Privacy policy
How we handle the personal data you give us through this website: who the controller is, for what purpose and on what legal basis, for how long, and what rights you can exercise.
Last updated: 9 August 2026
1. Data controller
The controller of the personal data collected through this website is:
| Item | Details |
|---|---|
| Controller | Atypical Tech Sociedad Limitada |
| Tax identification number (NIF) | B22965255 |
| Address | Avinguda Espanya 258, 43883 Calafell (Tarragona), España |
| Data protection contact | hello@atypicaltech.com |
2. What data we process
We only process what you give us voluntarily, plus the minimum needed to run the site securely:
- Contact form: name, email address, subject and message.
- Blog comments: name or alias, email address and the comment itself. The email address is never published.
- Technical connection data: IP address and browser user agent, recorded alongside form submissions.
- Browsing data: pages visited, time on page and traffic source — only if you accepted analytics cookies.
- Administration area: login credentials of the staff authorised to publish content.
3. Purposes and legal basis
Each activity has a defined purpose and a legal basis under article 6 of Regulation (EU) 2016/679 (GDPR):
| Purpose | Legal basis |
|---|---|
| Answering enquiries sent through the contact form and the correspondence that follows. | Consent (art. 6(1)(a) GDPR), given by ticking the box on the form. |
| Publishing and moderating comments on blog articles. | Consent (art. 6(1)(a) GDPR). |
| Recording the IP address and user agent behind a submission, to prevent automated bulk submissions and form abuse. | Legitimate interest in the security of the service (art. 6(1)(f) GDPR). |
| Measuring website use through aggregate statistics in order to improve its content. | Consent (art. 6(1)(a) GDPR), given through the cookie notice. |
| Managing authorised staff access to the administration area. | Performance of a contract or employment relationship (art. 6(1)(b) GDPR). |
| Keeping the records required by commercial and tax law when an enquiry leads to a business relationship. | Compliance with a legal obligation (art. 6(1)(c) GDPR). |
4. How long we keep it
| Data | Retention period |
|---|---|
| Contact form messages that do not lead to a business relationship | 12 months from the last contact. |
| Client data arising from a business relationship | For the duration of the relationship and then for the applicable statutory limitation periods (up to 6 years under commercial law and 4 under tax law). |
| Published comments | For as long as the article remains published, or until you ask for their removal. |
| Comments rejected in moderation | Deleted after review. |
| Record of your cookie choice | 12 months, after which you are asked again. |
| Google Analytics statistics | 14 months. |
5. Who we share it with
We do not sell or otherwise disclose personal data to third parties for commercial purposes.
To run the service we rely on providers acting as processors, each under the contract required by article 28 GDPR:
- Hosting and infrastructure provider, which hosts the website and its database.
- Email provider, through which messages are received and answered.
- Google Ireland Limited, which provides the Google Analytics 4 statistics service — only if you accepted analytics cookies.
6. International transfers
If you accept analytics cookies, Google may process data on servers outside the European Economic Area, in particular in the United States.
Those transfers rely on the EU-US Data Privacy Framework, found adequate by the European Commission in its decision of 10 July 2023, and additionally on the standard contractual clauses approved by the Commission.
If you do not accept analytics cookies, no transfer takes place: the site never loads any Google component at all.
7. Your rights
You may exercise the following rights at any time:
- Access: find out what data of yours we hold.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask for data to be deleted once it is no longer needed.
- Objection: object to processing based on our legitimate interest.
- Restriction: ask that data be kept but not used while a complaint is resolved.
- Portability: receive your data in a structured, commonly used format.
- Withdraw consent: at any time, without affecting the lawfulness of processing carried out beforehand.
8. How to exercise them
Write to hello@atypicaltech.com, or by post to Avinguda Espanya 258, 43883 Calafell (Tarragona), España, stating which right you wish to exercise and enclosing a copy of a document proving your identity.
We will reply within one month of receiving the request, extendable by two further months where the request is particularly complex — in which case we will tell you about the delay.
For cookies specifically, you can review or withdraw your choice at any time through the "Cookie settings" link in the footer, as explained in the cookie policy.
If you believe the processing does not comply with the law, you have the right to lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).
9. Data security
We apply appropriate technical and organisational measures to protect data against destruction, loss, alteration and unauthorised access: TLS encryption in transit, access control on the administration area, and restricting access to the staff who need it for their work.
No system is completely infallible. Should a breach occur that poses a high risk to your rights, we will tell you without undue delay, as article 34 GDPR requires.
10. Children
The services and content on this website are aimed at professionals and businesses. They are not directed at children under 14 and we do not knowingly collect data from anyone in that age group. If you find that a child has given us data, write to us and we will delete it.
11. Changes to this policy
This policy may be updated to reflect legal changes or changes in how we handle data. The date of the last update appears at the top of the document.
Where a change is substantial and affects processing based on your consent, we will ask for it again.