Legal

Privacy policy.

What personal data we process, why, on what legal basis and for how long. Each processing activity has its own section. If we have called or emailed you to offer our services, yours is number 04.

Who the controller is

Controller: RUBRO
Email: contacto@rubrosolutions.com
Phone: +34 663 711 544
Data protection officer: None: this activity is not one of those listed in art. 37.1 GDPR, nor in art. 34 of Spanish Organic Law 3/2018.

Processing 01

Booking the 20-minute call

What data: Your name and email address, which are needed to book; your phone number and the topic of the call, if you give them; the day and time you chose, and the language of the page. If you arrived through a personalised link of ours, the booking is linked to that link.
Purpose: To schedule and hold the call, confirm it and get back to you.
Legal basis: Steps taken at your request prior to entering into a contract (art. 6.1.b GDPR). Without a name and an email address we cannot give you a slot; the phone number and the topic are optional and only help us prepare the call. You can ask us to delete them at any time.
Recipients: Not disclosed to third parties. They are processed on our behalf, as processors, by our hosting, network and security, and email providers: each booking triggers an internal email notice. See “Providers and transfers” below.
Retention: 24 months from the call, or until you ask for erasure.

Processing 02

Messages by WhatsApp, email or phone

What data: By WhatsApp: your number, your profile name and the content of your messages. By email: your address and what you tell us. By phone: your number and any notes we take of the conversation.
Purpose: To answer you and, if you ask us to, prepare a proposal.
Legal basis: The pre-contractual steps you ask us to take (art. 6.1.b GDPR) or, if you are only making an enquiry, our legitimate interest in answering whoever writes to us (art. 6.1.f).
Recipients: Not disclosed to third parties. WhatsApp provides the messaging service and processes messages under its own terms; email passes through our email provider.
Retention: As long as needed to deal with your enquiry. If it leads to a project, for as long as the relationship lasts and the periods set by law.

Processing 03

Visits to this website and technical logs

What data: The technical data of every connection (IP address, date and time, page requested and browser), which the server and our network providers use to serve the website and protect it from abuse. We also count visits: the page, the language, the country, the domain you came from, the link identifier if you arrived through one of ours, whether you reach the contact part of the page, and a code derived from your IP address and the date.
That code: The visit count does not store the IP address but a truncated HMAC-SHA256 of IP and day, which stops the same visit being counted several times in one day. It changes every day, so it cannot follow you from one day to the next. It is pseudonymised data, not anonymous data. Neither your browser, nor any device fingerprint, nor the full address of the page you came from is stored.
Personalised links: If you arrive through a link we sent to your business, the visit is linked to that business in our commercial prospecting tool (processing 04), so we know whom to call first. If you book a call that same day, the visit is linked to your booking.
Legal basis: Legitimate interest (art. 6.1.f GDPR) in keeping the website secure and working, in knowing which content is of interest and in organising commercial follow-up. You can object at any time (see “Your rights”).
Retention: The visit count, 12 months. Technical connection data, only for as long as strictly needed to serve and protect the website.

Processing 04

Commercial prospecting

This is most likely the processing that brought you here, if you have had a call or an email from us.

Where the data comes from

From two public sources, and no others. You did not give it to us and we did not buy it from anyone. This is the information art. 14.2.f GDPR requires us to disclose.

Source 1 · OpenStreetMap

An open, publicly accessible geographic database under the ODbL licence, queried through its Overpass API within a 50 km radius around Alicante. From this source we keep what it publishes: the licence allows that and requires us to credit it, which is what we are doing here.

Source 2 · Google Maps / Places

A smaller area, 30 km, queried through the Google Places API. The regime here is far narrower: we only keep the identifier Google assigns to the place and its coordinates, and the coordinates are deleted after 30 calendar days.

One precision: that deletion is not automated yet. It runs by hand and whenever a new ingest is launched, and we are adding a daily timer. Since the September 2026 census the database does hold records from this source, so the 30-day limit is a live promise that is kept by hand today.

The name, the address, the phone number and the website are never stored: we ask Google for them each time the record is opened and discard them when it is closed. Storing them would breach Google’s terms; the effect for you is that from this source we hold less of your data, not more.

What data

If your record comes from OpenStreetMap: the trading name of the business, its address and coordinates, phone number, website and email address where OpenStreetMap publishes them, and the line of business. If it comes from Google Places: only the identifier, the coordinates for 30 calendar days and the line of business. In both cases, plus data we generate ourselves: contact status, sales notes, a history of calls and of visits to this website through a personalised link, and a service proposal drafted with a language model.

Use of a language model

What the model receives depends on whether we are working in bulk or on your record in particular.

