Privacy policy

What this policy covers

This policy covers only the axirensystems.com website: the contact form and browsing its pages.

The OnTrain (ontrain.app) and OnChats (onchats.app) platforms have their own privacy policies, because the data processed on them is different and, in some cases, so is the role of Axiren Systems (on those platforms it may act as a processor on behalf of the business that uses them). If you use either of them, the policy that applies to you is that platform's own.

Data controller

Controller: Quico Blázquez Vidal, a sole trader (empresario individual) trading as Axiren Systems. Tax identification number (NIF): 46088145D. Address: Calle de Cadarso 16, local, 28008 Madrid, Spain.

Contact email for any privacy matter and to exercise your rights: contacto@axirensystems.com.

No data protection officer has been designated, because our activity does not fall within any of the cases set out in Article 37 of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).

What data we process

The data you provide voluntarily through the contact form or by emailing us, and the minimal technical data generated by your visit. Specifically:

• Identification and contact details: name, company, email address and phone number with its country code.
• Project context: main interest, team size, main problem, when you would like to start, the tools you currently use, whatever you write in your message and the language of the page you send it from, so that we can reply in that language.
• Minimal technical data about the request, generated by the server when it receives it (date, time and IP address), which is kept in the hosting logs.
• To stop the form being used to send messages in bulk, we keep the IP address it is sent from in pseudonymised form for one hour: instead of the address we store a code calculated with HMAC and a secret salt that is kept only on our server. It is deleted after that hour.
• Your decision on the cookie notice and, if you choose one, the language of the website, which are stored in your own browser and do not reach our systems.

Providing your data is not a statutory or contractual requirement. However, the form fields marked with an asterisk (*) are necessary to handle your request: if you do not fill them in, we will not be able to reply to you. You can leave the fields marked as optional blank.

What we do NOT process

We do not collect special categories of personal data (health, political opinions, trade union membership, biometric data) and we do not ask you for sensitive information anywhere on the website. Please do not include it in the free-text message either: it is not needed to assess a project.

We do not carry out profiling, we do not make automated decisions that produce legal effects concerning you, and we do not use your data to train artificial intelligence models.

The website is not aimed at children under 14, and we do not knowingly collect data from children under that age.

How we count visits

To know how many people visit the website and which pages interest them, each time a page is opened we record the page, the date and time, and where the visit came from: another page of this website, the name of the site that linked to you (for example, google.com, without the full address) or "direct".

Nothing else. We do not record your IP address (beyond the hosting provider's technical logs described above) or any data about your phone or browser, we do not store anything on your device (no cookies, no local storage), and this data cannot be used to identify you or follow your journey. We only look at it in aggregate, in charts, and we delete it after 12 months. Legal basis: our legitimate interest in knowing whether the website works (Article 6(1)(f) GDPR).

Our business cards

Our business cards carry an NFC chip and a QR code that open axirensystems.com/hola/, where you can watch a short presentation video. The cards are not numbered: that page is counted like any other visit, as explained above.

If you then write to us through the contact form, your message reaches us marked as coming from the card, so that we know where the contact came from.

Purposes and legal basis

• To handle your request and answer your enquiry. Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) or, if your enquiry is not about a possible contract, our legitimate interest in answering it (Article 6(1)(f)).
• To prepare and maintain the business relationship if the contact progresses. Legal basis: the performance of the contract or the dealings prior to it (Article 6(1)(b)).
• To keep a record of the contact so that we can prove what was said and when. Legal basis: our legitimate interest in managing the relationship and in being able to defend ourselves against potential claims (Article 6(1)(f)).
• To comply with legal, tax and accounting obligations when a contract is entered into. Legal basis: legal obligation (Article 6(1)(c)).

We will not send you commercial communications unrelated to your enquiry without asking you first. If we ever do, each one will include a way to unsubscribe.

How long we keep your data

• If the contact does not progress: up to 12 months from the last communication, after which the data is erased.
• If the contact becomes a client: for as long as the relationship lasts and, after that, for the applicable statutory limitation periods (up to 6 years for commercial and accounting matters).
• Technical server logs: the hosting provider's retention period, usually a few months.

Once these periods have expired, the data is erased or irreversibly anonymised.

Who else can see your data

We do not sell your data or disclose it to third parties, except where there is a legal obligation to do so. It is accessed only by providers acting as processors under a contract signed in accordance with Article 28 GDPR, and only so that they can provide their service to us. By category:

• Web hosting provider, which hosts the website and receives the form.
• Email provider, through which your enquiry reaches us and we reply to it.
• Internal request management provider, where the contact is recorded so that we can follow it up.
• Professional advisers and invoicing provider, only if the contact becomes a contractual relationship.
• In addition, data may be disclosed to public authorities, courts or law enforcement agencies where there is a legal obligation to do so.

Where your data is processed

We give preference to providers that store data within the European Economic Area (EEA). Should a provider ever process data outside the EEA, this will be done under an adequacy decision of the European Commission or standard contractual clauses, with any additional safeguards required.

You can ask us at any time, by writing to contacto@axirensystems.com, for up-to-date details of the specific providers involved and of the safeguards that apply.

Security

The website is served over an encrypted connection (HTTPS) and access to contact data is limited to the people who need to process it. We apply reasonable technical and organisational measures appropriate to the risk of the processing: minimal access, strong authentication and backups.

No system is infallible. If a personal data breach affecting your data were to occur, we would notify the supervisory authority in the cases and within the time limits set by law and, if the breach posed a high risk to your rights, we would also communicate it to you.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and your right not to be subject to automated decisions, by writing to contacto@axirensystems.com and stating which right you wish to exercise.

In particular, you can object at any time to processing based on our legitimate interests: we will stop unless we can demonstrate compelling legitimate grounds that override your rights, or we need it to defend ourselves against claims.

We will reply no later than one month after receiving your request. This period may be extended by two further months if the request is complex, in which case we will let you know beforehand.

You have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency; www.aepd.es), C/ Jorge Juan 6, 28001 Madrid, or with the supervisory authority of the EU country where you live or work.

Changes to this policy

If there are changes to our processing, our providers or the law, we will update this text and the date at the top. If a change affects you significantly and we have a way of contacting you, we will let you know before it takes effect.