1. Data controller
| Corporate name | Summum Civitas S.L. |
| Tax ID (CIF/NIF) | B-47762893 |
| Address | Calle Fray Luis de León, 3 · 1ºB, 47002 Valladolid, Spain |
| Contact | sistemas@gruposummum.es |
2. Data we collect
Through the contact form we collect the data you voluntarily provide:
- Full name.
- Email address.
- Contact phone number (optional).
- Company or organisation (optional).
- Content of the message.
Together with your message we record the origin of the visit (campaign parameters, landing page and referring website), so we know through which channel you reached us.
We collect browsing data in aggregate form through Google Analytics 4, and only if you accept analytics cookies. If you reject them, only the web server's technical logs remain (source IP, user agent), kept for the minimum time necessary for the security of the service. The details are in our cookie policy.
3. Purpose and legal basis of the processing
| Purpose | Legal basis | Retention period |
|---|---|---|
| Responding to your query sent through the contact form | Express consent of the data subject (art. 6.1.a GDPR) | Until the query is resolved and, thereafter, the time necessary to address possible legal liabilities (max. 3 years) |
4. Recipients and disclosures
Summum Civitas S.L. does not transfer or disclose your personal data to third parties, except where legally required or requested by a competent authority.
To provide the service we rely on providers that process data on our behalf, as data processors and only on our instructions:
- Hetzner Online GmbH (Germany): hosting of the website and the contact form.
- Resend (Plus Five Five, Inc., United States), with Amazon Web Services, Inc. as sub-processor: delivery of the site's automated emails (the contact-form notification to our mailbox and the aid-alerts radar emails you request: subscription confirmation, aid alerts and unsubscribe confirmation) and of our replies from @gruposummum.es addresses.
- Google: Google Cloud EMEA Limited (Ireland) for the Google Workspace mailbox where we receive and handle your enquiry, and Google Ireland Limited (Ireland) for Google Analytics 4 (its cookies are only set if you accept them); in both cases with processing by Google LLC (United States).
- Cloudflare, Inc. (United States): forwarding the emails you send to @gruposummum.es addresses to our mailbox.
- Notion Labs, Inc. (United States): recording of the enquiries received in our commercial management tool.
International transfers. Resend, Amazon Web Services, Google LLC, Cloudflare and Notion Labs are located in the United States. These transfers rely on their participation in the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023) and, depending on the provider, also on the European Commission's standard contractual clauses included in their data processing agreements.
5. Your rights
You may exercise the following rights against Summum Civitas S.L. at any time:
- Access — find out what personal data we process about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion of your data.
- Objection — object to the processing under certain circumstances.
- Portability — receive your data in a structured format.
- Restriction — request the restriction of processing.
To exercise these rights, send your request in writing to sistemas@gruposummum.es, indicating the right you wish to exercise and enclosing a copy of your identification document.
If you consider that the processing does not comply with the applicable regulations, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es).
6. Security
Summum Civitas S.L. applies appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss or destruction, in accordance with the GDPR.
Communications between your browser and the website are encrypted using HTTPS (TLS 1.2+).
7. Changes to this policy
Summum Civitas S.L. may update this privacy policy to adapt it to legal or service changes. We recommend that you review it periodically. The date of the last update appears at the top of this document.
8. Aid alerts radar
If you subscribe to the "Aid alerts radar" from ayudas.html to receive email notifications about new grant and subsidy opportunities, this is an additional processing activity, independent from the contact form described in the sections above.
| Purpose | Legal basis | Retention period |
|---|---|---|
| Sending you email alerts about new grant opportunities matching the province and topics you choose | Express consent of the data subject (art. 6.1.a GDPR), given through double opt-in (sign-up email + confirmation click) and revocable at any time | Until you unsubscribe; the fact of unsubscribing is kept as a record of the erasure, to evidence the exercise of the right |
Data processed: email address, province and topics of interest that you select in the form. We do not request your name or any other data, and the IP address used to subscribe is not retained (data minimisation, art. 5.1.c GDPR).
Recipient / processor: these emails are sent through Resend (Plus Five Five, Inc., United States), the data processor described in section 4. The international transfer relies on its participation in the EU-U.S. Data Privacy Framework and on the standard contractual clauses incorporated into its Data Processing Addendum (DPA) (resend.com/legal/dpa). Resend acts as a data processor and only processes your data to deliver the email, following our instructions.
Your rights: you may exercise the same rights of access, rectification, erasure, objection, portability and restriction described in section 5, by writing to sistemas@gruposummum.es.
One-click unsubscribe: every alert email includes an unsubscribe link that requires no login or further confirmation; using it removes your subscription immediately and you will stop receiving alerts.