Privacy Policy
Last updated: 1 September 20261. Who is responsible
The controller for personal data processed through this website is:
ADSEA INNOVATIONS SL
Calle La Paz, Nº 9, Puerta BJ
46114 Vinalesa, Valencia, Spain
Tax ID (NIF): B23945652
Email: contact@thomaseccel.com
We are not required to appoint a Data Protection Officer under Article 37 GDPR, and have not appointed one. Privacy enquiries go to the address above.
2. Visiting this website (server logs)
Our hosting provider automatically records technical data each time a page is requested. This is standard for any web server and is necessary to deliver the site:
- IP address of the requesting device
- Date and time of the request
- The page or file requested, and the HTTP status returned
- Browser type and version, and operating system
- Referring URL, where your browser sends one
Purpose: delivering the website reliably, maintaining security, and detecting and defending against attacks and abuse.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is operating a secure and functioning website. We do not use this data to identify individual visitors or to build profiles.
Processor: the site is hosted on Cloudflare Pages, provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare also acts as a content delivery network and may set a strictly necessary security cookie (__cf_bm) to distinguish automated traffic from human visitors. Cloudflare is engaged as a processor under Article 28 GDPR.
3. Contact form and email
If you use the contact form, we process the data you enter: your name, email address, company name (optional), the topic you select, and the content of your message. If you email us directly, we process your email address and whatever your message contains.
Purpose: to answer your enquiry and, where relevant, to discuss and prepare a possible working relationship.
Legal basis: Article 6(1)(b) GDPR where your enquiry relates to a contract or to steps taken at your request before entering one; otherwise Article 6(1)(f) GDPR, our legitimate interest in responding to business enquiries addressed to us.
Is providing this data required? No. It is entirely voluntary and there is no statutory or contractual obligation to provide it. Without a name, an email address and a message, we cannot reply. That is the only consequence.
Processor: form submissions are transmitted through Formspree, Inc. (2093 Philadelphia Pike, Claymont, DE 19703, USA), which forwards them to our mailbox and stores them in our account. Formspree is engaged as a processor under Article 28 GDPR.
4. Fonts and third-party content
The Inter typeface used on this site is hosted on our own servers. It is not loaded from Google Fonts or any other external source, so no data about your visit is transmitted to Google or any third-party CDN when you view a page.
This website embeds no social media plugins, no analytics, no maps and no video embeds. The only third-party content is the consent banner described in section 5 and, if you accept it, the advertising pixel described in section 6.
5. Cookies and consent
When you first visit, a banner asks whether you accept cookies that are not strictly necessary. Declining is one click and has no effect on your use of the site: nothing is withheld, degraded or repeatedly re-asked.
Strictly necessary. Two cookies are set regardless of your choice, because the site cannot work without them:
CookieConsent, set by our consent manager to remember what you chose, so you are not asked on every page. Without it we would have no record of your decision. Stored for up to 12 months.__cf_bm, which our host may set to distinguish automated traffic from human visitors, as described in section 2.
These fall under the exemption in Article 5(3) of the ePrivacy Directive and do not require consent.
Marketing. Nothing else is placed on your device unless you accept. If you decline, no advertising pixel loads, no identifier is created, and no request is made to any advertising network.
Processor: the consent banner is provided by Cybot A/S (Havnegade 39, 1058 Copenhagen, Denmark), trading as Cookiebot, engaged as a processor under Article 28 GDPR and operating within the European Union.
Changing your mind: you can withdraw or change your consent at any time by reopening the banner from the link in the footer, or by clearing this site's cookies in your browser. Withdrawal is as easy as consent was, and does not affect the lawfulness of anything done beforehand.
6. Advertising measurement, only with your consent
If, and only if, you accept marketing cookies, this site loads an advertising pixel provided by OpenAI, used to measure whether our advertising leads to enquiries.
What it does: it records that a page was viewed and, if you submit the contact form successfully, that an enquiry was created. It sets an identifier on your device so that a click on one of our adverts and a later enquiry can be connected.
Automatic matching: the pixel also has automatic advanced matching enabled. When you submit the contact form it reads the fields you filled in, such as your email address and, where present, your name, phone number or location, converts each into an irreversible SHA-256 hash inside your browser, and sends only those hashes. The readable values are never transmitted, and the hashes exist so OpenAI can match your enquiry to an earlier advert click without either party exchanging your details in the clear. A hash is still personal data under the GDPR, which is why it is described here and why none of it happens without your consent. It never receives the contents of your message.
Legal basis: Article 6(1)(a) GDPR, your consent, together with Article 5(3) of the ePrivacy Directive. There is no legitimate interest fallback for advertising measurement, so if you decline it simply does not run.
Recipient: OpenAI, OpCo, LLC (1455 3rd Street, San Francisco, CA 94158, USA).
Transfers: this involves a transfer to the United States. Such transfers take place on the basis of appropriate safeguards under Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–U.S. Data Privacy Framework. You may request a copy of the relevant safeguards from us.
Retention: as set by OpenAI for advertising measurement. We do not store this data ourselves and have no separate copy of it.
7. Transfers outside the EEA
Cloudflare and Formspree are established in the United States, so personal data may be processed outside the European Economic Area. Such transfers take place on the basis of appropriate safeguards under Chapter V GDPR, the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–U.S. Data Privacy Framework.
You may request a copy of the relevant safeguards from us at the address in section 1.
8. How long we keep data
- Server logs: retained only for as long as needed for security and diagnostics, and deleted or anonymised thereafter.
- Enquiries that do not lead to a business relationship: deleted no later than 24 months after our last contact with you.
- Enquiries that do lead to a business relationship: retained for the duration of that relationship and afterwards for as long as Spanish commercial and tax law requires records to be kept.
We delete data earlier if you ask us to and no retention obligation prevents it.
9. Your rights
Under the GDPR you have the right to:
- Access (Art. 15), obtain confirmation of whether we process your data, and a copy of it
- Rectification (Art. 16), have inaccurate or incomplete data corrected
- Erasure (Art. 17), have your data deleted where the conditions are met
- Restriction (Art. 18), have processing limited in certain circumstances
- Data portability (Art. 20), receive your data in a structured, machine-readable format
- Object (Art. 21), object at any time, on grounds relating to your particular situation, to processing based on legitimate interests
- Withdraw consent (Art. 7(3)), where processing rests on consent, withdraw it at any time, without affecting the lawfulness of processing carried out beforehand
To exercise any of these, write to contact@thomaseccel.com. We respond within one month, as required by Article 12(3) GDPR.
10. Right to complain
If you believe we are processing your data unlawfully, you can lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work, or where you believe the infringement occurred.
Our lead supervisory authority is the Spanish data protection authority:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
www.aepd.es
11. Automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR.
12. Data security
This site is served exclusively over an encrypted HTTPS connection. Data you submit through the contact form is transmitted encrypted in transit.
13. Changes to this policy
We may update this policy to reflect changes to the website or to legal requirements. The date at the top shows when it was last revised.