Privacy policy
Last updated: 30 September 2026. This is a courtesy translation; in case of discrepancy, the Spanish version prevails.
In short: if you write to us, we use your details to review your case and reply. We do not sell or share them, and we do not add you to any mailing list.
1. Data controller
Owner: Luca Sanz Álvarez, trading as Devincta
NIF: 44444859G
Registered address: Castilla y León (España)
Email: devinctaconsultory@gmail.com
Website: devincta.com
2. Data we process
- Form data: name, contact email, company or website, description of your case and estimated investment range.
- Technical data: the page you write from, referring site and campaign parameters (UTM) if any, browser type and an irreversible fingerprint of your IP address computed with a secret key (the IP address itself is not stored). Used to understand where contacts come from and to prevent mass submissions.
- Correspondence: the emails we exchange with you following your request.
Please do not include special categories of data (health, beliefs, etc.) or third-party data without their consent.
3. Purposes and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Reviewing your request, replying and, where appropriate, scheduling a first conversation and preparing a proposal. | Steps taken at your request prior to entering into a contract (art. 6(1)(b)). For non-commercial enquiries, our legitimate interest in replying (art. 6(1)(f)). |
| Protecting the form against spam and abuse. | Legitimate interest in website security (art. 6(1)(f)). |
We do not make automated decisions or create profiles. We will not send you marketing communications unless you expressly ask for them.
4. Retention
Requests that do not lead to a project are automatically deleted 12 months after receipt. If we work together, the data becomes part of the contractual relationship and is kept for its duration and thereafter for the periods required by law (for example, tax and commercial law).
5. Recipients and processors
We do not share your data with third parties unless legally required. To provide the service we use the following providers, acting as processors under agreements compliant with article 28 GDPR:
| Provider | Service | Location and safeguards |
|---|---|---|
| Vercel Inc. | Website hosting and form delivery. | Global network, headquartered in the US. EU-US Data Privacy Framework and Standard Contractual Clauses. |
| Supabase Inc. | Database in which requests are recorded. | Servers in the European Union (Ireland). Standard Contractual Clauses for any access from outside the EU. |
| Google Ireland Ltd. | Email service through which we are notified of each request. | EU, with possible access from the US. EU-US Data Privacy Framework and Standard Contractual Clauses. |
6. International transfers
Some of these providers are based in the US. Transfers rely on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or, otherwise, on the Standard Contractual Clauses approved by the European Commission.
7. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to devinctaconsultory@gmail.com and stating the right you wish to exercise. We will reply within one month and will only ask you to verify your identity where there is reasonable doubt.
If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.
8. Minors
This website is aimed at professionals and businesses. Persons under 14 must not submit data through the form.
9. Security
We apply technical and organisational measures appropriate to the risk: the website is served exclusively over an encrypted connection (HTTPS), the form stores nothing on your device, the database is not publicly accessible and access to requests is restricted. We only ask for the data needed to reply.
10. Changes to this policy
If anything relevant changes, we will update this page and the date shown above.