This policy explains what personal data we process, for what purpose, on what legal basis and for how long, in accordance with articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on data protection and the guarantee of digital rights.
It describes how this website actually works rather than a generic template. If any of the circumstances described change, the policy is updated before the change takes effect.
Data controller
- Controller
- Corpshore Solutions Corporation
- Corporation number
- Ontario Corporation No. 5017380
- Address
- The Exchange Tower, 130 King Street West, Suite 1900, Toronto, Ontario M5X 2A2, Canada
- Privacy contact
- info@corpshore.solutions
The controller is established in Canada. Service contracts with clients in Spain are signed with this entity while no registered Spanish company exists.
What we process and why
Forms on the site send your details to our customer relationship management system, where they are recorded so we can handle your enquiry and follow it up commercially.
When you email us, we process whatever you choose to include in your message: usually your name, your email address, the company you represent and the substance of your enquiry. We use it to reply, to prepare a proposal if you ask for one, and to keep track of the commercial conversation.
If you send us an application for a role, we process the details in your CV to assess your fit for that recruitment process.
Separately, we measure use of the site with an analytics tool that uses no cookies and does not identify individuals. The data it produces is aggregated: page views, approximate country, device type and referring page.
Legal basis for each activity
- Replying to your enquiry and preparing a proposal: steps taken at your request prior to entering a contract, article 6(1)(b) GDPR.
- Handling your job application: steps taken at your request prior to entering a contract, article 6(1)(b) GDPR.
- Later commercial follow-up with clients and professional contacts: legitimate interest in maintaining the business relationship, article 6(1)(f) GDPR. You may object at any time.
- Aggregated website analytics: legitimate interest in understanding and improving use of the site, article 6(1)(f) GDPR. The tool uses no cookies and does not allow a visitor to be identified.
- Language cookie: necessary to provide the service requested, namely showing the site in the language chosen. Exempt from the consent requirement in article 22.2 of Law 34/2002.
Recipients and processors
We do not sell personal data and do not disclose it to third parties for advertising. The following providers process data on our behalf, as processors and under the contract required by article 28 GDPR:
- Vercel Inc., website hosting and aggregated analytics. Processes the technical data inherent in serving a web page, such as the IP address of the request.
- Our corporate email provider, which hosts the messages you send us.
- Zoho Corporation, customer relationship management, where commercial enquiries are recorded.
- Corpshore group companies involved in delivering a contracted service, where that is necessary to deliver it.
International data transfers
The controller is established in Canada. The European Commission has recognised an adequate level of protection for Canadian organisations subject to the Personal Information Protection and Electronic Documents Act in the course of their commercial activities, by Decision 2002/2/EC.
The site is hosted by a provider based in the United States. Transfers to that provider rely on the adequacy framework applicable to certified organisations or, failing that, on the standard contractual clauses approved by the European Commission.
Where delivering a contracted service involves processing data at one of our hubs outside the European Economic Area, the transfer is governed by the contract and the corresponding data processing agreement, with standard contractual clauses and, where appropriate, a transfer impact assessment. The compliance and security page explains that approach in more detail.
Retention periods
- Enquiry messages that do not lead to a commercial relationship: kept for the duration of the conversation and up to one year after the last contact.
- Client and contractual relationship data: for the term of the contract and thereafter for the statutory limitation periods applicable to commercial and tax obligations.
- Job applications: for the recruitment process they relate to and, if you expressly agree, for a further year for future processes.
- Aggregated analytics data: no data allowing an individual to be identified is retained, so no individual retention period applies.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to the email address given at the top of this policy, with a reference allowing us to identify you. We will respond within one month of receiving the request, extendable on the terms set out in article 12(3) GDPR.
Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.
If you believe your data is not being handled in accordance with the rules, you may lodge a complaint with the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. We would be grateful if you raised it with us first, so we can resolve it directly.
Information security
We apply technical and organisational measures to protect personal data against unauthorised access, loss and alteration, in the terms of article 32 GDPR. These are described in more detail on the compliance and security page, which also states which certifications we hold and which we do not.
Changes to this policy
This policy is reviewed whenever the operation of the site or the processing it describes changes. The date of the last review appears at the foot of the page.
Last reviewed: