Privacy policy

Last updated: 26 October 2026

This is a translation for information purposes; in case of discrepancy, the Spanish version prevails.

This policy explains how we process the personal data of people who use the website vexcosolutions.com, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

• Controller: Soluciones Digitales Vexco, S.L. (“Vexco Solutions”).
• Tax ID (CIF): B44978617.
• Address: Av. Francesc Macià, 35 (Cambra de Comerç de Sabadell), 08206 Sabadell (Barcelona), Spain.
• Data protection contact: javier@vexcosolutions.com.

Vexco is not required to appoint a data protection officer. You can send any privacy queries to the email address above.

2. What data we process

Contact form and audit requests

When you write to us through the form, we process your name, your work email and, if you provide them, your company name, your phone number, the service you are interested in, your current CRM and the message you send us. We also record the page from which you submit the form and your IP address, which we use to prevent automated submissions and abuse. Form data is recorded in our HubSpot CRM; if you have accepted HubSpot cookies, the submission is also associated with your browsing history on this website.

Meeting bookings

If you book a video call through the meetings calendar, we process the data you enter in it (such as your name, your email and the date and time you choose) to organise the meeting, which takes place on Google Meet. The calendar is provided by HubSpot and is only loaded if you click the button to open it.

Email communications

If you email us directly, we process your address and any data you include in the message in order to reply and, where applicable, manage the professional relationship.

Browsing and cookies

Only if you accept them, we use HubSpot analytics and marketing cookies that collect information about your browsing on the website. You will find the details in our cookie policy.

Please do not provide us with special categories of personal data, or with third-party data without their consent. If you provide us with data relating to other people, you are responsible for having informed them.

3. Purposes and legal bases

• Responding to your enquiries and preparing the audit or a proposal. Legal basis: taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and your consent when submitting the form (Art. 6(1)(a) GDPR).
• Organising and holding the meetings you book. Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• Managing relationships with clients and suppliers, including invoicing and accounting and tax obligations. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).
• Protecting the website against spam and abuse. Legal basis: our legitimate interest in ensuring the security of the service (Art. 6(1)(f) GDPR).
• Measuring website use and personalising our communications through HubSpot cookies. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

We do not send commercial communications by electronic means without your prior consent, except in the cases permitted by Article 21 of the LSSI-CE for existing clients, and always with the option to unsubscribe. We do not make automated decisions that produce legal effects concerning you, nor do we carry out profiling for that purpose.

4. How long we keep your data

• Enquiries and requests that do not lead to a professional relationship: for as long as necessary to deal with them and, at most, two years from the last contact, unless you ask us to delete them sooner.
• Clients: for the duration of the contractual relationship and, afterwards, for the limitation periods of any legal liabilities and those required by commercial and tax legislation (generally, six years for accounting records).
• Form anti-spam control: the pseudonymised identifier of your IP address that we use to limit repeated submissions is deleted after 10 minutes.
• Cookies: for the periods indicated in the cookie policy.

Once these periods have elapsed, the data is deleted or blocked for as long as liabilities may be claimed, in accordance with Article 32 of the LOPDGDD.

5. Recipients and data processors

We do not disclose your data to third parties unless required by law. To provide our services we rely on suppliers that process data on our behalf, with whom we have signed the corresponding data processing agreements:

• Hostinger, hosting provider for the website and the server that processes the form.
• Google (Google Workspace), for the corporate email where we receive requests, and Google Meet for video calls.
• HubSpot, as the CRM in which we manage contacts and opportunities, for the meetings calendar and, if you accept them, for analytics and marketing cookies.

International transfers

Some of these providers, such as HubSpot, Inc. and Google LLC, are headquartered in the United States or may access data from outside the European Economic Area. In those cases, transfers are covered by the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, where the provider is certified, and in any event by the standard contractual clauses approved by the European Commission, together with any additional safeguards that may be required.

6. Your rights

You may exercise the following rights at any time:

• Access: find out whether we process your data and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed.
• Objection: object to processing based on our legitimate interest.
• Restriction: ask us to keep your data without processing it in certain cases.
• Portability: receive your data in a structured, commonly used format.
• Withdraw your consent at any time, without affecting the lawfulness of prior processing.

To exercise them, email us at javier@vexcosolutions.com with “Data protection” in the subject line, stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it. We will reply within one month at most, which may be extended in the cases provided for in the GDPR.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid; www.aepd.es).

7. Security

We apply technical and organisational measures appropriate to the risk to protect your data against loss, unauthorised access or alteration, such as encrypted connections (HTTPS), access control and the selection of providers offering sufficient guarantees.

8. Minors

This website is aimed at professionals and businesses. We do not knowingly collect data from children under 14. If we discover that we have done so, we will delete it.

9. Changes to this policy

We may update this policy to reflect changes in the law or in our services. We will always publish the current version on this page, with its date of update.