Privacy policy

This is a translation for your convenience. The Spanish text of this privacy policy is the authoritative one and prevails if the two differ.

In short

• We only process the data you send us in order to write to us, and the technical data needed to serve the site and protect the form.
• We use it to answer you. We do not advertise with it, sell it or build profiles.
• The site has no analytics, no user accounts and no database of its own.
• You can ask us at any time to tell you what we hold, to correct it or to delete it, and you can object to our processing it.

Who the controller is

The data controller is MD TECH ENGINEERING, S.L.U. Its tax ID, registered office, register entry, email address and phone number are in the block at the top of this page.

We have not appointed a data protection officer. For anything about your data, write to hello@mdtechengineering.com.

What data we process

What you give us in the contact form

Your name, your work email, your company if you give it, the topic you choose and the message you write. Also the language of the page you write from, and the record that you ticked the box saying you had read the data protection information.

Name, email and message are needed for us to answer you this way. Company is optional. You are not obliged to give us any data: if you would rather not use the form, you can reach us by email, on WhatsApp or by phone.

What the security check on the form generates

To confirm that a submission comes from a person and not from a bot, the form uses Cloudflare Turnstile. Turnstile processes your IP address and technical data about your browser and device. It only loads when you get close to the form.

What browsing generates

Like any web server, our hosting provider processes your IP address and the technical data of each request in order to serve you the pages and protect the site.

The logs of our sending function do not contain your name, your email or your message. They record the outcome of each submission, how long it took, the language and the chosen topic.

What you give us through other channels

If you email us, message us on WhatsApp or call us, we process your address or number, the name you show and what you tell us.

What we do not ask for

We do not ask for health data, beliefs or other special categories of data, or for other people’s data. Please do not include them in your message.

What we use it for, on what basis and for how long

Purpose	Data	Legal basis	Retention period
To answer your enquiry and, if you ask for it, prepare a proposal	The form data, or the data of the channel you choose	Legitimate interest (Article 6(1)(f) GDPR). If you ask for a proposal for yourself as a professional, steps taken at your request before a contract (Article 6(1)(b))	While the conversation lasts and then for at most two years after the last contact
To send you an email confirming that your message has arrived	Name and email	Legitimate interest (Article 6(1)(f))	We keep no copy. The delivery provider keeps its record for a limited period
To protect the form and the site against bots and abuse	IP address and technical data about the browser and device	Legitimate interest (Article 6(1)(f))	The limited period Cloudflare applies to its logs
To handle your rights requests and possible claims	The data in the request and what is needed to evidence it	Legal obligation (Article 6(1)(c))	The limitation periods of any liability that may arise

What our legitimate interest is

• Answering you: dealing with those who write to us and keeping up the professional relationship with the company you work for. Spanish law presumes that interest for professional contact details (Article 19 of Organic Law 3/2018).
• Confirming receipt: letting you know that your message has arrived and when we will reply. That email does not reproduce your message: it only confirms receipt and the next step.
• Security: stopping the form from being used to send spam or to attack the site.

We do not base any processing on your consent. The box on the form is not consent: it only records that you have seen the information.

What happens when the period ends

When we delete or rectify your data, the law requires us to keep it blocked during the limitation periods, available only to judges, prosecutors and the competent authorities (Article 32 of Organic Law 3/2018). After that it is destroyed.

If you become a client, the data of that relationship is governed by the contract and by the information we will give you with it.

Who receives your data

We do not sell your data or pass it to third parties for their own purposes. These providers receive it and process it on our behalf, as processors:

Provider	What it does	Where it processes the data, and the safeguard
Cloudflare, Inc. (United States)	Hosts the site, runs the function that receives the form and provides the Turnstile security check	On its worldwide network, which includes the United States. EU-US Data Privacy Framework and, failing that, standard contractual clauses
Resend, a service of Plus Five Five, Inc. (United States)	Delivers the email that tells us about your message, with its content, and the confirmation email you receive	In the United States. EU-US Data Privacy Framework and, failing that, standard contractual clauses
Hostinger (Hostinger International Ltd., Cyprus, or another company of its group under its terms of service)	Hosts the mailbox where we receive your message and from which we reply	In its data centres. Where processing leaves the European Economic Area, the standard contractual clauses of its data processing agreement apply

In addition:

• Cloudflare also uses Turnstile data, as a controller in its own right, to improve its bot detection. It explains this in its Turnstile privacy addendum.
• If you choose WhatsApp, the conversation takes place on that service, which in Europe is provided by WhatsApp Ireland Limited under its own terms and privacy policy. It is not a processor of ours.
• We may have to hand data to judges, courts or public authorities when a law requires it.

Transfers outside the European Economic Area

Cloudflare and Resend are United States companies, so your data may be processed there.

• Adequacy decision. The European Commission found the level of protection adequate for companies that take part in the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795). When we checked on 8 October 2026, Cloudflare, Inc. and Resend appeared as active participants on the official list.
• Standard contractual clauses. The data processing agreements of both providers also incorporate the standard clauses approved by the European Commission (Implementing Decision (EU) 2021/914), for cases the Framework does not cover.

You can read those safeguards in the Cloudflare agreement and the Resend agreement, or ask us for a copy.

Your rights

You can ask us for:

• Access: to know whether we process your data and to receive a copy.
• Rectification: to correct data that is inaccurate.
• Erasure: to have it deleted.
• Restriction: to have us stop using it while a request of yours is being resolved.
• Portability: to receive, in a commonly used format, the data you gave us, where the processing is based on pre-contractual steps or on a contract.

Right to object

You can object at any time, on grounds relating to your particular situation, to the processing that is based on our legitimate interest: answering your enquiry, sending you the confirmation and protecting the form. We will stop processing your data unless we have compelling legitimate grounds or need it to defend ourselves against a claim.

How to exercise them

Write to hello@mdtechengineering.com or to our postal address and say which right you want to exercise. It is free. We will only ask for more information if we have reasonable doubts about your identity. We will answer within one month, which the law allows to be extended by two further months if the request is complex; in that case we will tell you.

Complaining to the supervisory authority

If you believe we have not handled your data or your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of the European Union country where you live or work.

Automated decisions

We make no decisions based solely on automated processing that have legal effects on you or affect you in a similar way, and we build no profiles.

The security check on the form is automatic and can stop a submission. If that happens to you, write to us by email or on WhatsApp.

Minors

This site is aimed at companies and professionals. It is not intended for minors and we do not knowingly collect their data. If you believe a minor has sent us data, write to us and we will delete it.

If you received an email from us without having written to us

The confirmation email is sent to the address given in the form. If someone entered yours without your permission, tell us and we will delete the message and your address.

Cookies

This site sets no cookies of its own and loads no analytics or advertising. The detail is in the cookie policy.

Changes and version

If we change how we process data, we will update this page and its date.

Version 2, of 8 October 2026. The legal basis for answering enquiries changes from consent to legitimate interest, and the text adds the tables of purposes and providers, the detail on transfers, the right to object, the blocking of data and the sections on minors and automated decisions. It replaces the version of 7 October 2026.