Privacy policy

Data controller

The controller is Salah Eddine Khamlichi (NIF 60389541M), with address at Calle Nadal 4, 08500 Vic, Barcelona, Spain. Any privacy request can be sent to legal@serveisdigitals.com.

What data we collect

Only what you type into the contact form yourself. We do not collect browsing data for advertising purposes and we do not build profiles.

Separately, the infrastructure serving this website processes your IP address and technical connection data for operational, security and visit-measurement reasons, never for advertising.

• Name and company
• Phone or WhatsApp
• Email address
• Sector
• What you would like to solve

What we use it for, and on what legal basis

Solely to answer your enquiry, review your case and, where appropriate, prepare a proposal. It is not sold and not shared with third parties for commercial purposes.

The legal basis is your consent, given by ticking the required box on the form (Art. 6(1)(a) GDPR). You may withdraw it at any time.

The optional marketing box

The form includes a second box, separate from the first, which is unticked by default and entirely optional. You do not need to tick it to get a reply: if you leave it unticked, you will still receive an answer to your enquiry.

If you do tick it, we will use your email address to occasionally send you content and news from Serveis Digitals. Nothing else: it is not shared with third parties and not used for any other purpose. The legal basis is also your consent (Art. 6(1)(a) GDPR), separate from the consent you give for us to answer your enquiry.

You can withdraw this consent whenever you like, without giving reasons and without affecting the answer to your enquiry: email legal@serveisdigitals.com asking to stop receiving communications, or use the unsubscribe link included in every one of those messages. Withdrawal does not affect the lawfulness of messages sent beforehand.

Where the data ends up

This site has no database of its own. What you write in the form is not stored on any server of ours: it becomes an email sent immediately to a Serveis Digitals mailbox.

That does not mean no other copy exists: the provider that sends the email keeps one in its logs for a limited time. The details are in the retention section.

Providers processing data on our behalf

Three providers act as processors, meaning they handle the data only on our instructions. In all three cases the data processing agreement forms part of their terms of service automatically, with no separately signed agreement required:

• Cloudflare (Cloudflare, Inc., United States) — hosts this site, and every visit passes through its network, including the form submission before it reaches Resend. It processes IP addresses and technical connection data to serve and protect the site, never for advertising. It also provides Cloudflare Web Analytics, the tool we use to count visits, which uses no cookies and identifies no one. Most of that traffic stays on the network servers closest to the visitor; metadata about that activity is processed in its data centres in the United States and Europe.
• Resend (Plus Five Five, Inc., San Francisco, United States) — sends the email generated by the form. Sending is routed from its European region (eu-west-1), but that region determines where the message is sent from, not where the data is stored: Resend stores the data in the United States.
• Proton AG (Switzerland) — hosts our email: the mailbox the form’s email arrives in and is kept in. Proton does not sign separate data processing agreements, for reasons of scale and operations; its agreement, published at https://proton.me/legal/dpa, is incorporated by reference into its terms of use in any relationship where the user acts as controller and Proton as processor within the meaning of the GDPR.

The mailbox where the email is received

The email generated by the form arrives in a mailbox hosted by Proton Mail (Proton AG, Switzerland) and is kept there for the periods set out below. The service is governed by Proton AG’s terms of service and privacy policy.

International transfers

Of the three processors, two are United States companies, so data is transferred to the United States: Cloudflare, whose network the visit and the submission pass through, and Resend, which stores the email information.

Those two transfers, and only those, are covered by the same two safeguards: the Standard Contractual Clauses approved by the European Commission, incorporated into each provider’s data processing agreement — in Resend’s case, module 2, controller to processor, governed by Irish law — and both companies’ certification under the EU-U.S. Data Privacy Framework.

The third processor, Proton AG, is in Switzerland, a country covered by a European Commission adequacy decision. The Standard Contractual Clauses therefore do not apply to Proton, and no other additional safeguard is needed: the adequacy decision covers the transfer on its own.

How long we keep it

The email containing your enquiry is kept in our mailbox while it is being handled and, if no commercial relationship begins, for up to 12 months from the last contact. After that it is deleted.

If a commercial relationship does begin, data related to the contract is kept for the applicable statutory retention periods.

If you ticked the marketing box, your email address is kept for that purpose until you withdraw your consent and, in any case, is deleted if there is no interaction for three years.

Separately, Resend keeps a copy of the sent email and its logs for 30 days under its own retention policy, and its backups persist for a further 7 days.

If you prefer email or WhatsApp

The contact page also offers our email address and a WhatsApp link. If you use either, we will process whatever data you choose to provide — name, company, contact details and the content of your message — for the same purpose and for the same period as the form data.

WhatsApp is an external platform: opening that conversation takes you off this site, and the exchange is also governed by the terms and privacy policy of its operator, which we do not control.

The conversation itself is processed by the WhatsApp service, under its own terms and privacy policy, and is stored on its systems. We are responsible only for the data we receive through that channel and how we use it, not for the processing WhatsApp carries out on its own account. If you would rather that conversation did not exist on a third-party platform, use the form or email instead.

AI phone support, voice and transcripts

With AI phone support, callers are informed at the start that they are interacting with an AI system. If a call is recorded or transcribed, they will also be informed about the controller, purpose, legal basis, retention and how to exercise their rights.

Attenda: data processed by the application

Attenda is the Serveis Digitals platform for phone support and the management of requests and appointments. Unlike this website, Attenda does store data, and it does so on behalf of the client company, which is the data controller. Serveis Digitals acts as processor.

The data it processes is what the client company enters into it or what the call collects: contact details of the people who call, the request they make and the appointments the company’s team decides to arrange. The infrastructure is Cloudflare.

Connecting the client company’s calendar

Attenda lets the client company connect its own Google calendar, voluntarily and revocably at any time.

When a Google calendar is connected, Attenda requests a single permission (https://www.googleapis.com/auth/calendar.events) and uses it exclusively for two things: showing existing events inside the Attenda agenda so the team can see its real availability, and creating an event when a member of the team confirms an appointment. The event created contains only the service and the time; no personal data about the person being served is included.

Attenda reads no other information from the Google account, does not share it with third parties, does not use it for advertising or to train artificial intelligence models, and does not sell it. Access credentials are stored encrypted and are never displayed anywhere. When the calendar is disconnected, access is revoked and the credentials are deleted.

Attenda’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect calendar data

Calendar access credentials are stored encrypted and never displayed anywhere: no screen, no route and no response returns them, and they are deleted when disconnecting. Calendar data is only accessed by the client company from its own Panel. From Google Calendar, Attenda only uses the title and time of events in the primary calendar, to show them in the Panel’s agenda without storing them, and it creates an event with the service name and time for each appointment the team schedules; it does not modify or delete any event, does not sell this data or use it for advertising or to train models, and when the calendar is disconnected it revokes access and stops accessing it.

Attenda does NOT send any data received from Google APIs to any artificial intelligence model, whether its own or that of third parties. The voice assistant never consults the calendar, and events do not pass through any model before or after being created. Google data is not used to train, create or improve any machine learning model, nor is it transferred for that purpose.

Attenda’s use of information received from Google APIs, including Workspace user data, will adhere to the Google User Data Policy, including the Limited Use requirements.

Your rights

You may request access to your data, its rectification, its erasure, restriction of processing, portability and objection to processing. You may also withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, email legal@serveisdigitals.com stating which right you wish to exercise. No special form is required.

If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Changes to this policy

If the way data is processed changes — for example if an analytics tool is enabled or a new provider is added — this policy will be updated before the change goes live.