How we handle
your personal data.

1. Data controller

Controller

Visionharbor Technologies S.L. (trade name: VisionHarbor)

Tax ID (NIF)

B-26605329

Address

Calle Huéscar 16, 29007 Málaga (Spain)

Email

We have not appointed a data protection officer because we are not required to. For any question about this policy or your data, email us at .

2. What data we process

Contact form

Your name, your organisation, your work email address, the area you are interested in and your message, together with the sector or service you were reading about when you opened the form.

Booking requests

Your name, your work email address, your organisation, the type of session requested, the consultant you would like to speak with, the topic you want to work through and your preferred timing and time zone.

Job applications

If you apply for a role through our careers page: your name, your email address, your phone number and LinkedIn profile if you give them, the position you apply for, your message and the CV you upload, with whatever details you choose to include in it. Please do not include special categories of data (such as health, religion or trade union membership) in your CV.

Email and meetings

The data you send us by email: your name, contact details, the content of your messages and any attachments. If we hold an online meeting, the meeting platform processes your display name and connection data for the duration of the call.

Technical visit data

Our hosting provider automatically records technical data such as your IP address, the date and time, the page requested and your browser type, in order to deliver the website and protect it against abuse. We do not use web analytics and do not build browsing profiles.

Clients

If your organisation engages us, we process the contact details of the people we work with, billing details and the information needed to deliver the service, under the terms of the relevant agreement.

Please do not include passwords, payment details, special categories of personal data or confidential operational data in a form or an initial email. We will agree a secure way to share such information if an engagement requires it.

3. Purposes, legal basis and retention

Purpose	Legal basis	Retention
Replying to your enquiry or booking request and, if you ask, arranging a conversation, a meeting or a proposal.	Your consent (art. 6.1.a GDPR) and steps taken at your request before entering into a contract (art. 6.1.b GDPR).	12 months from our last contact if you do not become a client.
Assessing your job application and contacting you about it; with your consent, keeping your CV on file for other suitable roles.	Steps taken at your request before entering into a contract (art. 6.1.b GDPR). Keeping your CV on file: your consent (art. 6.1.a GDPR), which you can withdraw at any time.	Until the selection process ends; with your consent, up to 12 months from your application.
Delivering contracted services and managing our relationship with your organisation.	Performance of the contract (art. 6.1.b GDPR). For contact people at the client organisation, our legitimate interest (art. 6.1.f GDPR and art. 19 LOPDGDD).	For as long as the contract lasts.
Invoicing, accounting and tax obligations.	Compliance with legal obligations (art. 6.1.c GDPR).	Six years (art. 30 of the Spanish Commercial Code) or the applicable tax limitation period.
Running the website securely and preventing abuse.	Our legitimate interest in providing a secure website (art. 6.1.f GDPR).	The short period for which the hosting provider keeps its technical logs.

When these periods end, we block the data for as long as legal claims may arise (art. 32 LOPDGDD) and then delete it.

We do not send unsolicited marketing communications, build profiles or make automated decisions using your data.

Giving us your data is voluntary, but without your name, a way to contact you and a description of your request we cannot respond to it.

4. Recipients and processors

We do not sell your data and do not disclose it to third parties unless required by law (for example, to the Spanish Tax Agency or the courts). To operate, we rely on providers that process data on our behalf under data processing agreements in line with article 28 GDPR:

Provider	Role	Location and safeguards
Cloudflare, Inc.	Website hosting, content delivery and security.	USA. European Commission standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.
Resend (Plus Five Five, Inc.)	Delivering form submissions, including uploaded CVs, to us by email.	USA. European Commission standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.
Microsoft Ireland Operations Ltd. (Microsoft 365)	Email, calendar invitations, document storage and online meetings.	European Union. Possible transfers to the USA under the EU-US Data Privacy Framework and standard contractual clauses.

Where a provider processes data outside the European Economic Area, we rely on the safeguards indicated above. You can ask us for more information about these safeguards at .

5. Your rights

You can exercise the following rights at any time:

• Access: find out what data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Objection and restriction of processing.
• Portability: receive your data in a structured, commonly used format.
• Withdrawal of consent, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise them, email or write to Visionharbor Technologies S.L., Calle Huéscar 16, 29007 Málaga (Spain), stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it. We will reply within one month.

If you believe we have not handled your data or your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

6. Other people’s data

If you give us data about other people, such as colleagues at your organisation, you must have informed them first and be entitled to share it with us.

7. Security

We apply appropriate technical and organisational measures to protect your data, such as encrypted connections (HTTPS), restricting access to the people who need the data, and selecting providers that offer adequate security guarantees.

8. Changes to this policy

We may update this policy when our services or the law change. The date of the latest update is shown at the top of this page.