Privacy Policy

Data controller

Xpecializa Consulting S.L. has not appointed a Data Protection Officer. The address dpo@xpecializa.com is used as a dedicated channel for privacy enquiries and the exercise of data protection rights.

Data processed

Depending on how users interact with Xpecializa, the following categories of data may be processed:

  • Name and email address provided when booking a meeting through Calendly.
  • Telephone number, name, message content and any other information voluntarily provided through WhatsApp.
  • Email address used to subscribe to the Radar.
  • Technical and browsing data collected through Google Analytics where the user has given consent.
  • Information required to respond to requests, manage professional relationships or comply with legal obligations.

Xpecializa does not request special categories of personal data through this website.

Meeting bookings

Data provided through Calendly will be processed to manage the request, arrange the meeting and send any necessary communications. The legal basis is taking steps at the data subject's request prior to entering into a contract and, where appropriate, consent.

WhatsApp communications

Data will be processed to respond to enquiries and maintain the communications requested by the user. The legal basis is consent and, where the enquiry concerns a potential engagement, taking pre-contractual steps.

Radar subscription

The email address will be processed to manage the subscription and send the Technology Consulting Radar periodically. The legal basis is the subscriber's consent. The subscription uses a confirmation process and can be cancelled at any time using the link included in every communication.

Website analytics

Where the user accepts analytics cookies, Google Analytics will be used to obtain aggregated statistics on website use, browsing and performance. The legal basis is consent, which can be withdrawn at any time through the cookie settings panel.

Compliance with legal obligations and defence of rights

Data may be processed to comply with legal obligations, respond to requests from authorities, or establish, exercise or defend legal claims. The legal bases are compliance with legal obligations and Xpecializa's legitimate interest in protecting its rights.

Voluntary provision of data

Using Calendly, WhatsApp and subscribing to the Radar is voluntary.

Users must provide accurate, up-to-date information concerning themselves. They must not provide third-party data unless authorised to do so.

Recipients and service providers

Personal data will not be sold or disclosed to third parties for commercial purposes.

Service providers acting for Xpecializa may have access to data, including:

  • Hostinger, as hosting provider.
  • Mailchimp, to manage Radar subscriptions and mailings.
  • Calendly, for meeting bookings.
  • Google Analytics, for consent-based website measurement.
  • CookieYes, to manage cookie preferences.
  • WhatsApp Ireland Limited, where the user chooses this channel.
  • Technology, legal, administrative or security providers required for the operation of the business.

These providers will process data in accordance with their terms, privacy policies and applicable data processing agreements.

Data may also be disclosed to public authorities, courts or tribunals where required by law.

International transfers

Some providers may process data outside the European Economic Area.

Where international transfers take place, they will rely on safeguards recognised by applicable law, such as adequacy decisions, standard contractual clauses approved by the European Commission or other legally valid mechanisms.

Further information is available in the privacy policies of Google, Mailchimp, Calendly, CookieYes and WhatsApp.

Retention

  • Calendly and WhatsApp: for up to two years from the last communication, unless a contractual relationship arises or longer retention is required to meet legal obligations or liabilities.
  • Radar: while the subscription remains active and until the data subject unsubscribes or withdraws consent.
  • Google Analytics: data associated with identifiers will be retained for no more than 14 months, without prejudice to aggregated data.
  • Contractual relationships: for their duration and subsequently for the applicable statutory periods.
  • Claims: for as long as required to manage them and while liabilities may arise.

Your rights

Data subjects may exercise the following rights:

  • Access.
  • Rectification.
  • Erasure.
  • Objection.
  • Restriction of processing.
  • Data portability.
  • Withdrawal of consent.

To exercise these rights, write to dpo@xpecializa.com, stating the right you wish to exercise and providing the information needed to verify your identity where appropriate.

Withdrawal of consent will not affect the lawfulness of processing carried out before it was withdrawn.

If you believe your data has not been processed correctly, you may lodge a complaint with the Spanish Data Protection Agency: https://www.aepd.es/.

Automated decision-making

Xpecializa does not make automated decisions or carry out profiling that produces legal effects or similarly significantly affects users.

Children

The services and content on this website are intended for professionals and businesses and are not specifically directed at children.

Security

Xpecializa applies reasonable technical and organisational measures to protect data against loss, unauthorised access, alteration or disclosure.

However, no system connected to the Internet can guarantee absolute security.

Using Calendly, WhatsApp, LinkedIn or other external services involves accessing platforms operated by third parties. Processing carried out by those platforms is governed by their own privacy policies.

Changes to this policy

This policy may be updated to reflect changes in law, technology or the processing activities carried out. The current version will remain available on the website.

Last updated: 19 August 2026.