Privacy Policy

Who is responsible for your data

The data controller is IAOPSTIMAI S.L., NIF ESB56900053, registered address Calle Arándiga 18c, 28023 Madrid, Spain. For any privacy matter you can reach us at contact@claverock.com.

What this policy covers, and what it does not

This policy covers only personal data processed through the Website, which is a marketing and information site. It does not cover the work we carry out when delivering our services to a client. When we deliver services, we act inside the client’s own environment and under the separate written agreement between Claverock and that client (for example a confidentiality agreement, engagement letter, service agreement or service-level agreement, as applicable), which governs how any data in that engagement is handled. This Website policy and those agreements are kept deliberately separate.

What we collect

Contact form. When you use the contact form, we collect the name, firm, email address and message you provide. The form reaches us as an email.

Security data. To protect the form from spam and abuse, we use Cloudflare Turnstile, which processes limited technical data (such as your IP address and basic device signals) to tell humans from bots. Turnstile sets no advertising cookies.

Cookieless analytics. We use Plausible Analytics to understand, in aggregate, how the Website is used. Plausible sets no cookies, does not collect personal data, and does not track you across other websites.

We do not run accounts, take payments, host client documents, or offer any interactive artificial-intelligence feature on the Website. We do not collect special categories of data through the Website, and we ask that you do not submit any through the contact form.

Why we process it, and our legal basis

Under the EU General Data Protection Regulation (GDPR) and Spain’s Organic Law 3/2018 (LOPDGDD), our legal bases are:

To answer your enquiry. We use your contact-form details only to respond to you and to take any steps you ask for before a possible engagement. Legal basis: our legitimate interest in responding to enquiries about our practice, and where relevant the taking of steps at your request prior to entering a contract.

To keep the Website secure. We process limited technical data to protect the form and the site from abuse. Legal basis: our legitimate interest in the security of the Website.

To understand use of the Website. We use privacy-friendly, cookieless analytics. Legal basis: our legitimate interest in measuring and improving the Website.

We do not use your details to send you marketing, and submitting the form does not add you to any mailing list. We do not sell or rent personal data, and we do not profile you or make automated decisions about you.

Who we share it with

We share personal data only with service providers who help us run the Website, and only so they can perform their function for us under appropriate confidentiality and data-protection terms. These are: Resend, which delivers your contact-form message to us by email; Cloudflare, which hosts the Website and provides security, including the Turnstile anti-spam check; and Plausible, which provides our cookieless analytics. We may also disclose data where we are legally required to do so, for example to comply with a lawful request from a court or authority.

International transfers

Some of our providers may process data outside the European Economic Area. Where they do, we rely on an adequacy decision of the European Commission, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, to ensure your data receives an equivalent level of protection. Our analytics provider, Plausible, hosts data within the European Union.

How long we keep it

We keep contact-form enquiries for up to twenty-four (24) months after our last contact with you about the enquiry, and then delete them, unless the enquiry becomes a client engagement, in which case the data moves under the separate agreement governing that engagement. Security and analytics data are kept only for as long as needed for those purposes.

Your rights

Under the GDPR and the LOPDGDD you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent for anything, you may withdraw it at any time. To exercise any of these rights, email us at contact@claverock.com. We may need to verify your identity before we act on a request.

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. We would appreciate the chance to address your concern first.

Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. No transmission over the internet can be guaranteed completely secure, but we work to keep the little data the Website handles safe.

Children

The Website is intended for professional users and adults. We do not knowingly collect personal data from anyone under eighteen. If you believe a minor has provided us data, please contact us and we will delete it.

Links to other websites

The Website may link to third-party websites we do not control. This policy does not apply to them, and we encourage you to read their own privacy policies.

Changes to this policy

We may update this policy from time to time. Changes take effect when posted, and the “Last updated” date above will change.

Contact

For any question about this policy or your personal data, contact us at contact@claverock.com, or by post at IAOPSTIMAI S.L., Calle Arándiga 18c, 28023 Madrid, Spain.