This policy explains how we handle the personal data you give us through this website, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on data protection and the guarantee of digital rights.
Who the data controller is
Controller: 1North Consultoría de Gestión, S.L.
Tax number (NIF): B19870120
Address: Paseo Gran Vía 52, 2.º derecha, 50005 Zaragoza, Spain
Data protection contact: info@1north.es
We have not appointed a data protection officer because none of the circumstances in article 37 GDPR applies. Any question about personal data can be sent to the address above.
What data we handle and where it comes from
We only handle the data you give us voluntarily: name, company, email address, topic and the content of the message. The contact form lives on this site, but when you submit it your data goes straight to Formward, which receives it, filters it and keeps it until it notifies us; it never passes through our server. We also handle whatever you include if you email us directly or contact us through LinkedIn.
We do not collect data about third parties and we do not obtain data from external sources. We do not process special categories of data (health, beliefs, trade union membership and similar); please do not include any in your message.
This website is static and sets no cookies, and uses no analytics or profiling tools.
What we use your data for, and on what legal basis
Answering your enquiry and staying in touch. Legal basis: your consent, given by ticking the acceptance box on the form and submitting it (article 6(1)(a) GDPR), and pre-contractual steps taken at your request (article 6(1)(b)).
Managing the contractual relationship if we end up working together, including invoicing and the associated legal obligations. Legal basis: performance of a contract (article 6(1)(b)) and compliance with legal obligations, in particular tax and accounting ones (article 6(1)(c)).
We do not use your data to send unsolicited marketing, we do not build profiles and we take no automated decisions producing legal effects concerning you.
How long we keep it
If your enquiry does not lead to a professional relationship, we keep the data for a maximum of twelve months from the last contact, then delete it.
If we do work together, we keep the data for the duration of the relationship and, once it ends, for the applicable statutory limitation periods: six years for commercial records (article 30 of the Spanish Commercial Code) and four years for tax obligations (General Tax Act). After those periods the data is deleted or anonymised.
Who else can access your data
We do not sell or disclose your data. The only parties with access are the providers needed to deliver the service, acting as processors under a contract meeting the requirements of article 28 GDPR:
Web hosting: OVHcloud, with servers at its Gravelines data centre in France. It stores the site files and logs technical access. As this is inside the European Union, there is no international data transfer.
Contact form processing: Formward, a Swedish company with its infrastructure in Sweden. It receives the submission, filters it, notifies us by email and keeps it in a dashboard only we can access. IP addresses are stored hashed, never in the clear.
Corporate email: Google Ireland Limited and Google LLC (Google Workspace), through which we receive your message and handle the reply.
Public authorities and courts may also access your data where there is a legal obligation to disclose it.
Transfers outside the European Economic Area
Web hosting. Site files and access logs are stored in Gravelines, France, inside the European Union. There is no international transfer.
Email. The service is provided by Google Ireland Limited, established in the European Union, which may use Google LLC (United States) as a sub-processor. That transfer relies on the European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, to which Google LLC is certified, and additionally on the standard contractual clauses included in the Google Workspace data processing agreement.
Contact form. Submissions are processed and stored in Sweden, inside the European Union. There is no international transfer.
Your rights
You may exercise the following rights at any time: access to your data, rectification of inaccurate data, erasure, restriction of processing, portability and objection to processing.
Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise them, write to info@1north.es stating which right you wish to exercise. We may ask you to prove your identity. We will reply within one month of receiving the request, extendable by a further two months if the request is particularly complex.
Exercising these rights is free of charge.
Where to complain
If you believe we have not handled your request properly, or that the processing of your data breaches the rules, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es). We would appreciate it if you wrote to us first so we can try to resolve it.
Security
We apply reasonable technical and organisational measures to protect your data against loss, unauthorised access and misuse: HTTPS encryption of the site, restricted access to the information, and processing agreements with our providers.
Changes to this policy
We may update this policy if our services, our providers or the applicable rules change. The version in force is always the one published on this page, with the update date shown above.