Privacy policy

Osprean Technologies, S.L. ("Osprean"), tax ID B10841278, registered office at Calle Mesena, 70, 2.º B, 28033 Madrid (Spain), is the controller of the personal data collected through this website. You can write to us at info@osprean.com.

Data protection officer: [DELEGADO DE PROTECCIÓN DE DATOS — nombre y contacto, o indicar que no procede].

This policy covers the osprean.com website only. The Osprean platform used by our public-sector clients is governed by the data processing agreement signed with each of them: there the client is the controller and Osprean acts as processor under article 28 GDPR.

We only handle the data described below. This site does not build profiles, does not make automated decisions and does not sell data to anyone.

Contact form. We collect your name, your email address and the message you write; organisation and phone number are optional. We use them to reply and, where relevant, to arrange a demo of Osprean. The form includes a hidden anti-spam field that collects no personal data.

Server logs. Our server automatically records the IP address, the date, the page requested and the browser, in order to keep the service running, detect abuse and rate-limit form submissions. These logs are not cross-referenced with contact data.

Analytics. If you expressly accept, we use Google Analytics 4 to see which pages are visited and where traffic comes from. Until you accept, Google's script is not downloaded and no data is sent to Google — not even your IP address. Cookie details are in the cookie policy.

If you write to info@osprean.com directly or call us, we will handle the data you give us for the same purpose.

We rely on the following legal bases:

• Your consent (art. 6(1)(a) GDPR) when you submit the contact form and when you accept analytics cookies. You may withdraw it at any time, without affecting processing carried out beforehand.
• Pre-contractual steps taken at your request (art. 6(1)(b) GDPR) when what you ask for is commercial information or a demo of Osprean.
• Our legitimate interest (art. 6(1)(f) GDPR) in keeping the site available and protected against abuse, which is the basis for the server logs.

We do not process special categories of data (health, beliefs, trade union membership and the rest of art. 9 GDPR) through this site. Please do not include them in the form message.

Form messages are kept for as long as the conversation lasts and afterwards for as long as needed to handle any liability arising from the contact: [PLAZO DE CONSERVACIÓN]. Server logs are kept [PLAZO DE CONSERVACIÓN].

Google Analytics data is kept according to the retention set on the account: [PLAZO DE CONSERVACIÓN]. The Spanish DPA's guidance on analytics takes 25 months as the reference maximum.

We do not disclose your data to third parties. We do rely on providers that handle it on our behalf, as processors, under a contract signed in accordance with article 28 GDPR:

We may also disclose your data to public authorities and bodies where a legal rule requires it.

[REVISIÓN LEGAL — confirmar que existe contrato de encargado del tratamiento firmado con cada uno de estos proveedores y que la lista está completa.]

Google processes analytics data in the United States, outside the European Economic Area. If you accept analytics cookies, your IP address, your browser and the pages you visit are sent to Google and may end up being processed there.

Cloudflare is likewise in the United States, and Microsoft Azure processes part of the data in the European Union and part in the United States. These transfers rely on the standard contractual clauses approved by the European Commission and, where the provider is certified, on the EU–US Data Privacy Framework.

[REVISIÓN LEGAL — confirmar en cada contrato la garantía de transferencia aplicable y la evaluación de impacto de las transferencias, si procede.]

We apply technical and organisational measures proportionate to the risk: HTTPS traffic encryption, access control, backups and activity logging. The site is hosted in European Union data centres.

No measure removes risk entirely. Should a security breach occur that poses a high risk to your rights, we would tell you and notify the supervisory authority within the GDPR deadlines.

You may exercise the following rights at any time:

• Access: find out what data of yours we handle and obtain a copy (art. 15 GDPR).
• Rectification: correct inaccurate or incomplete data (art. 16).
• Erasure: ask us to delete it once it is no longer needed (art. 17).
• Restriction: ask us to stop using it temporarily (art. 18).
• Portability: receive it in a structured format or have us send it to another controller (art. 20).
• Objection: object to processing based on our legitimate interest (art. 21).
• Withdrawal of consent: at any time and as easily as you gave it, without affecting earlier processing.

To exercise them, write to info@osprean.com or use the contact form, stating which right you wish to exercise. We may ask you to prove your identity. We will reply within one month.

If you are not satisfied with our reply, you can lodge a complaint with the Spanish Data Protection Agency.

If we change the way we handle data, we will update this page and state the date. If the change is significant and the processing relies on your consent, we will ask for it again.

Last updated: 17 September 2026. In the event of any discrepancy, the Spanish version prevails.