Privacy policy
This is an English translation provided for convenience. The Spanish version is the legally binding one and prevails in case of any discrepancy: Política de privacidad.
Last updated: October 27, 2026 · Version 1.4
1. Data controller
The data controller for the personal data collected through this website is:
- Company name: PIPM ALTAHOJA SOLUTIONS, S.L.
- Tax ID (CIF): B22899462
- Registered office: C/ Uruguay, 20 — 29693 Estepona (Málaga)
- General contact email: hola@izuel.es
- Email for privacy matters and rights under the General Data Protection Regulation (GDPR): privacidad@izuel.es
- Website: https://izuel.es
PIPM ALTAHOJA SOLUTIONS, S.L. (hereinafter, the “Controller”) acts as data controller and determines the purposes and means of the processing.
2. Purposes and legal basis
We process your personal data for the following purposes and on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Responding to requests for information and contact forms | Consent of the data subject (Art. 6(1)(a) GDPR) |
| Managing the contractual relationship with clients and suppliers | Performance of a contract (Art. 6(1)(b) GDPR) |
| Complying with legal obligations (tax, accounting, commercial) | Legal obligation (Art. 6(1)(c) GDPR) |
| Sending commercial communications about our services | Express consent or legitimate interest with regard to clients (Art. 6(1)(a) / 6(1)(f) GDPR) |
| Improving the website and statistical analysis | Consent (analytics cookies) — see Cookie Policy |
| Answering, by means of an automated artificial intelligence assistant, the questions you type into the website chat | Legitimate interest in handling the inquiries you raise (Art. 6(1)(f) GDPR) |
3. Data we collect
Depending on the purpose, we may collect the following data:
- Contact form: name, email address, telephone number (optional) and message.
- Contractual relationship with clients or suppliers: identification data (first name, surname(s), national ID, foreigner ID or tax ID number (DNI/NIE/CIF), company name), contact details, billing details and, where applicable, bank details.
- Browsing data: IP address, device type, browser and data relating to the use of the site, as detailed in the Cookie Policy.
- Website chat: the text you type into the chat (we ask you not to include personal data) and a technical identifier derived from your IP address, pseudonymised by means of HMAC with a key that changes every day, which does not allow the IP address to be identified and is used only to prevent abuse. The anti-spam verification (Turnstile, by Cloudflare) also processes technical browser signals, such as the IP address; its script is loaded on the contact form and, in the chat, only when you open the panel.
No special categories of data (health, ideology, religion, biometric data, etc.) are requested. The user guarantees the accuracy of the data provided and undertakes to notify any changes to it.
4. Retention periods
- Contact data where no contract is entered into: until the user requests its erasure or, failing that, for a maximum of 1 year from the last interaction.
- Contractual data: for as long as the contractual relationship lasts and, once it has ended, for the applicable statutory periods (in particular, tax, accounting and commercial periods, which may be up to 6 years under the Spanish Commercial Code (Código de Comercio), and even longer periods for certain specific obligations).
- Data for commercial communications: until the data subject withdraws their consent.
- Browsing data / cookies: in accordance with the periods indicated in the Cookie Policy.
- Website chat: IZUEL does not store the content of conversations. The technical identifier is deleted after two days. The invocation logs of the chat service (Cloudflare Workers) are switched off, so the IP addresses of the requests are not stored in them; the few error entries that are logged contain neither the IP address nor the text of conversations. According to Anthropic’s Privacy Center, Anthropic deletes inputs and outputs from its systems within 30 days of receipt or generation, unless the law requires it to keep them longer or a use that breaches its usage policy leads it to keep them for up to 2 years (source, accessed October 1, 2026).
Once the stated periods have elapsed, the data will be erased or, where applicable, blocked in accordance with the provisions of the applicable regulations.
5. Recipients and data processors
Data will not be disclosed to third parties, except where required by law. For the proper provision of the service, the data may be processed by the following data processors under the terms of Article 28 GDPR, each acting on behalf of the controller, following its instructions and under the corresponding data processing agreement:
- Web hosting provider: Raiola Networks, S.L., with servers located in Spain (European Union).
- Email provider: Raiola Networks, S.L., with servers located in Spain (European Union).
- Web analytics provider, if one is active on the site.
- Accounting and administrative advisory firm for compliance with tax, accounting and employment obligations, where applicable.
- Website chat: Anthropic, PBC (United States), the provider of the artificial intelligence model that generates the answers.
- Chat hosting and anti-spam verification (Turnstile): Cloudflare, Inc. (United States), which also provides the anti-spam verification on the contact form.
Data may also be disclosed to Public Administrations, Courts and Tribunals, and law enforcement agencies where there is a legal obligation to do so.
6. International data transfers
The web hosting and corporate email processors (Raiola Networks, S.L.) are located in Spain (European Economic Area), so those services do not involve data transfers outside the EEA. Transfers to the United States do take place through the website chat and the anti-spam verification: with Anthropic, PBC, by means of the standard contractual clauses included in its data processing agreement (Anthropic relies on those clauses and is not stated to participate in the EU-U.S. Data Privacy Framework); with Cloudflare, Inc., on the basis of its participation in the EU-U.S. Data Privacy Framework and, as a fallback, the standard contractual clauses. If providers located outside the EEA are added in the future (for example, an analytics tool, a payment system or another integration), this policy will be updated to identify the provider, the destination country and the safeguard covering the transfer: an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework), Standard Contractual Clauses under Article 46 GDPR, or other appropriate safeguards provided for in the regulations.
7. Your rights
You may at any time exercise your rights of access, rectification, erasure (“right to be forgotten”), objection, restriction of processing and portability, and withdraw any consent you have given, without affecting the lawfulness of processing carried out prior to its withdrawal.
To exercise these rights, you can write to us at privacidad@izuel.es, stating “GDPR” (or “RGPD”) in the subject line and attaching a copy of a document proving your identity. You may also write to the registered office indicated in section 1. If you consider that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.
8. Data security
The Controller has adopted the technical and organizational measures necessary to guarantee the security of personal data and to prevent its alteration, loss, or unauthorized processing or access, taking into account the state of the art, the nature of the data and the risks to which they are exposed, in accordance with Article 32 GDPR.
9. Minors
The services offered through the website are intended exclusively for persons over 18 years of age. Data of minors is not knowingly collected or processed. If we become aware that we have received data from a minor without the consent of the person holding parental authority or guardianship, we will erase it immediately.
10. Changes to the privacy policy
This policy may be amended to adapt it to changes in legislation, case law or the Controller’s practices. Any amendment will be published on this page with its corresponding update date. If you have any questions about how we process your data, write to us at privacidad@izuel.es.
Last updated: June 20, 2026.