Legal

Privacy policy

Last updated: October 2026. This translation is provided for convenience; in case of discrepancy, the Spanish version prevails.

1. Data Controller

In accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPD-GDD), we inform you that the controller of your personal data is:

Company name: THRAX BIEITO INGENIERIA INFORMATICA SL (hereinafter “THRAX”)
Tax ID (CIF): B24784175
Registered address: Carrer Joan Vidal i Jumbert 10, 08403 Granollers (Barcelona)
Email: [email protected]
Phone: 644 836 122

THRAX does not have a Data Protection Officer (DPO), as it is not required to under Article 37 of the GDPR. For any query regarding the protection of your data, you can contact us at [email protected].

2. Data We Collect and Purpose

Through the contact form on this website, we collect the following personal data:

Data	Purpose	Required
Full name	To identify you and personalise our communication	Yes
Email address	To reply to your enquiry	Yes
Phone	To contact you if necessary	Yes
Message	To understand the reason for your enquiry and deal with it	Yes

Main purpose: to handle enquiries received through the contact form and respond to users' requests for information.

Contact channels: by sending us an enquiry, you authorise us to contact you in order to deal with it and follow it up, using any of the details you have given us and by any of these means: email, phone call, SMS and messaging apps such as WhatsApp. The same applies if you write to us directly on WhatsApp or call us.

These channels are used solely to respond to your enquiry and to any steps arising from it (quote, technician's visit, follow-up). We will not send you commercial communications unrelated to your enquiry without your prior, specific consent.

You can tell us at any time — in your message itself or by writing to [email protected]— that you would prefer us to contact you through one particular channel only, or that we stop contacting you.

We do not use this form data for profiling or advertising.

In addition, for internal statistical purposes, we record the following for each visit: full IP address, browser, operating system, device type, language, pages visited and buttons used, linked to our own identifier (cookie thrax_vid, see Cookie policy) which allows repeat visits from the same browser to be recognised. This information can only be accessed from THRAX's internal administration panel and is not shared with third parties.

3. Legal Basis for Processing

The legal basis for processing your data is:

Consent of the data subject (Art. 6.1.a GDPR): by ticking the acceptance box on the contact form and submitting it, you expressly consent to the processing of your data for the stated purpose, and to our contacting you by email, phone, SMS or WhatsApp to respond to and deal with your enquiry. A record of that acceptance (date, time and IP address) is kept so that it can be demonstrated in accordance with Art. 7.1 GDPR.
Taking steps prior to entering into a contract (Art. 6.1.b GDPR): where your enquiry consists of requesting a quote or information prior to contracting a service, the processing and subsequent contact are necessary to deal with that request.
Legitimate interest (Art. 6.1.f GDPR): protecting the forms against spam and automated use by means of Google reCAPTCHA, so that they are not used to send email to third parties from our domain or to fill our systems with false data.

You can withdraw your consent at any time by sending an email to [email protected], without affecting the lawfulness of processing carried out before its withdrawal.

4. Retention Period

Data collected through the contact form will be kept for a maximum period of 6 months from receipt of the enquiry, unless there is a legal obligation requiring it to be kept for longer.

Once that period has elapsed, the data will be securely deleted.

The browsing and internal statistics data described in section 2 (IP, device, pages and buttons used) do not currently have a defined automatic deletion period; this section will be updated if one is established.

5. Recipients and Data Processors

Your data will not be disclosed to third parties unless required by law. To send and receive emails we use Proton Mail (Proton AG), a provider headquartered with servers in Switzerland, which encrypts messages in storage.

If you choose to contact us via WhatsApp, the conversation takes place on the platform of WhatsApp Ireland Limited (Meta group), subject to its own terms of use and privacy policy, over which THRAX has no control.

The contact forms and the WhatsApp button are protected by Google reCAPTCHA v3, from Google Ireland Limited, to prevent spam and automated submissions. When you use them, Google receives your IP address and technical data about your browser and your interaction with the page in order to work out whether you are a person. Google processes that data in accordance with its privacy policy and its terms of service.

International transfers: Switzerland is covered by a European Commission adequacy decision, so Proton's processing of email offers a level of protection equivalent to that of the GDPR and requires no additional safeguards. Google may process reCAPTCHA data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework, which is covered by a European Commission adequacy decision. Apart from the services listed in this section and in the Cookie policy, no data is transferred outside the European Economic Area.

6. User Rights

Under the GDPR and the LOPD-GDD, you may exercise the following rights:

Access: to know which of your personal data we process.
Rectification: to request the correction of inaccurate or incomplete data.
Erasure: to request the deletion of your data when it is no longer needed.
Restriction: to request that processing be restricted in certain circumstances.
Objection: to object to the processing of your data.
Portability: to receive your data in a structured, commonly used format.

To exercise any of these rights, send an email to [email protected] stating the right you wish to exercise and attaching a copy of your DNI or equivalent identity document.

You also have the right to lodge a complaint with theSpanish Data Protection Agency (AEPD):

Website: www.aepd.es
Address: C/ Jorge Juan, 6, 28001 Madrid
Phone: 900 293 183

7. Security Measures

THRAX has adopted the technical and organisational measures necessary to guarantee the security of your personal data and prevent its alteration, loss, or unauthorised processing or access, taking into account the state of the art, the nature of the data and the risks to which it is exposed.

8. Customers, Invoicing and SEPA Direct Debits

We process data of customers and/or their representatives (identification and contact details, address, and bank details such as IBAN; and, where applicable, tax ID (NIF/CIF)) to manage the business relationship, provide the service, invoice, collect payment by SEPA direct debit and handle incidents and returns.

Legal basis: performance of a contract or taking steps prior to entering into a contract (Art. 6.1.b GDPR) and compliance with legal obligations (Art. 6.1.c GDPR).
Recipients: financial institutions and banks involved in collecting payment; public authorities where required by law.
Retention: for the duration of the business relationship and, thereafter, for the statutory periods for keeping commercial/accounting records (generally 6 years from the last accounting entry, except where special periods apply).
Rights: access, rectification, erasure, objection, restriction and portability, and to lodge a complaint with theAEPD (www.aepd.es).

9. Cookies and Local Storage

Without asking you for anything, this site stores in the browser's localStorage your visual theme preference (light/dark) under the key thrax-theme: this is technical storage, it is not sent to any server and remains exclusively on your device.

Everything else sits behind the consent banner and is only activated if you accept it: functional storage (thrax-wa-lead and thrax-wa-nombre, which remember on your device the name and phone number you gave us through the WhatsApp button so we don't have to ask you again) and analytics cookies (internal statistics and Google Analytics 4). No advertising cookies are installed. The forms also load Google reCAPTCHA as a necessary security measure, only when you are about to use them (see section 5). You can change your decision at any time from the “Preferences” link in the footer.

For more information about cookies, see our Cookie policy.