Skip to main content
Legal information

Privacy policy

Courtesy translation. In case of discrepancy, the Spanish version prevails. Política de privacidad (versión en castellano) →

Privacy policy for https://trackia.es/ — last updated: May 29, 2026.

At CEDESA DIGITAL, S.L. (the “Controller”), we take seriously the privacy of the people who visit the trackia.es site and of the companies that subscribe to the Trackia service. This Privacy Policy explains what personal data we process, for what purpose, on what legal basis, to whom we disclose it and what rights you have.

1. Data controller

  • Company name: CEDESA DIGITAL, S.L.
  • NIF (Spanish tax ID): B06684369
  • Address: Campus Universitario, Avda. de la Investigación S/N, Edificio PCTEX Oficina 2.1 — 06006 — Badajoz (Spain)
  • Phone: (+34) 924 090 608
  • General email: contacto@cedesa.es
  • Email for privacy matters and rights requests: privacidad@cedesa.es

2. Data we process

Through the Website we may process the following categories of data:

  • Identification and contact data: first name, last name, company, job title, business email, phone, approximate fleet size, free-text message — when you fill in the demo request or contact form.
  • Browsing data: truncated IP address, device type, browser, operating system, pages viewed, time on site and interaction events — collected through Google Analytics 4 and Microsoft Clarity, only if you have given your express consent to analytics cookies.
  • Communications: the content of the emails you send us or of any calls you yourself ask us to make.

No special categories of data are collected (health, ideology, sexual orientation, biometric data, etc.). The Website is not intended for minors.

3. Purposes of processing and legal basis

a) Handling demo requests and sales inquiries

Responding to the demo request or sales inquiry you send through the Website’s forms, scheduling the call, preparing the demo and giving you a fixed quote.

Legal basis: the data subject’s explicit consent under Art. 6(1)(a) of the General Data Protection Regulation (GDPR), given by ticking the box accepting this policy and submitting the form; and the Controller’s legitimate interest in responding to a request from a potential customer (Art. 6(1)(f) GDPR).

b) Sending commercial communications about Trackia

Sending you product news, use cases or invitations to events related to the Trackia platform by email.

Legal basis: the data subject’s consent, when you specifically give it (Art. 6(1)(a) GDPR); or the Controller’s legitimate interest for communications to existing customers about products or services similar to those already contracted (GDPR Recital 47; art. 21.2 of the Spanish Information Society Services Act [LSSICE]), always with a free and simple way to opt out in every message.

c) Website usage analytics

Measuring traffic and aggregate visitor behavior to improve the Website’s content, navigation, conversion and technical performance.

Legal basis: the data subject’s consent, given through the cookie banner (Art. 6(1)(a) GDPR; art. 22.2 LSSICE). Until you accept, no analytics scripts are loaded and no analytics cookies are set.

4. Retention periods

  • Demo or contact form data: for as long as necessary to handle the request and, if it does not lead to a contractual relationship, for up to 24 months for sales follow-up purposes, unless you request erasure sooner.
  • Customer data: for as long as the contractual relationship lasts and, once it ends, for the applicable legal periods (tax, commercial).
  • Browsing data (analytics cookies): the periods indicated in the Cookie Policy (between 1 day and 2 years depending on the cookie). If you withdraw your consent, the data is no longer collected.
  • Emails: for as long as they are useful to maintain the relationship and handle possible claims, and at most for the applicable statutory limitation periods.

5. Data recipients

Your data is not disclosed to third parties, except where required by law. It is, however, processed by the following providers, acting as data processors, which provide technical services to the Controller:

  • Formspree, Inc. (United States) — technical handler for sending and receiving the Website’s forms. Policy: formspree.io/legal/privacy-policy .
  • Google Ireland Limited — Google Tag Manager, Google Analytics 4 and the reCAPTCHA anti-spam protection service for the contact form, with servers in the EU. There are international transfers to Google LLC in the U.S. Policy: policies.google.com/privacy .
  • Microsoft Ireland Operations Ltd. — Microsoft Clarity (heatmaps and aggregated recordings). There are international transfers to Microsoft Corporation in the U.S. Policy: privacy.microsoft.com .
  • Cloudflare, Inc. — CDN infrastructure and static hosting for the Website. Policy: cloudflare.com/privacypolicy .

6. International transfers

Google’s tools (GA4, GTM), Microsoft Clarity, Cloudflare and Formspree may involve international transfers of data to the United States. These transfers are covered by one of the following mechanisms provided for in Articles 44 et seq. of the GDPR:

  • The adequacy decision on the EU-U.S. framework (EU-US Data Privacy Framework), for providers that are certified under it.
  • Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical measures (encryption in transit and at rest, data segmentation).

7. Data subject rights

As a data subject, you may exercise the following rights at any time:

  • Access: find out what data of yours we process.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure (“right to be forgotten”): have us delete your data when it is no longer necessary.
  • Restriction: have us stop processing it in certain circumstances.
  • Objection: object to processing based on legitimate interest, including objecting to commercial communications.
  • Portability: receive your data in a structured, commonly used and machine-readable format.
  • Withdrawal of consent: withdraw a previously given consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
  • Not to be subject to automated decisions with legal effects: we do not apply automated profiling with legal effects to Website visitors.

To exercise these rights, send an email to privacidad@cedesa.es stating: (i) the right you wish to exercise, (ii) your full name, (iii) a copy of a document proving your identity, and (iv) an email or postal address where we can reply to you. You can also send your request by post to Campus Universitario, Avda. de la Investigación S/N, Edificio PCTEX Oficina 2.1 — 06006 — Badajoz (Spain).

We will respond to your request within a maximum of one month of receipt, which may be extended by two further months given the complexity or number of requests, in which case we will inform you in advance.

8. Right to lodge a complaint with the supervisory authority

If you believe that the processing of your data does not comply with the applicable regulations, or you have not obtained satisfaction when exercising your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es.

9. Security measures

The Controller has adopted the technical and organizational measures necessary to ensure the security of personal data and prevent its alteration, loss, or unauthorized processing or access, taking into account the state of the art, the nature of the data and the risks to which it is exposed (Art. 32 GDPR). These include, among others: end-to-end HTTPS encryption, role-based access control, encrypted backups and activity logs.

10. Changes to this policy

The Controller may amend this Privacy Policy to adapt it to changes in legislation, case law or business practices. Changes will be published on this same page with the “last updated” date. We recommend that you review it periodically.

Last updated: May 29, 2026.