Privacy policy

Data controller

The controller of the personal data collected on somiadigital.com is Joan Cama Ribot, trading as Somia Digital, Spanish tax ID 41531670H (the Controller). Contact details:

• Address: Carrer de Sant Joan, 16, 17200 Palafrugell (Girona), Spain
• Telephone: +34 678 307 546
• Email: hola@somiadigital.com

Legislation and principles

This policy complies with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on data protection and digital rights (LOPDGDD), and Spanish Law 34/2002 on information society services and e-commerce (LSSI-CE).

We process data in line with the principles in Article 5 GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

What data we process and why

Below we explain each type of processing carried out through the site. We do not ask for special categories of data (health, beliefs, ethnic origin, etc.), so please do not include them in your messages or in the chat.

Enquiries and sign-ups through forms

Data: what you type into the form (name and, where applicable, surname, email address, phone number if you give one, company, the service or topic you are interested in, and your message). When it arrives, our server adds your IP address, the approximate location derived from it (city, region and country) and your device type, operating system and browser.

Purpose: to answer your enquiry, prepare a quote or handle your registration for a training course or networking event. The technical data helps us spot abusive submissions and see where enquiries come from. The site does not store forms in any database: they reach us by email, and you receive an automatic confirmation email.

Legal basis: your request, as a pre-contractual step (Art. 6(1)(b) GDPR), and the consent you give by ticking the privacy box (Art. 6(1)(a)). Technical data is processed on the basis of our legitimate interest in protecting the site against abuse (Art. 6(1)(f)).

AI chat assistant

The chat assistant is an automated AI system, not a person. It answers questions about our services using the information on the site, and runs on Google's Gemini model. Its answers may contain mistakes, so always check prices, timescales and terms with us.

What is sent: each time you write, the text of the conversation (the latest messages), the language and the page you are on go to our server and from there to Google's Gemini API, which generates the reply. Please do not type sensitive data or other people's data.

What is stored: our server does not store the text of conversations. To prevent abuse, it keeps message counters and an anti-bot verification flag, keyed to an encrypted fingerprint (hash) of the IP address and the random device identifier, never to the IP address in clear. Server logs record errors and limits, never the content of messages or your email address. The conversation history stays only in your browser for 7 days so you can pick it up again (see the Cookie policy).

If you want us to contact you: the assistant only passes your details on once you have given a name and email address and expressly confirmed that you want us to get in touch. It then sends us an email with your name, email address, phone number if given, the service you are interested in, a summary of what you need, any timescale or budget you mentioned, the last part of the conversation and the same technical data as the forms (IP address, approximate location and device). You receive a confirmation email.

Lead rating and automated decisions: when it passes on a contact, the assistant (Gemini, based on the conversation) adds an indicative rating of your level of interest (high, medium or low) and, if you mentioned them, any deadlines or urgency. We do this only to prioritise our reply and organise our work: a person always reads the request and replies to you, and the rating does not determine whether or on what terms we deal with it. The chat therefore does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Legal basis: answering the questions you ask about our services, at your request (Art. 6(1)(b) GDPR); your consent, when you confirm that you want us to contact you (Art. 6(1)(a)); and our legitimate interest in protecting the service against abuse and in prioritising our replies to the contacts we receive (Art. 6(1)(f)).

Booking a meeting

On the contact page you can book a meeting through the Cal.com calendar, which only loads when you open the meeting tab. The details you enter in the booking form go to Cal.com, which manages the appointment and sends the confirmations on our behalf. Legal basis: your request for a meeting (Art. 6(1)(b) GDPR).

Protection against bots and abuse

The chat, the forms and the domain checker use Cloudflare Turnstile to check that a person is using them. To do this, Cloudflare processes technical signals (IP address, TLS fingerprint, browser user-agent header and the site where the check takes place) solely to detect and block bots. We also apply usage limits per IP address or device, over windows of 10 minutes, 1 hour or 24 hours, with counters keyed to an encrypted fingerprint; they lapse when the window ends and are deleted by automatic clean-ups. Legal basis: our legitimate interest in protecting the site and its users (Art. 6(1)(f) GDPR).

When you use the domain checker, our server looks up the domain name you type in public registration (rdap.org) and DNS (Google Public DNS) services, without sending them any of your data.

Audience measurement

Rybbit, without cookies: we count visits, page views and some clicks (call, email, WhatsApp or form submission) with Rybbit, an analytics tool that runs on a server in Europe managed by Somia Digital and receives data through the site's own domain. It uses your IP address to work out your country and city and, combined with your browser, to generate an encrypted identifier that cannot reveal who you are. It stores nothing on your device and does not share data with third parties. Legal basis: our legitimate interest in understanding how the site is used so we can improve it (Art. 6(1)(f) GDPR). You can object at any time by writing to hola@somiadigital.com.

Google Analytics 4, only with consent: if you accept analytics cookies, Google Analytics records the pages you visit, some clicks and device and approximate location data to produce statistics. From the chat we only send the topic category of the question, never the text. We only grant Google analytics consent and keep advertising consent denied, so no Google Signals data is collected and the data is not used for personalised advertising. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE), which you can withdraw through “Cookie settings”. The cookies and how long they last are listed in the Cookie policy.

