Legal
Privacy policy
This policy covers the personal data Tresora processes through this website. Personal data held inside the platform belongs to the customer whose data it is, and is governed by the agreement signed with that customer rather than by this page.
On this page
- 01Who this policy is from
- 02This website, and the platform
- 03What this website collects
- 04Why, and on what basis
- 05Who else receives it
- 06Your rights, and how to use them
- 07When this changes
Controller
Who this policy is from
Tresora Web S.L. publishes this website and decides what is processed through it, which makes Tresora Web S.L. the controller of that data.
Correspondence
Tresora Web S.L.Plaza Carlos Trías Bertrán, 428020 Madrid, SpainTax ID (NIF): B05684311Where we work
- Austin, Texas
- Madrid, Spain
Anything about personal data can be sent to that address in writing. Anything that wants an answer rather than a record is faster through the contact page.
There is one mailbox for this and it is answered by a person. A request does not have to be phrased as a legal one to be treated as one.
Two roles
This website, and the platform
Two different things happen under one name, and they are governed separately.
On this website Tresora is the controller: it decides what is collected here and what for, and this policy is the whole of it.
Inside the platform the roles are the other way around. The customer is the controller of their own data and Tresora is the processor, acting on that customer’s documented instructions under a signed agreement. The data processing page describes how that works.
Collection
What this website collects
Four things, and the list is complete.
- What your browser sends to ask for a page
- The address it came from, the page requested, the time, and the description the browser gives of itself. Serving a page requires it, and a web server ordinarily writes it to a log.
- Whatever you write to us
- If you send a message, we have the message, the address it came from, and anything you chose to put in it. Please leave out anything you would not want kept in an inbox.
- The language you chose
- One first-party cookie, so the site keeps speaking the language you picked. It holds a language code and nothing that identifies you.
- The theme you chose
- Light or dark, kept by your own browser on your own device. It is never sent to us and we never see it.
Purpose and basis
Why, and on what basis
Three purposes, and nothing beyond them: to serve the site, to keep it standing up and free of abuse, and to answer people who write to us.
Where the General Data Protection Regulation asks for a legal basis, running and defending the site rests on our own legitimate interest in publishing it; answering your message rests on the steps taken at your request before any contract; and anything a law obliges us to keep rests on that obligation.
Measurement with cookies rests on your consent. The cookieless page count taken before you answer rests on our legitimate interest in knowing which pages are read, and it stops the moment you refuse.
Personal data collected here is not sold, rented, or handed to anybody for their own marketing. There is no arrangement under which that could happen.
Recipients
Who else receives it
The company that runs the machines, and the one that counts the visits.
This site and the platform behind it run on OVHcloud, a European provider operating its own data centers in France. It supplies the compute, the storage and the backups, which means it holds data at rest even though it has no reason to look at any of it. That relationship is governed by a written processing agreement.
Until you answer the cookie notice, this website sends Google Analytics a cookieless record of which page was opened, the referring page, roughly which country the request came from (derived from the IP address), and basic browser details, with no cookie and no identifier. If you accept measurement, the record also carries an identifier held in the analytics cookie. We read it to see which pages are used and which are ignored. It is not joined to any account, it never carries anything you typed into a form, and if you refuse nothing more is sent — which you can do at any time from the link in the footer.
That is also the one place data covered by this policy can leave Europe: Google is a US company, and analytics data can be processed outside the European Union under standard contractual clauses and the EU–US Data Privacy Framework. It stops if you refuse measurement, and it applies to this public website alone.
The complete list
- Who
- OVHcloud
- What they do
- Hosting, storage and backup
- Where
- France, European Union
- Set when
- Always — it is the infrastructure
- Who
- Google Analytics
- What they do
- Aggregate measurement of this website
- Where
- Ireland, with transfers to the United States
- Set when
- Without cookies until you answer; with cookies only after you accept; never after you refuse
Your rights
Your rights, and how to use them
Under the General Data Protection Regulation you can ask what personal data we hold about you and do something about the answer.
- Ask what we hold, and get a copy of it.
- Have what is wrong corrected, and what is missing completed.
- Have it deleted, where nothing obliges us to keep it.
- Restrict or object to what we do with it, including anything resting on our legitimate interest.
- Take it elsewhere, in a structured and machine-readable form.
Write to the address above and say which of those you want. We may ask you to establish that the data is yours before acting on the request, because handing somebody else’s data to a confident stranger is the failure this step exists to prevent.
If the answer does not satisfy you, you can complain to the data protection authority competent where you live.
Versions
When this changes
The version published here is the one that applies.
When it changes, this page changes. A change that alters what happens to personal data is described on the page in plain words rather than absorbed quietly into a paragraph.
If something here is inaccurate, tell us. Correcting it is faster than any disclaimer and it is the outcome we would rather have.
The rest of it, written down