In bulk — the way most of the database was prepared, and the way an email is drafted — it receives seven items and nothing else: the sector, the estimated size, the scope (whether the business sells to companies or to consumers), whether a website is on record, whether a phone number is on record, which gaps we have observed and how many kilometres you are from the centre of the area. For the website and the phone, a yes or a no travels, never the item itself. Nothing that points at you travels: not the name, the address, the email or your coordinates.

With your record open — when preparing the opening line of a call or pressing “Analyse this business” — it also receives the trading name, the town, the opening hours we have on record, how many businesses in our own database are within 300 metres of yours, whether an email address is on record, and what Google publishes about your premises: the type of business, its description, the rating, the number of reviews, the hours, whether it is still open and whether a phone number and a website are on file. For the email, the phone and the website, a yes or a no travels, never the item itself; the exact address and the coordinates do not travel either. A trading name next to a town can point at you if the business is yours and trades under your own name. For one day this page said the name never travelled, which was not true of this second case; corrected on 27 August 2026.

In both cases the distance is rounded to the whole kilometre: a band around a fixed point that thousands of businesses fit inside, so it cannot be used to locate yours. A person reviews what the model returns before it is used. There is no automated decision-making with legal or similarly significant effects (art. 22 GDPR).

Purpose

To offer you our software development services and to follow up on that contact.

Legal basis

Legitimate interest (art. 6.1.f GDPR) in business-to-business commercial prospecting, read together with art. 19 of Spanish Organic Law 3/2018, which presumes that basis covers the processing of contact data of sole traders and professionals when it relates only to their professional activity. We have documented the balancing of that interest against your rights and can send it to you on request.

About email

Commercial communications by email also require the recipient’s prior request or authorisation (art. 21 of Spanish Law 34/2002). That is why our first contact is by phone or in person, and we only email people who have asked us to.

Recipients

We do not sell or disclose this database to anyone. There are three caveats you should know about:

When we open a record that came from Google Maps, we ask Google for the details of that establishment at that moment, so Google receives the query. Google already holds that data — it is the source — but we would rather say so than write “none”.

When we work on your open record, the trading name and the town travel to Anthropic, who provide the language model as a processor (art. 28 GDPR): it handles that data only to return the text to us, under a processing agreement that includes the European Commission’s Standard Contractual Clauses, and does not use it for purposes of its own.

Our mailbox is Google Workspace: if we write to you — only if you asked us to — that email passes through their servers.

Transfers outside the EU

The prospecting tool’s database sits on our own server and nothing leaves it. The send to the language model goes to Anthropic, PBC, a US company: it is a transfer to the United States covered by the processing agreement, which incorporates the European Commission’s Standard Contractual Clauses, controller-to-processor module, governed by Irish law and courts (arts. 44 ff. and 46.2.c GDPR).

Queries to Google Maps also travel to the infrastructure of a US company. What is sent is a query — some coordinates, or the identifier Google itself assigned — not an extract of our database, and it is governed by the Google Cloud Platform terms on data processing and international transfers. We provide the specific contractual details to anyone who asks at contacto@rubrosolutions.com.

Retention

12 months from the last meaningful contact. If you ask to be removed, we delete the record and keep only your email address or phone number on a suppression list, for the sole purpose of never contacting you again (art. 21.3 GDPR).

Providers and transfers

Providers: For bookings, messages and visits we work with hosting, network and security, email and messaging providers. They process data on our behalf and only to provide their service to us. We do not sell or disclose personal data.
International transfers: If any of those providers processes data outside the European Economic Area, it does so with appropriate safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses. Those of processing 04 are set out in its own section.
Backups: Server backups are kept for 30 days: whatever we delete is gone from them within that period.

Cookies and storage on your device

Cookies: We use no cookies, neither our own nor third-party ones.
Local storage: If you choose the red version of the website, your browser saves that choice in its local storage (key “rubro:tema”) to remember it on your next visit. It is only written when you press the switch, it never leaves your device and it is used for nothing else. It is strictly necessary to give you what you ask for (art. 22.2 of Spanish Law 34/2002), so it needs no consent. You can delete it in your browser settings.

Your rights

Which ones: Access, rectification, erasure, objection, restriction of processing and portability. You can exercise them at contacto@rubrosolutions.com, free of charge and without having to justify anything. We answer within one month at the most.
Objection: You can object at any time to the processing based on our legitimate interest: the visit count (03) and commercial prospecting (04). To prospecting, without giving reasons: we stop (art. 21 GDPR).
Opting out: To stop receiving commercial communications, just reply BAJA to any email of ours or write to baja@rubrosolutions.com. We apply it the same day.
Complaints: If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.