Privacy policy

Data controller

The controller for the personal data collected through plutontech.es is Víctor Gutiérrez Cobos, Spanish tax ID (NIF) 54490666-D, domiciled in Colmenar Viejo, Madrid, Spain, trading as Pluton Technologies (hereinafter, "Pluton").

For any request related to this policy, or to exercise the rights described below, you may write to hola@plutontech.es or call +34 624 176 109.

What data is processed

Browsing data: when you visit plutontech.es, the server automatically records the IP address, browser user-agent, requested URL and referring page (referrer). This is standard technical information required for the security and diagnostics of the service.

Form data: when you fill in the contact form, a demo request or a sales enquiry, the data you provide is processed — name, email, company, phone if given, and the content of your message — and stored in the internal CRM to manage the follow-up conversation.

Client data: if the business relationship is formalised, the data required to deliver the service and to issue invoices is also processed (identification of the company or professional, contact details and the financial data of the invoices issued). Billing is handled directly by Pluton; the site neither collects nor stores card payment data, nor does it use any third-party payment gateway.

Self-hosted analytics data, opt-in only: if you explicitly accept analytics in the cookie notice, aggregated usage events are recorded — page view, click on an element, form submission, scroll depth — together with the visited path, the referrer channel (UTM campaign or referrer) and the site variant shown. Your IP address, tracking cookies and device fingerprint are not recorded, and no event is recorded at all if your browser has the Do-Not-Track (DNT) signal enabled. On a purely technical and transient basis, the originating IP address is used to rate-limit abusive submission of these events; it is not stored alongside the event.

Cookie preference: the choice made in the cookie notice is stored in your browser's localStorage, not on the controller's servers.

Purpose and legal basis

Website operation and security (browsing data): legitimate interest of the controller in keeping the service running and secure. Art. 6.1.f GDPR.

Handling enquiries submitted via the form: consent given when the form is submitted. Art. 6.1.a GDPR, withdrawable at any time by writing to hola@plutontech.es.

Management of the client relationship, including billing: performance of the service agreement entered into (art. 6.1.b GDPR) and, in relation to the resulting accounting and tax obligations, compliance with a legal obligation (art. 6.1.c GDPR).

Self-hosted aggregate analytics: explicit consent given by choosing "accept all" in the cookie notice. Art. 6.1.a GDPR, withdrawable at any time by clearing your browser's localStorage or changing your choice on the cookie policy page.

Strictly necessary cookies: no consent required, under art. 22.2 of the Spanish LSSI.

How long data is kept

Messages received via forms and contacts who don't go on to formalise a business relationship: 24 months from the last interaction, after which they are deleted or anonymised.

Client data and contractual documentation: for the duration of the contractual relationship and, once it ends, for the retention periods required by applicable commercial and tax law (generally 6 years under art. 30 of the Spanish Commercial Code).

Web server technical logs: 30 days.

Self-hosted analytics events: at most the 5,000 most recent events are kept; once that volume is exceeded, the oldest events are automatically discarded.

Cookie preference: stays in your browser until you clear it.

Data sharing and sub-processors

Pluton does not sell personal data or share it with third parties for commercial purposes.

The site runs on self-hosted, self-managed infrastructure: messages, CRM data, technical logs and analytics events are not transmitted to external SaaS providers for analytics, marketing or CRM. No Google Analytics, Meta Pixel, HubSpot, Salesforce or equivalent service is used.

The only third parties involved are those strictly necessary for the technical operation of the infrastructure: a hosting provider for the physical server, located in the European Union, which does not access the site's content and only provides the physical and network infrastructure; and a DNS resolution provider for the domain, located outside the European Economic Area, whose involvement is limited to standard DNS queries, with no access to HTTP traffic, cookies or the site's content.

Both are bound by a GDPR-compatible Data Processing Agreement (DPA) and, for the DNS provider, the international transfer is covered by legal safeguards (Standard Contractual Clauses or adherence to the EU-US Data Privacy Framework). If a new provider with access to personal data is added in the future, this policy will be updated before it goes into operation. The specific identity of these providers can be requested by writing to the contact address given at the start of this policy.

Data subject rights

You can exercise the rights of access, rectification, erasure, restriction of processing, portability and objection recognised by the GDPR by writing to hola@plutontech.es. Your request will be handled within the legally established timeframe.

If you believe the processing of your data does not comply with applicable regulations, you can lodge a complaint with the Spanish Data Protection Authority, the Agencia Española de Protección de Datos (www.aepd.es).

Changes to this policy

Any material change to this policy will be reflected by updating the date shown at the top of this document and, where appropriate, communicated through reasonable channels (a notice on the site or an email if you've previously interacted with us).