1 Controller and contact details

The controller responsible for the processing described below is:

Afori Solutions S.L.U.

Plaça de Gal·la Placídia, 1, 3, 08006 Barcelona, Spain

Data protection contact: hallo@afori.com

Our external Data Protection Officer is AUDINNOVA, S.L. You can contact the DPO at DPO@2-CARE.ES or +34 973122795.

This policy applies to www.afori.com and its German and English information pages and contact channels. It explains how we process personal data when you use these functions or contact us. Processing through our platform is covered by the information provided there for the relevant activity. This policy does not contain a data processing agreement.

2 Accessing and operating the website

When you visit the website, our hosting provider Framer B.V., Netherlands, processes technical data required to make it available. This includes your IP address, date and time of access, page requested, referrer, browser type and version, and operating system. We use this data to provide the website, maintain its stability and security, and detect misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to provide and secure the website.

You can find information about cookies and other technologies in our Cookie Policy. Audience measurement is described in section 5.

3 Enquiries and discussions

When you contact us, we process your name, email address, company and the content of your enquiry to respond to it. Our website links to a contact form hosted externally at form.typeform.com by Typeform S.L., Spain. The form is opened on Typeform rather than embedded in our website. You can also contact us by email at hallo@afori.com.

If you act on behalf of a company, the necessary processing is based on Article 6(1)(f) GDPR. Our interest is to respond to your business enquiry and prepare or maintain our relationship with your company. For narrowly limited professional contact details, we take account of Article 19 of the Spanish Organic Law on Data Protection and Digital Rights (LOPDGDD). If you yourself are to become a party to a contract and processing is necessary to take steps at your request before entering into that contract, Article 6(1)(b) GDPR applies.

You are not legally or contractually required to provide data for a general enquiry. Fields necessary to submit the Typeform form are marked as required. Without these details you cannot submit that form. Without the contact details needed to respond, we cannot answer your enquiry.

We delete ordinary website enquiry data once it is no longer needed and, at the latest, 12 months after the enquiry is closed. An enquiry is closed when we have sent our final substantive response or documented that it has ended. If there is no further conversation, the period starts on receipt of the enquiry. The same rule applies to Typeform responses, enquiry emails, enquiry records in Attio and n8n, and relevant exports and copies. Unnecessary duplicates are removed earlier. This is a maximum period, not a minimum storage requirement.

Information needed for a resulting customer or contractual relationship is subject to the separate retention rules for that relationship. Records required to meet a statutory retention obligation or for a specific legal claim are kept separately, with access restricted, only for the applicable period. Where Article 32 LOPDGDD requires blocking following erasure, the data is reserved against ordinary access and use and may be made available only to the courts, public prosecutor or competent public authorities for liabilities arising from the processing, within the relevant limitation period. It is then destroyed.

Please do not send health data, copies of identity documents or documents relating to your insurance clients through general website contact channels. A separately agreed transmission channel is required for these purposes.

4 Recipients and transfers

We use Framer B.V. to host the website and process technical access data, Typeform S.L. to collect and provide contact form responses, and Google Cloud EMEA Limited (Ireland), our Google Workspace provider, to handle email correspondence. Contact form responses are also forwarded to Attio Ltd (United Kingdom), our customer relationship management provider, and processed through an n8n workflow automation instance that we operate on Amazon Web Services infrastructure in the eu-central-1 (Frankfurt, Germany) region. We use these systems to record and follow up enquiries. These providers process the relevant data on our behalf under the applicable data processing arrangements. For consent-based audience measurement we use Google Analytics 4, provided by Google Ireland Limited, as explained in section 5.

Framer states that its services use servers in the United States. Its published data processing addendum provides for adequacy decisions, including the EU-US Data Privacy Framework where the recipient is certified, or standard contractual clauses where no adequacy decision applies. Typeform's published data processing agreement permits support by affiliates in the United States and United Kingdom and provides contractual terms for onward transfers. Google LLC in the United States may also receive data. Transfers to certified US recipients may rely on the EU-US Data Privacy Framework, with standard contractual clauses used where applicable. Transfers to Attio Ltd in the United Kingdom are covered by the European Commission's adequacy decision for the United Kingdom. Attio's published data processing addendum also provides for onward transfers to sub-processors under adequacy decisions or appropriate safeguards, including standard contractual clauses. Our n8n instance is hosted in Frankfurt, Germany.

Information about the safeguards used, or a copy of them, is available through our data protection contact stated in section 1.

5 Audience measurement

Framer Analytics: We use Framer Analytics to measure website visits and provide aggregated statistics about page views, visitors, sources, pages, countries and devices. It does not set analytics cookies or create persistent identifiers. Framer describes calculating daily unique visitors by hashing the IP address and user agent with a secret that changes and is deleted each day. Technical information used for the statistics includes the requested page, referring page, browser, device type, operating system and country derived from the IP address. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to understand how the website is used in order to improve it.

Google Analytics 4: If you consent, we use Google Analytics 4, provided by Google Ireland Limited, to measure how visitors use the website. Google Tag Manager loads the measurement tag after your consent. Analytics processes device and browser information, pages visited and pseudonymous cookie identifiers to distinguish visitors and sessions. Google uses the IP address to derive approximate location information and states that GA4 does not log or store individual IP addresses. The legal basis is Article 6(1)(a) GDPR. The first-party cookies _ga and _ga_N4LQ800YEY are stored for 13 months. This device storage period is separate from the retention of analytics data on Google servers. Retention for the relevant user-level and event-level data is set to two months. Resetting the retention period on new activity is disabled. Google deletes expired data through its monthly deletion process. This setting does not determine the retention of standard aggregated reports. Google Ireland Limited and Google LLC may receive the analytics data. The applicable international transfers are described in section 4. You can withdraw consent through the selection interface described in the Cookie Policy.

6 Your rights

Subject to the applicable legal conditions, you have the right of access, rectification, erasure, restriction of processing and data portability. Data portability applies in particular to data you have provided that is processed by automated means on the basis of consent or a contract.

You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR. You may object to processing for direct marketing at any time.

You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal. Data will be erased where the legal conditions are met and no other legal basis or statutory exception permits its continued processing.

You can exercise your rights through our data protection contact or another appropriate contact channel. No particular form is required. Only where we have reasonable doubts about your identity may we request additional information, to the extent necessary to confirm it.

We generally respond to requests within one month of receipt. Where an extension is legally permitted, we inform you within that month of the extension and the reasons for it.

You may lodge a complaint with a competent data protection supervisory authority, in particular in the place of your habitual residence, place of work or the alleged infringement. The Spanish supervisory authority is the Agencia Española de Protección de Datos.

7 Changes

We update this information when the processing described changes. We inform you about additional purposes before the relevant processing begins and obtain consent where required.