Privacy Policy
1. Data controller
- Identity: [Razón social completa]
- Tax ID (CIF/NIF): [CIF]
- Address: [Domicilio completo], Barcelona, Spain
- Email: hola@plexum.cat
- Data Protection Officer (DPO): [Nombre DPD o 'No aplica — empresa sin obligación legal de DPD']
2. Data we collect
Plexum may collect the following categories of data:
- Contact data: name, email address, phone, company name — when the user completes the contact form or subscribes to communications.
- Navigation data: IP address, browser type, pages visited and session duration — collected automatically via technical cookies (see Cookie Policy).
- SaaS platform data: if the user registers for Plexum services (Clock, CRM), the terms and privacy policy of the relevant service contract apply.
3. Purposes and legal basis for processing
| Purpose | Legal basis |
|---|---|
| Responding to contact form enquiries | Legitimate interest (Art. 6(1)(f) GDPR) |
| Sending opt-in commercial communications | Consent (Art. 6(1)(a) GDPR) |
| Providing contracted SaaS service | Contract performance (Art. 6(1)(b) GDPR) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c) GDPR) |
4. Data retention
Data provided through the contact form will be retained for as long as there is a mutual interest in maintaining the processing purpose and, in any case, for the period during which legal liabilities may arise.
Data from SaaS platform users will be retained for the duration of the contract and, subsequently, for the legally required period (normally 5 years for commercial obligations).
5. Recipients and international transfers
Plexum does not transfer personal data to third parties for commercial purposes. Data may be shared with:
- Service providers (data processors): cloud infrastructure platforms, email tools, etc. — all under a data processing agreement and in compliance with GDPR.
- Cloud infrastructure: data is stored on servers located in the European Union (Supabase EU region).
- Legal obligations: when required by Spanish or European law.
6. Data subject rights
Users may exercise the following rights against the data controller:
- Access: obtain confirmation of whether their data is being processed and a copy thereof.
- Rectification: correct inaccurate data or complete incomplete data.
- Erasure (right to be forgotten): request deletion of their data when it is no longer needed.
- Restriction of processing: request that processing be restricted in certain circumstances.
- Portability: receive their data in a structured, commonly used format.
- Objection: object to processing based on legitimate interest.
- Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
To exercise these rights, write to hola@plexum.cat stating the right you wish to exercise and attaching a copy of your ID document.
If you are not satisfied with the response received, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).
7. Security measures
Plexum has implemented the necessary technical and organisational measures to ensure the security of personal data and prevent its alteration, loss, processing or unauthorised access. Data is stored with encryption in transit (TLS) and at rest. Access is limited to authorised personnel.
8. Amendments
Plexum reserves the right to amend this Privacy Policy to adapt it to legislative or case-law developments. Significant changes will be communicated to affected users.
Last updated: June 2026