.captiatech.com. It collects two things, and only if you decide to use it: what you type in the conversation with MireIA, our assistant — how you work, which processes weigh you down and any approximate figures you care to give — and, at the end, your contact details (name and email, plus phone, company and role if you wish) should you ask us to send you the report. It collects nothing until you open it, and you can go through the whole conversation and close it without leaving us any data: capture happens only if you fill in the final form and tick the consent box, which is never pre-ticked.
The last question of the interview is free text. We do not need you to write anyone else's personal data or any sensitive information there, and we ask you not to: what we are after is processes and figures, not people. We review that field and strip out whatever the assessment does not need.
If, at the end of the report, you book the 30-minute session, we use your name and email to create the appointment in our calendar and generate the video-call link.
In addition, if you accept analytics cookies, we automatically collect browsing data (pages viewed, visit duration, device and browser type, approximate country and traffic source) through Google Analytics 4. No measurement is activated until you give your consent: the site starts with consent denied by default. You can withdraw it at any time from the cookie panel. See our Cookie policy for more detail.
Purpose and legal basis
Data you provide through the contact form, by email or by WhatsApp is used solely to handle your inquiry, to arrange the free consultation if you request one and, where applicable, to start a business relationship. We do not use it to send you unsolicited marketing, nor do we share it with third parties for advertising purposes. The legal basis is your consent and, where applicable, the performance of pre-contractual measures (art. 6.1.a and 6.1.b GDPR).
Analytics data is used exclusively to measure use of the site in aggregate form and improve it. Its legal basis is your consent (art. 6.1.a GDPR), given through the cookie panel.
Data from the Automation Radar is used to generate and send you your report and to get in touch with you about that assessment. Nothing else: it feeds no advertising and is shared with no third party. The legal basis is your consent (art. 6.1.a GDPR), given by ticking the box on the final form and withdrawable at any time by writing to hola@captiatech.com. The report is written automatically by an artificial intelligence model from what you have told it: it is an indicative estimate expressed in ranges, it produces no legal effect on you, and it is no substitute for an analysis carried out with your real figures at hand.
If you book the 30-minute session, we process your name and email to arrange and hold that meeting. There the legal basis is additionally the performance of pre-contractual measures taken at your request (art. 6.1.b GDPR).
Retention period
We keep your data for as long as the relationship lasts or until you request its deletion, and afterwards for the periods required by law to address possible liabilities.
Data captured by the Automation Radar is kept in a table of its own, separate from our CRM, and stays there until it is imported into the CRM; from that point the CRM's retention period governs it. Whether or not it ever gets imported, it is deleted from the radar 24 months after capture by an automated daily job. And in any case we delete it sooner if you ask us to or withdraw your consent.
Appointments for the 30-minute assessment stay in CAPTIA's corporate calendar and are deleted 12 months after the meeting.
Recipients and processors
We do not share your data with third parties except where legally required. This website's hosting provider acts as a data processor under Article 28 GDPR.
The contact form is provided by Deftform, a service operated by ivy.mayhem GmbH (Hohe Bleichen 22, 20354 Hamburg, Germany), which acts as a data processor on CAPTIA's behalf under the data processing agreement (DPA) that forms part of its terms of service, and stores submissions on servers located in Germany. See also their privacy policy.
For ancillary functions — hosting, email delivery, content delivery network, spam protection and error monitoring — that provider in turn relies on sub-processors, listed in the annex to its DPA. Some of them are established outside the European Union; see the international transfers section.
If you accept analytics cookies, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) processes browsing data as a processor on CAPTIA's behalf, through Google Analytics 4.
The Automation Radar relies on five providers acting as processors on behalf of CAPTIA, each under its own processing agreement (art. 28 GDPR):
- Vercel Inc. (United States): hosts the application and runs its server functions, so all data passes through it in transit. Processing agreement · sub-processors.
- Anthropic Ireland Limited (Ireland): its language model drives the conversation and writes the report, so it receives what you type in the chat. In the European Union the service is provided by this Irish entity, and its processing chain reaches Anthropic PBC in the United States. It does not use that content to train its models, per its own commercial terms. Processing agreement · sub-processors.
- Supabase Pte. Ltd (65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513): the database where the lead is stored. This project's instance is hosted in the Frankfurt region (Germany) and access is restricted to our server. Processing agreement · sub-processors.
- Plus Five Five, Inc., which operates Resend (United States): sends us the internal notification for each new lead. Processing agreement · sub-processors.
- Microsoft, through CAPTIA's Microsoft 365: creates the assessment appointment and the video-call link, for which it receives your name and email. Processing agreement.
International transfers
The content of form submissions is stored on servers located in Germany. However, the form provider relies on sub-processors for ancillary functions (email delivery, content delivery network, spam protection and error monitoring), and some of them are US companies, so occasional access from outside the European Economic Area cannot be ruled out. Those transfers are covered by the provider's data processing agreement and by the safeguards provided under the GDPR.
Only if you consent to analytics, the use of Google Analytics 4 (contracted with Google Ireland Limited, which may process data on Google LLC servers in the United States) may involve transferring your data outside the European Economic Area. Such transfers are covered by the safeguards provided under the GDPR: standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework.
Using the Automation Radar involves transfers outside the European Economic Area. The Chapter V safeguard is not the same for all of them, so it is worth stating case by case:
- Anthropic: we contract with the Irish entity, but its processing chain reaches Anthropic PBC in the United States. Those transfers rely on standard contractual clauses (modules two and three), per its processing agreement.
- Supabase Pte. Ltd is established in Singapore, a country with no European Commission adequacy decision, and the transfer relies on standard contractual clauses. The data itself sits in the European Union (Frankfurt).
- Vercel Inc. and Plus Five Five, Inc. (Resend) are US companies. Their transfers rely on standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework.
- Appointments are handled in CAPTIA's Microsoft 365, under the safeguards of Microsoft's processing agreement.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to hola@captiatech.com. You also have the right to file a complaint with the Spanish Data Protection Agency (aepd.es). This includes any data you have sent us through the contact form: you can come to us directly, without having to contact the form provider.
Minors
This website is not directed at minors under 14. CAPTIA does not knowingly collect data from minors of that age.
Changes to this policy
We may amend this policy to reflect legislative changes or changes to the website itself; the current version will always be published here. See also our Cookie policy for more detail on the cookies used.
This policy follows the same criteria as that of CAPTIA Ingeniería (captia.es), adapted to the services actually provided on this website.
