Privacy policy

1. Data controller

Controller: José Enrique Ibarra Fernández. Tax ID (NIF): 34849563D. Address: Calle Árbol del Paraíso, 3 — 04007 Almería, Spain. Email for data protection matters: privacidad@atalayagrc.com

2. What data we process and why

a) Demo request. Through the form on this site we collect the data you voluntarily provide: name, company, email address, phone number, sector, regulations of interest and any message you choose to include. The purpose is to handle your demo request and maintain the related commercial contact.

b) Analytics and audience measurement. If you accept analytics cookies, we use Google Analytics and Microsoft Clarity to understand how the site is used (pages visited, interaction, heatmaps and anonymised session recordings) in order to improve it. We do not combine this information with your form data, nor use it for personalised advertising.

c) First-party visit counter, cookie-free. To know how many people visit each page, we use a counter running on our own server (Koko Analytics). It uses no cookies, stores nothing on your device and sends no data to third parties. To tell whether a visit is new, an encrypted fingerprint is computed on the fly from your IP address and browser, combined with a key that changes every day; your IP is never stored and the fingerprint is discarded when the key changes. We only keep aggregated totals (visits per page and per day), which cannot identify you, and they are deleted automatically after 24 months. The legal basis is our legitimate interest in measuring the audience in aggregate (Art. 6(1)(f) GDPR), in line with the Spanish Data Protection Agency (AEPD) guidance on audience measurement tools. You can object by writing to privacidad@atalayagrc.com.

We do not carry out profiling with legal effects or automated decision-making, nor do we use your data for purposes other than those stated.

3. Legal basis

Processing of the form data is based on your consent, given when you submit it, and on the application of pre-contractual measures requested by you (Art. 6(1)(a) and 6(1)(b) GDPR). Processing for analytics purposes is based on your consent, given when you accept analytics cookies in the banner (Art. 6(1)(a) GDPR), which you can withdraw at any time.

4. Retention period

The demo request data is kept for a maximum of 1 year from receipt, unless a commercial relationship begins that justifies keeping it longer, or you request its deletion earlier. Analytics data is retained according to each provider’s settings (Google Analytics keeps user-level data for up to 14 months; Microsoft Clarity, approximately 1 year).

5. Where the data is stored and international transfers

The form data is stored in this website’s database, hosted on servers located in the European Union. Analytics data is processed by Google and Microsoft, which may process it outside the European Economic Area, including the United States; such transfers rely on the EU-US Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission. In addition, only in the event of a security incident on the server, the hosting provider’s automated analysis may process technical system data (processes, network connections and load), including IP addresses, in the United States; that transfer relies on Standard Contractual Clauses.

6. Recipients and data processors

Data is not shared with third parties except where legally required. The following act as data processors, providing the guarantees required by the GDPR: Euronodes Ltd., which hosts this website, its database and its email on servers located in the European Union (only in the event of a security incident may it carry out an automated analysis with a sub-processor in the United States, under Standard Contractual Clauses), Google Ireland Ltd. (Google Analytics), Microsoft (Microsoft Clarity and encrypted server backup in Microsoft 365) and our authorised commercial distributor, ADM Cloud Services (ADMONLINE SERVICIOS GLOBALES, S.L.), which receives demo requests by email and handles their follow-up and the related business contact on behalf of Atalaya GRC.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to privacidad@atalayagrc.com, stating the right you wish to exercise. You can withdraw your consent for analytics at any time using the “Manage cookies” link in the footer of every page. If you believe your data is not being handled correctly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Cookies

This site uses technical/functional cookies necessary for its operation and, subject to your acceptance, analytics cookies. See our Cookie policy for details.

Last updated: 23 October 2026.