Privacy policy

The short version

We collect very little. If you fill in our contact form we store your name, email, optional company and your message, so we can reply and keep track of the conversation. It reaches us by email and is recorded in HubSpot, our CRM. We do not use cookies, we do not track you across sites, we do not build advertising profiles, and we never sell or rent personal data.

The rest of this page is the detail the GDPR requires us to give you.

Who is responsible for your data

The controller is the entity identified in our legal notice. For any question about this policy, or to exercise any of the rights described below, write to hola@disruptivecats.com and we will answer within one month, as the GDPR requires. In practice, within a working day.

We have not appointed a Data Protection Officer, because the scale and nature of our processing does not require one under Article 37 GDPR.

What we collect, and why

Contact form. Name, email address, company (optional) and your message. We use this to reply to you, to assess whether we can help, and to keep a record of the enquiry. Legal basis: performance of, or steps preparatory to, a contract (Art. 6(1)(b) GDPR), and our legitimate interest in responding to business enquiries and keeping a coherent record of them (Art. 6(1)(f)).

Technical logs. Our hosting provider processes your IP address, browser user-agent, requested URL and timestamp in order to serve the page, filter abuse and keep the service secure. Legal basis: our legitimate interest in the security and integrity of the service (Art. 6(1)(f)).

Audience measurement. We use Cloudflare Web Analytics, which is cookieless and does not fingerprint visitors or track them between sites. It gives us aggregated counts (pages viewed, referrers, country, device class), not individual profiles. Legal basis: our legitimate interest in understanding whether our site works (Art. 6(1)(f)).

We do not ask for special category data and you should not send it to us through the contact form. We do not use personal data to train AI models.

Who else processes it

We keep the list short deliberately. Each of these acts as a processor under a data processing agreement:

• Cloudflare, Inc.: hosting, CDN, DDoS protection and cookieless analytics for this website. US-headquartered; processing relies on Standard Contractual Clauses and Cloudflare's EU data localisation commitments.
• Railway Corp.: infrastructure in its EU region (Amsterdam). It hosts the self-hosted CRM we used until September 2026, and enquiries received before then stay there until we move them to HubSpot or delete them. Railway is US-headquartered, so its own administrative access relies on Standard Contractual Clauses.
• Resend: transactional email delivery. It carries each enquiry from this website's form to our inbox. US-headquartered, under Standard Contractual Clauses.
• HubSpot, Inc.: our CRM. It receives your name, email, company and message, so we can reply and keep track of the conversation, and nothing else. HubSpot is US-headquartered; its processing is governed by its data processing agreement, and any transfer outside the European Economic Area relies on the European Commission's Standard Contractual Clauses.

International transfers

Four of the processors above (Cloudflare, Railway, Resend and HubSpot) are US-headquartered companies, which means personal data may be processed or accessed from outside the EEA for support and administration.

Those transfers are covered by the European Commission's Standard Contractual Clauses, supplemented where relevant by each provider's participation in the EU-US Data Privacy Framework and by technical measures including encryption in transit and at rest. You can ask us for details of the safeguards in place at any time.

How long we keep it

We do not keep data indefinitely just because storage is cheap.

• Enquiries that do not become an engagement: up to 24 months from your last contact, then deleted. We keep them this long because business conversations frequently restart.
• Enquiries that become a client relationship: for the duration of the relationship, then as required by Spanish commercial and tax law, generally six years for accounting records under the Código de Comercio, and four years for tax purposes.
• Technical logs: short retention periods set by our hosting provider, typically days.
• Analytics: aggregated only, and not linked to you.

Your rights

Under the GDPR you can ask us to:

• confirm whether we hold data about you, and give you a copy (access);
• correct anything inaccurate or incomplete (rectification);
• delete your data (erasure), where we have no overriding obligation to keep it;
• pause processing while a dispute is resolved (restriction);
• hand your data to you or another provider in a portable format (portability);
• stop processing based on legitimate interest (objection).

How to exercise them, and how to complain

Email hola@disruptivecats.com. We may need to confirm your identity before acting, but only to the extent necessary. Exercising these rights is free; we will not charge you or make it awkward.

If you think we have handled your data badly, please tell us first, because we would rather fix it. You also have the right to complain directly to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es, C/ Jorge Juan 6, 28001 Madrid), or to the supervisory authority where you live or work.

Security

Everything is served over TLS. Access to our CRM, and to the inbox that receives enquiries, is limited to the people who answer them. Secrets are held in our hosting provider's encrypted store and never committed to source control. The contact form is protected by validation and a honeypot rather than a third-party CAPTCHA, which avoids sending your data to an additional processor.

No system is perfectly secure. If we ever suffer a breach that is likely to result in a risk to your rights, we will notify the AEPD within 72 hours and tell you directly where the GDPR requires it.

Children

This site is aimed at businesses and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has sent us personal data, tell us and we will delete it.

Changes to this policy

If we change how we process personal data we will update this page and move the date at the top. Where a change materially affects you and we hold your contact details, we will tell you directly rather than relying on you noticing.