Legal
Privacy policy
This policy covers the personal data Tresora processes through this website. Personal data held inside the platform belongs to the customer whose data it is, and is governed by the agreement signed with that customer rather than by this page.
On this page
- 01Who this policy is from
- 02This website, and the platform
- 03What this website collects
- 04Why, and on what basis
- 05Who else receives it
- 06Your rights, and how to use them
- 07When this changes
Controller
Who this policy is from
Tresora publishes this website and decides what is processed through it, which makes Tresora the controller of that data.
Correspondence
TresoraCalle Hermosilla, 48, 1º Dcha.28001 Madrid, SpainWhere we work
- Austin, Texas
- Madrid, Spain
Anything about personal data can be sent to that address in writing. Anything that wants an answer rather than a record is faster through the contact page.
There is one mailbox for this and it is answered by a person. A request does not have to be phrased as a legal one to be treated as one.
Two roles
This website, and the platform
Two different things happen under one name, and they are governed separately.
On this website Tresora is the controller: it decides what is collected here and what for, and this policy is the whole of it.
Inside the platform the roles are the other way around. The customer is the controller of their own data and Tresora is the processor, acting on that customer’s documented instructions under a signed agreement. The data processing page describes how that works.
Collection
What this website collects
Four things, and the list is complete.
- What your browser sends to ask for a page
- The address it came from, the page requested, the time, and the description the browser gives of itself. Serving a page requires it, and a web server ordinarily writes it to a log.
- Whatever you write to us
- If you send a message, we have the message, the address it came from, and anything you chose to put in it. Please leave out anything you would not want kept in an inbox.
- The language you chose
- One first-party cookie, so the site keeps speaking the language you picked. It holds a language code and nothing that identifies you.
- The theme you chose
- Light or dark, kept by your own browser on your own device. It is never sent to us and we never see it.
Purpose and basis
Why, and on what basis
Three purposes, and nothing beyond them: to serve the site, to keep it standing up and free of abuse, and to answer people who write to us.
Where the General Data Protection Regulation asks for a legal basis, running and defending the site rests on our own legitimate interest in publishing it; answering your message rests on the steps taken at your request before any contract; and anything a law obliges us to keep rests on that obligation.
Consent is not a basis this site relies on, because nothing here asks for it. That is a consequence of what is not on the site rather than a position we take on consent.
Personal data collected here is not sold, rented, or handed to anybody for their own marketing. There is no arrangement under which that could happen.
Recipients
Who else receives it
The company that runs the machines, and — only if you allow it — the one that counts the visits.
This site and the platform behind it run on OVHcloud, a European provider operating its own data centers in France. It supplies the compute, the storage and the backups, which means it holds data at rest even though it has no reason to look at any of it. That relationship is governed by a written processing agreement.
If you accept measurement on the cookie notice, this website sends Google Analytics a record of which pages were opened, roughly which country the request came from, and an identifier held in the analytics cookie. We read it to see which pages are used and which are ignored. It is not joined to any account, it never carries anything you typed into a form, and it is not set at all unless you say yes — which you can take back at any time from the link in the footer.
That is also the one place data covered by this policy can leave Europe: Google is a US company, and analytics data can be processed outside the European Union under standard contractual clauses and the EU–US Data Privacy Framework. It happens only with your consent, and it applies to this public website alone.
The complete list
- Who
- OVHcloud
- What they do
- Hosting, storage and backup
- Where
- France, European Union
- Set when
- Always — it is the infrastructure
- Who
- Google Analytics
- What they do
- Aggregate measurement of this website
- Where
- Ireland, with transfers to the United States
- Set when
- Only after you accept it
Your rights
Your rights, and how to use them
Under the General Data Protection Regulation you can ask what personal data we hold about you and do something about the answer.
- Ask what we hold, and get a copy of it.
- Have what is wrong corrected, and what is missing completed.
- Have it deleted, where nothing obliges us to keep it.
- Restrict or object to what we do with it, including anything resting on our legitimate interest.
- Take it elsewhere, in a structured and machine-readable form.
Write to the address above and say which of those you want. We may ask you to establish that the data is yours before acting on the request, because handing somebody else’s data to a confident stranger is the failure this step exists to prevent.
If the answer does not satisfy you, you can complain to the data protection authority competent where you live.
Versions
When this changes
The version published here is the one that applies.
When it changes, this page changes. A change that alters what happens to personal data is described on the page in plain words rather than absorbed quietly into a paragraph.
If something here is inaccurate, tell us. Correcting it is faster than any disclaimer and it is the outcome we would rather have.
The rest of it, written down