Privacy policy

Last updated: 21 October 2026

This policy explains what personal data Dalflow processes, why, on what legal basis and how you can exercise your rights, in line with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on data protection (LOPDGDD).

Data controller

Controller: Armand Dalmau Pérez (Dalflow)
Tax ID (NIF): 46416781K
Address: Travessera de Dalt, 38, 08024 Barcelona, Spain
Email: [email protected]

No data protection officer has been appointed, as the activity does not require one (art. 37 GDPR). Any privacy question is handled at the same email address.

What data is processed and why

1. Contact by email or form

Data: what you send: name, email, company, job title, phone number if you give it, and the content of your message.
Purpose: to answer your enquiry and, if you ask, prepare a diagnosis or a proposal.
Legal basis: your consent when you get in touch (art. 6.1.a GDPR) and steps taken at your request before entering into a contract (art. 6.1.b GDPR).
Retention: as long as needed to handle your enquiry. If no business relationship follows, the data is deleted no later than 2 years after the last contact. If you become a client, it is kept for the duration of the relationship and then for the periods required by law (for example, 6 years for accounting and tax records).

2. Booking meetings with Google Calendar

Data: name, email, date and time of the meeting and any information you add when booking.
Purpose: to schedule the meeting, send you the invitation and reminders, and hold it.
Legal basis: steps taken at your request before entering into a contract (art. 6.1.b GDPR).
Retention: the event stays in the calendar for up to 2 years after the meeting, unless a business relationship follows.

3. Business emails to companies

Data: first name and surname, job title, work email, company and, where available, company phone number and website.
Source: publicly available sources intended for professional use, such as the company’s own website, professional profiles (for example, LinkedIn) and business directories.
Purpose: to send professionals, in their professional capacity, a small number of personalised emails presenting Dalflow services related to their company’s activity.
Legal basis: Dalflow’s legitimate interest in making its services known to businesses (art. 6.1.f and recital 47 GDPR). Emails are only sent to work addresses and about topics linked to the recipient’s role or company. This interest has been weighed against your rights: the messages are few, relevant to your work, and you can object at any time.
How to unsubscribe: reply to the email with a “no” or write to [email protected]. You will not receive any more messages.
Retention: no more than 12 months from the last unanswered contact. If you object, only your email address is kept on a suppression list, so that you are not contacted again.

4. Cookie-free web analytics

Tool: Cloudflare Web Analytics. It measures visits in aggregate (page views, country, device type and referring site) without cookies, without storing anything on your device and without tracking you across sessions or websites.
Purpose: to know which pages are visited in order to improve the website.
Legal basis: legitimate interest in understanding how the website is used (art. 6.1.f GDPR).

Cookies

This website does not use analytics, advertising or tracking cookies, which is why it shows no cookie banner. Cloudflare, as hosting and security provider, may use strictly necessary technical cookies to protect the website against abuse. Some interactive demos save the options you select in your browser’s local storage, only so that they work; that data never leaves your device.

Providers and recipients

Data is not shared with third parties unless required by law. To provide the service, Dalflow works with these providers, who act as data processors:

Zoho Corporation: email.
Google Ireland Limited: calendar and meetings.
Cloudflare, Inc.: website hosting, security and analytics.

Some of these providers, or their subcontractors, may process data outside the European Economic Area. Where they do, it is with appropriate safeguards: a European Commission adequacy decision (such as the EU-US Data Privacy Framework) or standard contractual clauses.

Automated decisions

No automated decisions are made and no profiling with legal effects on you takes place.

Minors

Dalflow’s services are aimed at businesses and professionals. Data from children under 16 is not knowingly collected; if you find that it has been, write in and it will be deleted.

Your rights

You can at any time ask for access to, rectification or erasure of your data, object to its processing, request restriction or portability, and withdraw any consent you have given. Just write to [email protected]. You will get an answer within one month at the latest. If there is reasonable doubt about your identity, you may be asked to prove it.

If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of your country.

Security

Dalflow applies technical and organisational measures appropriate to the risk, such as restricted access to accounts and encrypted connections (HTTPS).

Changes to this policy

This policy may be updated. The date at the top shows the current version.