Privacy policy

Version 2025-11 · Last updated: 18 November 2025

The Spanish version prevails.

This policy explains how we process the personal data you give us through the contact form on joywareteam.com, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Controller
Joyware Europe SL
NIF
B23988470
Registered office
Carrer Alfons, 43480 Vila-seca (Tarragona), Spain
Registry details
Registered with the Commercial Registry of Tarragona
Data Protection Officer
Not appointed

2. Data we process

When you submit the contact form we process:

  • Identification and contact data: name, country, contact language, email and/or phone.
  • Contact preferences: time zone and preferred time slot.
  • Details of your request: services and products you are interested in and the free text describing what you need.
  • Technical data: the page you sent the form from, date and time of submission, and a one-way hash of your IP address used only to prevent spam and abuse; we do not store the IP in clear.
  • Consent record: that you accepted this policy, the version accepted and when.

3. Information you should not include

We do not need special categories of data (health, beliefs, etc.) or data about third parties. Please do not include them in the free text; if they reach us, we will delete them.

4. What we use your data for

  • Replying to your request and contacting you by the channel, language and time slot you choose.
  • Preparing and sending proposals and, where applicable, managing the pre-contractual and commercial relationship.
  • Protecting the form against spam and fraudulent use.

We will not send you marketing communications or newsletters unless you consent to them separately. We do not make automated decisions or profiling with legal effects on you.

5. Legal basis

  • Steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) to handle the request and manage the commercial relationship.
  • Your consent (Art. 6(1)(a) GDPR), given by ticking the form checkbox, which you can withdraw at any time without affecting the lawfulness of prior processing.
  • Legitimate interest (Art. 6(1)(f) GDPR) in keeping the form secure (IP hash against spam).

6. Recipients and processors

Vercel Inc.
Hosting of the website and the CRM.
Supabase Inc.
CRM database, hosted in the European Union (Frankfurt, Germany).
Google (Google Workspace)
Sign-in of the Joyware team to the CRM. It does not receive the content of your request through the form.

We do not disclose your data to third parties unless legally required. These providers process it on our behalf under a data processing agreement (Art. 28 GDPR):

7. International transfers

Some providers are US companies or use sub-processors outside the European Economic Area. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified and/or on the Standard Contractual Clauses approved by the European Commission, with any supplementary safeguards required.

8. How long we keep it

If your request does not lead to a commercial relationship, we delete your data 12 months after the last contact.

If a relationship starts, we keep it for its duration and then blocked for the statutory limitation periods.

The consent record is kept for as long as needed to prove it.

9. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, by writing to info@joywareteam.com stating the right you exercise. We may ask you to prove your identity if there are reasonable doubts.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

10. Security

  • Encrypted connections (HTTPS) and data encrypted at rest in the database.
  • CRM access only for authorised Joyware staff, with corporate Google accounts and role-based permissions.
  • Audit log of changes to the data.
  • Anti-spam measures (honeypot field, minimum time, rate limits and IP hash) without third-party cookies.

11. Cookies and analytics

The form does not set first- or third-party cookies. Website analytics (Vercel Web Analytics and Speed Insights) uses no cookies or persistent identifiers and only runs if you accept it in the cookie notice. See the cookie policy for details.

12. Candidates: CVs

Joyware also receives CVs (résumés) through Salary Nice, a brand and business owned by Joyware Europe SL, for recruitment and to place professionals on client projects (staffing). The controller of this data is Joyware Europe SL, with the details in section 1.

  • Data we process: CV, work experience and education, contact details and salary expectations.
  • Purpose: recruitment and placement on client projects.

Legal basis: your consent when you send us your CV (Art. 6(1)(a) GDPR) and steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).

We only share your CV with a client if you give your explicit consent for that specific process. You can exercise your rights at info@joywareteam.com, as for the rest of this policy.

Retention: with your consent we keep your CV for up to 2 years for future processes; otherwise we delete it when the selection process ends.

13. Changes to this policy

If we change this policy we will publish the new version on this page with its date. If the change is significant and affects processing based on your consent, we will ask for it again.