Privacy policy

Who's the data controller

Víctor Gutiérrez Cobos (Spanish tax ID 54490666-D), operating under the Pluton Technologies brand, is the controller for the data collected through plutontech.es.

For any request related to this policy you can write to hola@plutontech.es or call +34 624 176 109.

What data we process

When you visit plutontech.es, our web server automatically records the IP address, browser user-agent, requested URL and referrer. This is standard operational information kept for security and diagnostics.

When you fill in a form (contact, demo request or sales enquiry), we process the data you provide: name, email, company, phone if given, and the contents of your message. This is stored in our internal CRM to manage the follow-up conversation.

If you've given explicit consent for analytics, we record aggregated usage events (page view, CTA click, form submit) along with the visited path, the referrer channel (UTM campaign or referrer) and the assigned A/B variant. We don't record your IP address, tracking cookies or device fingerprint. If you've enabled the Do-Not-Track (DNT) signal in your browser, we don't record any event.

If you interact with the cookie banner, we store your choice in your browser's localStorage (not on our server). Clearing it in the browser is equivalent to withdrawing consent.

Why we process it and on what legal basis

Website operation (server logs): legitimate interest of the controller in keeping the service running and secure. Art. 6.1.f GDPR.

Reply to your enquiry (forms): consent given when you submit the form. Art. 6.1.a GDPR. You may withdraw it at any time by writing to us.

Self-hosted aggregate analytics (usage events): explicit consent given by choosing "accept all" in the cookie banner. Art. 6.1.a GDPR. You may withdraw it at any time by clearing localStorage or changing your choice.

Strictly necessary cookies: no consent required under Spanish LSSI art. 22.2.

How long we keep the data

Messages received via forms and CRM leads: 24 months after the last interaction with you, unless the business relationship requires longer retention. Deleted or anonymized afterwards.

Web server (nginx) logs: 30 days.

Self-hosted analytics events: 90 days in the operational store. Then aggregated to anonymous counters with no individual traceability.

Cookie preference: stays in your browser until you clear it.

Who we share it with (sub-processors)

We don't sell personal data. We don't share it with third parties for commercial purposes.

We run on self-hosted infrastructure: your message doesn't go through any external SaaS provider. The web server, database (PostgreSQL), email system and backups live in infrastructure controlled by Víctor Gutiérrez Cobos. We use no Google Analytics, Meta Pixel, HubSpot, Salesforce, SendGrid, Mailgun, Vercel or equivalents. The only sub-processors are those strictly required for that infrastructure to operate.

Each sub-processor is limited to the described service, bound by a GDPR-compatible Data Processing Agreement (DPA) and, where international transfer is involved, covered by legal safeguards (Standard Contractual Clauses or adherence to the EU-US Data Privacy Framework). If we add a new provider, we update this policy before bringing it into operation. The current list:

Your rights

You can exercise the rights of access, rectification, erasure, restriction, portability and objection set out in the GDPR by writing to hola@plutontech.es. We'll reply within the legal timeframe.

If you believe the processing doesn't comply with regulations, you can lodge a complaint with the Spanish Data Protection Authority (www.aepd.es).

Changes to this policy

If anything material changes, we'll update the date above and, where appropriate, let you know through reasonable channels (a banner on the site or an email if you've interacted with us).