Skip to content
iNTERVOLUTIONS
ES EN
Legal

Privacy policy

Last updated:

In short

  • We only collect data when you write to us: a form, a subscription or a job application.
  • We do not sell or share your data with anyone, and there is no advertising or third-party tracking on this site.
  • The analytics are ours, use no cookies, don't store your IP address — and don't run until you say yes.
  • Everything we keep has an expiry date, and deletion is automatic.
  • You can ask us to show, correct or delete what is yours by sending one email. No forms, no paperwork.

Who handles your data

The controller is Tombatossals Softworks LLC, the company that owns intervolutions.com.

Operations are carried out from our European engineering office in Av. Vicente Sos Baynat s/n, 12071 Castellón de la Plana, Spain.

The company is incorporated in Illinois, United States, which means part of our team may access this data from outside the European Economic Area. We set this out below, under international transfers.

For anything concerning your data: [email protected]

What we collect, why, and on what legal basis

Five distinct processing activities, each with its own data, purpose and legal basis. There are no others.

When What data What for Legal basis How long
Contact form Name, email, service of interest, rough timing and your message. We automatically add your IP address, your browser, the date and where you came from (campaign or referring site). Reading your inquiry and replying. The IP and browser are used only to detect abuse of the form. Pre-contractual steps at your request (art. 6.1.b GDPR). For abuse control, our legitimate interest in not letting the form become a spam relay (art. 6.1.f). 24 months from our last contact
Quote request The same as the contact form, plus the project type, budget range and timeline you selected in the form. Preparing and sending you a proposal. Pre-contractual steps at your request (art. 6.1.b GDPR). 24 months from our last contact
Newsletter signup Your email address. Plus, as context, the page you signed up from, the language, the date and your IP address. Sending you the newsletter, at most once a month. Your consent (art. 6.1.a GDPR), which you can withdraw at any time. Until you unsubscribe
Job application Name, email, the role, your LinkedIn or portfolio if you provide them, your message and the résumé you attach (PDF, DOC or DOCX, up to 8 MB). Assessing your application for that role. Pre-contractual steps at your request (art. 6.1.b GDPR). 12 months from the date you apply
Browsing the site Pages viewed, how far you read, button clicks, form submissions, language, screen size, whether the device is mobile, and where you arrived from. Your IP is NOT stored: it is turned into an irreversible code with a random salt that differs every day. Understanding which content works and what breaks, so we can improve the site. Your consent (art. 6.1.a GDPR and art. 22.2 of the Spanish LSSI). We ask when you arrive, and nothing is stored or sent until you answer. You can change your mind at any time from the cookie policy. 14 months

What we don't do

  • We do not sell, rent or share your data with anyone for commercial purposes.
  • We do not build profiles or make automated decisions that affect you. A person reads everything.
  • We do not combine your browsing with other sites, because there is no third-party tracker on this one.
  • We neither ask for nor want sensitive data (health, beliefs, ethnicity, union membership). If you send it in a free-text message, we delete it.
  • The site is not aimed at children under 13 (14 in Spain) and we do not knowingly collect their data.

How long we keep it

The periods above are not an intention: they are written into the code and enforce themselves. These deletions are automatic:

  • Analytics events are deleted after 14 months.
  • Messages that could not be delivered because of a mail failure — which may include a résumé — are deleted from the server after 30 days.
  • The technical mail-delivery log is deleted after 90 days.

The emails that reach us through the forms live in our mailbox and we prune it periodically according to the periods in the table. If you want yours deleted sooner, say so and we will.

If we end up working together, the documentation of that relationship is kept for its duration and afterwards for as long as tax and commercial obligations require.

Who else sees your data

The full list, without euphemisms:

  • Google (Google Workspace / Gmail). Our corporate email. Everything you send through a form arrives and is stored there, attached résumés included. It acts as a data processor.
  • Our hosting provider. Serves the site and stores the technical files described above. It does not access the content except for maintenance.
  • Nobody else. We do not put your data into third-party platforms: no external CRM, no newsletter platform, no applicant tracking system, no outside analytics and no payment gateway. Fewer middlemen, less exposed surface. The only outside resource this site loads is Cloudflare Turnstile, and only on pages with a form: it checks that whoever is submitting is a person and not a program. It sets no cookies, does not profile you and never receives what you write — only the signal that the submission is legitimate.

In addition, we may have to disclose data to public authorities, courts or law enforcement where a legal rule requires it.

International transfers

Data is transferred to the United States, and we would rather say so plainly than bury it in a long sentence. It happens for two reasons: the company is incorporated in Illinois, United States, and our corporate email is Google's.

Google LLC participates in the EU-U.S. Data Privacy Framework, the European Commission adequacy decision that permits those transfers, and its processing terms additionally incorporate the Standard Contractual Clauses.

Within our own team, access is limited to the people who need the data to do their job: reply to your inquiry, prepare your proposal or assess your application.

Your rights

At any time, and free of charge, you can ask us for:

  • Access: to know what we hold about you and get a copy.
  • Rectification: to correct anything wrong or incomplete.
  • Erasure: to delete it, where it is no longer needed for what it was collected for.
  • Objection: to stop processing where we rely on legitimate interest, such as the anti-abuse checks on the forms.
  • Restriction: to keep it but stop using it while a disagreement is resolved.
  • Portability: to take what you gave us in a format you can reuse.
  • Withdrawing consent: where that is the basis, as with the newsletter or the site analytics. Withdrawing does not affect what was done before.

Just write to [email protected] saying what you want. No form is needed and you don't have to justify why. We reply within one month at the latest, and usually within two or three days. If we have a reasonable doubt about who is writing, we may ask for something that confirms it — only so we don't hand your data to someone else.

And if you think we've got it wrong, you can complain to the Spanish Data Protection Agency (www.aepd.es). If you're in the United States, you can also contact your state attorney general's consumer protection office. We'd appreciate hearing from you first, but you're under no obligation to do so.

U.S. residents

  • We don't collect biometric data, so the Illinois Biometric Information Privacy Act (BIPA) doesn't apply to anything on this site.
  • The rights above (access, correction, deletion) are available to you regardless of where you live, through the same email address.

How we protect it

  • The site is always served encrypted over HTTPS, and mail leaves over an encrypted connection with the certificate properly verified.
  • The directories where data is written sit outside what the web server serves and are blocked by configuration.
  • Résumés are not stored on the server: they are attached to the email and the temporary file disappears with the request. They only remain on disk if delivery fails, and in that case they delete themselves after 30 days.
  • We validate uploaded files by their actual content and not just their extension, and we rate-limit submissions to slow down automated attacks.
  • No system is infallible. If a breach ever occurs that poses a risk to you, we will tell you and notify the authority, as the law requires.

Cookies and measurement

This site uses no cookies. If you accept measurement, it stores a few values in your browser, all of them ours, and you can change your mind at any time. The full detail is in the cookie policy.

Changes to this policy

If what we do with your data changes, we update this page and the date above. If the change is significant and we have a way to reach you, we will tell you. We will not apply a substantially new purpose to data you already gave us without asking you first.

Contact

Any question about this policy, or about your data: [email protected].

See also: Legal notice · Cookie policy · Terms and conditions