privacy policy
This policy explains what personal data we collect through procom.dev, what we do with it and what rights you have. It follows the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) and Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).
Who we are
The data controller and owner of this website is:
- Company: Pro Commons Developers S.L.
- Tax ID (CIF): B55412076
- Address: Gran Via de les Corts Catalanes, 590, Barcelona, Spain
- Email: see our contact form
You can write to that email address about anything related to your data.
What we collect and why
When you use the contact form
We receive your name, your email address and your message. To stop spam, our server also records your IP address and the time you sent the form.
- Purpose: to read your message and reply to it. If you're asking about our services, also to prepare a proposal or quote at your request.
- Legal basis: your consent, which you give by ticking the box before sending (Art. 6(1)(a) GDPR). If your message is about hiring us, the steps you ask us to take before a contract (Art. 6(1)(b)). The IP address and timestamp are processed under our legitimate interest in keeping the form free of spam and abuse (Art. 6(1)(f)).
- Is it required? Name, email and message are needed to reply. Without them we can't answer you.
When you write to us by email
We receive your email address and whatever you include in the message, and use them only to reply and keep track of the conversation. Legal basis: our legitimate interest in answering messages sent to us (Art. 6(1)(f)), or pre-contractual steps if you're asking about our services (Art. 6(1)(b)).
When you browse the site
Our server keeps standard access logs (IP address, date and time, page requested, browser) to run the site and protect it against attacks. Legal basis: legitimate interest in keeping the site secure (Art. 6(1)(f)).
We also use Cloudflare Web Analytics to count visits. It does not use cookies, does not store anything on your device and does not identify individual visitors. Legal basis: legitimate interest in knowing, in aggregate, how much the site is used (Art. 6(1)(f)).
Only if you accept analytics cookies in the banner, we use Google Analytics 4 and Microsoft Clarity to see which pages are visited, roughly where visitors come from, what device and browser they use and how they move through the site. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE). Nothing from these tools loads until you accept. Details are in our cookie policy.
We do not make automated decisions about you or build profiles that have legal or similar effects on you. We don't sell your data or use it for advertising.
Who else gets the data
We don't pass your data to third parties unless the law requires it (for example, a court order). Some providers process it on our behalf, under a data processing agreement as required by Art. 28 GDPR:
- The company that hosts our server and email, which stores the site, the logs and the messages you send us.
- Cloudflare, Inc. for cookieless visit statistics.
- Google Ireland Limited for Google Analytics 4, only if you accept analytics cookies.
- Microsoft Ireland Operations Limited for Microsoft Clarity, only if you accept analytics cookies.
Transfers outside the EU
Google, Microsoft and Cloudflare may process data in the United States. These companies are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection in its decision of 10 July 2023. Where that doesn't apply, transfers are covered by the European Commission's Standard Contractual Clauses (Art. 46 GDPR).
How long we keep it
- Contact form and email messages: while we deal with your enquiry and for up to 12 months after our last exchange, then we delete them. If you become a client, we keep what's needed for as long as commercial and tax law require (6 years for business records under Art. 30 of the Spanish Commercial Code, 4 years for tax purposes).
- IP addresses used for anti-spam: deleted automatically once they're more than an hour old.
- Server access logs: up to 14 days, then rotated out automatically.
- Google Analytics: 14 months at most. Microsoft Clarity: recordings up to 30 days, aggregated data up to 13 months.
- Your cookie choice: 180 days, after which we ask again.
After these periods, data may be kept blocked only where the law requires it to handle possible legal claims, and is then deleted.
Your rights
You can ask us at any time to:
- tell you what data we hold about you and give you a copy (access);
- correct data that is wrong or incomplete (rectification);
- delete your data (erasure);
- stop using your data for a time, for example while we check a complaint (restriction);
- send your data to you or to another organization in a common format (portability);
- stop processing based on our legitimate interest (objection).
Where we rely on your consent, you can withdraw it whenever you want. That doesn't affect what we did before you withdrew it. For cookies, use the "cookie settings" link at the bottom of any page.
Write to us by email (contact form) or to our postal address, saying which right you want to use. We may ask you to confirm your identity if we can't be sure the request comes from you. We'll answer within one month.
If you think we've handled your data badly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es). We'd appreciate the chance to fix it first, but you don't need to contact us before going to the AEPD.
Children
This site isn't aimed at children. Under Spanish law (Art. 7 LOPDGDD), people under 14 can't consent to data processing themselves, so please don't use the contact form if you're under 14. If we find out we've received data from someone under 14 without their parents' or guardians' consent, we'll delete it.
Your responsibility
When you send us data, you confirm it's true and that it's yours. If you send us someone else's details, you need to have their permission and to have told them about this policy.
Security
The whole site runs over HTTPS. Messages from the contact form go straight to our mailbox and are not stored in a database. Only the people who reply to enquiries can read them. The anti-spam checks run on our own server, so we don't send your data to CAPTCHA services.
Changes
If we change how we use personal data, we'll update this page and the date at the top. If the change is significant, we'll make it visible on the site.