Hosting and delivery of the site

Every time you visit the site, the request goes through Cloudflare, which acts as an intermediary (proxy) to serve it quickly and securely, and then reaches Netlify, which hosts the site and runs its server functions (chat, forms and usage limits). Both process your IP address and the technical details of the request (browser, page requested, date and time) to serve and protect the site. Legal basis: our legitimate interest in providing a secure and available website (Art. 6(1)(f) GDPR).

Contact by phone, email or WhatsApp

If you call or email us directly, we process the details you give us in order to deal with your request (Art. 6(1)(b) GDPR). If you message us on WhatsApp, that service is provided by WhatsApp Ireland Limited, which handles the data under its privacy policy.

Providers (processors) and international transfers

We do not sell your data or pass it to third parties for their own purposes, except where required by law. To provide the service we work with the following providers, which process data on our behalf (Art. 28 GDPR). Several are based in the United States; international transfers are covered by the safeguards each provider states:

• Netlify, Inc. (USA): website hosting, server functions and storage of the anti-abuse counters (Netlify Blobs). Safeguards: EU-US Data Privacy Framework and the European Commission's standard contractual clauses (Netlify policy).
• Cloudflare, Inc. (USA): proxy, content delivery and security for the domain, and Turnstile verification. Safeguards: EU-US Data Privacy Framework and, where needed, standard contractual clauses (Cloudflare policy). For Turnstile, Cloudflare also acts as a controller of the signals it uses to improve bot detection (Turnstile privacy addendum).
• Google: Google Analytics 4, only with consent, and the Gemini API for the chat assistant. For analytics, Google relies on the EU-US Data Privacy Framework (Google data transfers). For Gemini, Google processes the data as a processor under its data processing addendum, with standard contractual clauses or a recognised alternative mechanism. Under the Gemini API terms that apply when the service is offered in the European Economic Area, Google does not use prompts or responses to improve its products and keeps them for 55 days solely to detect abuse (usage policies).
• Google Workspace (Google Ireland Limited, Ireland): the hola@somiadigital.com mailbox, where we receive the form and chat notifications and the emails you send us, and from which we reply. Google acts as a processor under the Cloud Data Processing Addendum, the data processing terms it offers for Google Workspace (Google Workspace privacy compliance). Where data is processed outside the European Economic Area, Google relies on the EU-US Data Privacy Framework and standard contractual clauses.
• Resend (Plus Five Five, Inc., USA): sending the form and chat emails, both the notification we receive and the confirmation you get. Safeguards: EU-US Data Privacy Framework and standard contractual clauses (Resend DPA).
• Cal.com, Inc. (USA): meeting scheduling. Safeguards: EU-US Data Privacy Framework and standard contractual clauses where appropriate (Cal.com policy).

Rybbit is not a third party: the analytics runs on a server in Europe managed by Somia Digital and the data is not shared with anyone.

How long we keep data

• Enquiries and contacts (forms, chat and email), sign-ups and meetings: we keep them for as long as they are useful to deal with your request and for any business relationship that arises from it, and until you ask us to delete them. We review them periodically and delete those no longer needed for that purpose. If an enquiry leads to an engagement, the data becomes part of that contractual relationship and is kept for the periods required by law.
• Chat conversations: our server does not store them; the history stays in your browser for 7 days, and Google keeps prompts and responses for 55 days solely to detect abuse.
• Anti-abuse counters and verification flags: they lapse after 10 minutes, 1 hour or 24 hours and are deleted by automatic clean-ups.
• Google Analytics cookies: 13 months (see the Cookie policy).
• Google Analytics data: under the property's settings, Google keeps event-level and user-level data for a maximum of 14 months; the aggregated reports derived from it are kept.
• Rybbit statistics: aggregated, pseudonymous data (pages, clicks, approximate country and city and an encrypted identifier that cannot reveal who you are), stored on our server in Europe. We keep them for as long as they help us see how the site is doing, until we decide to delete them.

Children's data

Only people over 14 can consent to us processing their data (Art. 8 GDPR and Art. 7 LOPDGDD). If you are younger, your parents or guardians must give consent.

Confidentiality and security

We apply technical and organisational measures appropriate to the risk: the site only works over an encrypted connection (HTTPS), the IP addresses used for usage limits are stored as hashes, and server logs do not record message content. Data is kept confidential and only the people and providers who need it for the purposes described can access it.

No system connected to the internet is invulnerable. If a security breach were likely to result in a high risk to your rights and freedoms, we would tell you without undue delay, as the GDPR requires.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, as well as the right not to be subject to decisions based solely on automated processing. You can also withdraw any consent you have given, without affecting processing carried out before then: for analytics cookies, through “Cookie settings”; for everything else, by writing to us.

To exercise them, write to hola@somiadigital.com or to the Controller's postal address with the reference “GDPR-somiadigital.com”, stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for a document that proves it.

If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) or the Catalan Data Protection Authority (APDCAT), or with the supervisory authority in the country where you live or work.

Links to third-party websites

The site links to websites run by other companies (social networks, podcast platforms, client websites). Each has its own privacy policy and is responsible for it.

Changes to this policy

We will update this policy whenever the site's services, providers or the law change. The current version is always the one on this page, with the review date at the top.