Privacy policy
This translation is provided for convenience. The Spanish version is the legally binding one. See the Spanish privacy policy.
1. Data controller
The data controller is Ociel Gallardo (sole trader), trading as GallaDev, NIE Z5030742A. Address: C/ d'En Vicent Gallart, 54, 46011 Valencia (Spain). Email: hola@galladev.com. You can also write via the form on galladev.com or on LinkedIn ociel-gallardo.
2. What data we process and where it comes from
Contact form. Name, email, company (optional), your message and the date of submission. To protect the form, Cloudflare Turnstile processes technical signals (IP address and browser data). Our server uses the IP transiently to limit repeated submissions and sends it to Cloudflare to verify the check.
Emails to hola@galladev.com. Sender, content and, if any, attachments.
Professional contacts. If we obtain data from public sources to present our services, section 8 applies.
Browsing. Technical access data (IP, browser) in the hosting provider's logs, and the analytics in section 9.
3. Purpose and legal basis
- To reply to your enquiry and, if you ask, prepare a proposal: pre-contractual steps at your request (Art. 6.1.b GDPR). The form checkbox records that you have read this information. It is not consent required in order to reply.
- To organise requests in our internal CRM. We may analyse the text of your message with artificial intelligence (Groq) to prioritise them. That analysis is not triggered merely by submitting the form: it is done from the CRM when reviewing the request. The basis is legitimate interest (Art. 6.1.f GDPR) in handling requests better. We do not take automated decisions that produce legal effects or similarly affect you. You may object by writing to us.
- To present GallaDev's services if you work at an accounting firm, advisory firm, practice or SME and have not written to us yourself: legitimate interest (Art. 6.1.f GDPR). Details, channels and objection are in section 8. We do not send cold email.
- The form is not used to send you commercial communications. A commercial email is only sent if you have given prior permission, or after a previous contact in which you authorise it (Art. 6.1.a GDPR and Art. 21 LSSI). You may withdraw it at any time.
- Site and form security: legitimate interest (Art. 6.1.f GDPR).
4. How long
Requests that do not become an engagement: 12 months from the last contact and then deletion or anonymisation. If there is a client relationship: for as long as it lasts and afterwards for the limitation periods of actions and of commercial and tax obligations (up to 6 years, Art. 30 of the Spanish Commercial Code). Prospecting under section 8 has its own period. If you object, we keep only your phone or email and the date on an exclusion list, so we do not contact you again.
5. Who processes data on our behalf
We do not sell or transfer your data. These providers process data on our behalf. We will only disclose data to authorities when required by law.
| Provider | Purpose | Location and safeguards |
|---|---|---|
| Cloudflare, Inc. | Website hosting (Cloudflare Pages), form delivery, Cloudflare Turnstile and, on galladev.com, Cloudflare Web Analytics. | Cloudflare, Inc. (USA). Transfer under the European Commission's standard contractual clauses or, if the provider is certified, the EU-US Data Privacy Framework. |
| Vercel Inc. | Hosting of the internal CRM (GallaDev Workspace), where requests are stored. | Vercel Inc. (USA). Transfer under the European Commission's standard contractual clauses or, if the provider is certified, the EU-US Data Privacy Framework. |
| Supabase, Inc. | CRM database: name, email, company and message. | Supabase, Inc. (USA). Transfer under the European Commission's standard contractual clauses or, if the provider is certified, the EU-US Data Privacy Framework. |
| Resend (Plus Five Five, Inc.) | Acknowledgement to the form email address, notice to the controller, and the hola@galladev.com mailbox. | Plus Five Five, Inc. (USA). Transfer under the European Commission's standard contractual clauses or, if the provider is certified, the EU-US Data Privacy Framework. |
| SerpApi, LLC | Querying public sources (firm website, maps and search engines) when preparing a prospecting profile. Not involved in the contact form. | SerpApi, LLC (USA). Transfer under the European Commission's standard contractual clauses or, if the provider is certified, the EU-US Data Privacy Framework. |
| Groq, Inc. | On demand only, from the CRM, to prepare notes: summarise public information about a firm (section 8) or analyse the text of a request. Not run when the form is submitted. | Groq, Inc. (USA). Transfer under the European Commission's standard contractual clauses or, if the provider is certified, the EU-US Data Privacy Framework. |
6. International transfers
The providers in the table are established in the United States. The transfer is based on the European Commission's standard contractual clauses (Decision 2021/914) or, if the provider is certified, the EU-US Data Privacy Framework. You may request a copy of the safeguards at hola@galladev.com.
7. Your rights
You may request access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent without affecting processing already carried out. Write to hola@galladev.com. We reply within one month. If you are not satisfied, you may complain to the Spanish Data Protection Agency (www.aepd.es).
8. Professional contacts (commercial prospecting)
Who and for what. If you work at an accounting firm, advisory firm, practice or SME, Ociel Gallardo (GallaDev) may process your professional data to present its services.
What data and where it comes from. Contact details of the firm or company (name, website, address, professional phone and professional email) and, where applicable, your name, role and what you publish as a professional. We obtain them from public sources: the firm's website, professional directories, Google Maps and search engines, LinkedIn, or events and professional associations where we have met. If we speak with you, we add brief notes about the conversation.
Legal basis. Our legitimate interest in making known services related to your professional activity (Art. 6.1.f GDPR and Art. 19 LOPDGDD). You may ask us for a summary of how that interest is weighed against your rights.
How we contact you. By phone, to professional numbers; in person, at your office; on LinkedIn, individually; or by post. By email only if you have asked for or authorised it in a previous contact. We do not send cold email. Before calling or sending a letter in your name we check the Lista Robinson.
AI. We use Groq on demand only, from the CRM, to summarise the firm's public information and prepare lead notes before the conversation. A person always reviews the result. We do not take automated decisions about you.
Providers. For these profiles, Supabase (database), Vercel (the CRM), Cloudflare, Groq (AI notes, on demand only from the CRM) and SerpApi (public source queries) may be involved. They are established in the United States, with the safeguards in section 6. If we write to you on LinkedIn, LinkedIn processes that message.
How long. 12 months if there is no response. If you object, we keep only your phone or email and the date on an exclusion list, so we do not contact you again.
Your rights. You may object at any time, without giving reasons, by saying so on the call or visit, replying to the message or writing to hola@galladev.com. You may also exercise your rights of access, rectification, erasure, restriction and portability, and complain to the Spanish Data Protection Agency (aepd.es). To opt out of advertising from any company by phone, post, email or SMS you may join the Lista Robinson (listarobinson.es).
9. Cookies and similar technologies
This site does not use first-party or third-party cookies for advertising or profiling, nor advertising pixels.
- Cloudflare Turnstile, when using the form, to distinguish people from bots. It stores a technical identifier in local storage on its domain (
challenges.cloudflare.com) and is strictly necessary for the service you request (Art. 22.2 LSSI). More information in the Turnstile Privacy Addendum. - Cloudflare Web Analytics, on galladev.com. Cookie-free audience measurement: aggregated statistics (page views, referrer, device type and performance), not crossed with other data or used for other purposes.
With this setup a cookie notice is not required. If we later use cookies that need your permission, we will ask before, with the option to accept or refuse.
10. Security
We apply reasonable technical and organisational measures: Cloudflare Turnstile verification on the form, sending the message to the CRM only over HTTPS with a shared secret, and CRM access limited to authorised accounts. No system is completely secure. Do not send especially sensitive data through the form (health, identity documents, bank details).
11. Updates
We may update this policy. The current version will always be published on this page.