Privacy Policy

This policy explains how Halconia processes the personal data of those who visit this website, write to us or engage our services in intelligent architecture, business automation, knowledge systems and artificial intelligence solutions. It has been drafted in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and with Spanish Organic Act 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

1. Data controller

• Company name: HALCONIA SOCIEDAD LIMITADA
• Tax ID: B88678073
• Address: Calle Juan Ochoa, 11, puerta izquierda, planta 0, 33401 Avilés, Asturias, España
• Registry details: Commercial Registry of Asturias, section 8, sheet AS 66364, entry 1, dated 6 May 2026
• Contact email: hola@halconia.es
• Website: halconia.es

For privacy enquiries and to exercise your data protection rights, contact hola@halconia.es.

2. Data we process

We process the following categories of personal data:

• Identification data: first name and surname and, where applicable, your job title and the company you represent.
• Contact data: email address and telephone number.
• Content of your enquiry: the information you choose to include in the form or in your messages, including the description of the project or the need you raise.
• Browsing data: IP address, device and browser type, pages visited and aggregated measurement data obtained through cookies, on the terms set out in our Cookie Policy.
• Contractual relationship data: billing data and communications exchanged during the performance of a project.

The data always originates from the data subject themselves or from the company they represent. We do not obtain data from third-party sources and we do not build commercial profiles. During the performance of a project, we only process the business data necessary to deliver the agreed service, applying the data minimisation principle.

We ask that you do not include in the forms or in your messages any special categories of data (article 9 of the GDPR), such as health data, political opinions or trade union membership, since they are not necessary in order to handle your request.

3. Purposes and lawful bases

Each processing operation relies on a lawful basis under article 6(1) of the GDPR, as detailed below:

Legitimate interest balancing test

Before relying on legitimate interest as a lawful basis, we carry out a balancing test between that interest and the rights and freedoms of the data subjects. In the cases indicated, the interest pursued is keeping the website secure and available and improving the quality of our services, for which we use professional contact data and aggregated usage information. The processing is not intrusive, it is foreseeable within a professional relationship, it does not involve profiling or automated decision-making, and in any event you may object to it by writing to hola@halconia.es. With these safeguards in place, we conclude that the interests or fundamental rights of the individuals concerned do not override it.

4. Retention periods

• Enquiries that do not lead to a contractual relationship: retained for a maximum period of 12 months from the last contact, after which they are erased.
• Contractual, accounting and tax data: retained for 6 years from the last entry, in accordance with article 30 of the Spanish Commercial Code, and for the tax limitation periods provided for in Spanish Act 58/2003, the General Tax Act, currently 4 years.
• Data processed during the performance of projects: retained for a maximum of 12 months after the project ends, subject to any earlier return or deletion instructions agreed with the client. Records that must be retained to meet legal obligations or address liabilities are kept separately for the applicable periods.
• Browsing data and cookies: for the lifetime of each cookie as set out in the table included in the Cookie Policy.

Once these periods have elapsed, the data are blocked and remain available solely to judges, courts, the Public Prosecutor's Office and the competent public authorities for the limitation period applicable to any actions, after which they are securely erased.

5. Recipients and data processors

We do not disclose personal data to third parties, except where legally required. We do rely on service providers who access data on Halconia's behalf as data processors. With all of them we enter into the processing agreements required by article 28 of the GDPR, which oblige them to process the data solely in accordance with our instructions, to maintain confidentiality and to apply appropriate security measures.

• Web hosting: Netlify.
• Netlify: management of contact form submissions.
• Google Analytics: statistical measurement of website use, only if you give your consent to analytics cookies.
• CookieScript: management and recording of cookie consent.
• Artificial intelligence providers: providers of AI models and services selected according to each client’s requirements, without an exclusive commitment to a particular provider. The specific providers, their role and the applicable processing conditions are documented for each project before client data are shared. Selection takes account of functionality, security, confidentiality, data location and retention, and the terms governing any use of content for model training. Only the data necessary for the agreed service are shared; website contact enquiries are not automatically sent to AI providers.
• Accounting and tax advisers and banking institutions: where necessary in order to comply with legal obligations and manage payments.

6. International transfers

Some of the providers indicated are established outside the European Economic Area or may access the data from third countries. In such cases the transfer relies on the safeguard mechanisms provided for in Chapter V of the GDPR, principally:

• Adequacy decisions of the European Commission, including the EU-U.S. Data Privacy Framework for US providers certified under that framework (art. 45 of the GDPR).
• Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented where appropriate with additional security measures following the corresponding transfer impact assessment (art. 46 of the GDPR).

You may request information about the safeguards applied to a specific transfer, as well as a copy of them, by writing to hola@halconia.es.

7. Security and confidentiality

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with article 32 of the GDPR: access control based on the principle of least privilege, encryption of communications through HTTPS, strong authentication in our working tools, backups, activity logging and periodic review of the permissions granted to providers.

In projects involving artificial intelligence we minimise the data sent to providers, we avoid transmitting personal data where the purpose can be achieved with anonymised or synthetic information, we configure the services to prevent unauthorised uses of the content and we agree the processing conditions in writing with each provider. All staff and collaborators are bound by a duty of confidentiality, which survives the termination of the relationship.

In the event of a personal data breach entailing a risk to the rights and freedoms of individuals, we will notify the supervisory authority within 72 hours and, where the risk is high, also the individuals affected, in accordance with articles 33 and 34 of the GDPR.

8. Rights of data subjects

You may exercise the following rights at any time:

• Access: to know what data of yours we process and for what purpose.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request deletion of the data when they are no longer necessary.
• Objection: to object to processing based on legitimate interest on grounds relating to your particular situation.
• Restriction of processing: to request that we suspend processing while a claim is verified.
• Portability: to receive your data in a structured, commonly used and machine-readable format, or to have them transmitted to another controller.

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

To exercise these rights, simply send a request to hola@halconia.es, indicating the right you wish to exercise. We will only request additional identification information if we have reasonable doubts about your identity; an ID copy is not routinely required. We will respond within one month of receiving the request, extendable by a further two months if the request is particularly complex, in which case we will inform you of the extension and the reasons for it. Exercising these rights is free of charge.

If you consider that the processing of your data does not comply with the applicable rules, or that we have not properly handled the exercise of your rights, you have the right to lodge a complaint with the competent supervisory authority, which in Spain is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), with its offices at calle Jorge Juan 6, 28001 Madrid, and its electronic headquarters at www.aepd.es. You may also contact us first or, where applicable, the data protection officer.

9. Changes to this policy

We may update this policy to adapt it to legislative changes, to new tools or to changes in the way we provide our services. The version in force is always the one published on this page, indicating the date it was last updated. Where the changes are substantial and affect processing based on your consent, we will inform you and, if necessary, request it again.