Privacy policy

What data we process

• Contact details you give us: name, work email, company and, if you add it, a phone number.
• What you tell us about your project, typed or spoken. If you use voice input, the recording is only used to turn it into text.
• Technical data sent with a request: approximate location (city and country, derived from your IP address) and the type of device.
• Publicly available information about your company, taken from the website of your email domain, to prepare our reply.

Why and on what legal basis

We use this data to answer your enquiry, prepare a proposal and, if you ask for it, send you the assessment report: steps taken at your request before a possible contract (Art. 6(1)(b) GDPR). We protect the site against automated abuse and record the approximate location and device of requests on the basis of our legitimate interest in running a secure service (Art. 6(1)(f) GDPR).

The AI assistant

The chat on the home page is an AI assistant. It asks a few questions and summarises your request; a person at Calima reads every request. The assistant makes no decisions about you.

If you write to us on WhatsApp, the same AI assistant answers first and says so in its first message; a person can take over at any time. We keep the chat (voice messages are transcribed to text) to answer you and follow up on your request, and delete it with the rest of your request.

Website statistics

To understand how the website is used, we count page views without cookies and without storing your IP address: the page, the website you came from, your approximate country and city, the type of device and browser, and the name of the network you connect from (for example a company or an internet provider), which we derive from the IP address and then discard. A visitor is counted with an anonymous code that changes every day, so no one can be tracked over time. Legal basis: our legitimate interest in improving the website (Art. 6(1)(f) GDPR). We delete these statistics after 13 months and keep only anonymous monthly totals (for example, how many visits came from each country), which cannot be linked to anyone.

Analytics and advertising (only with your consent)

If you agree in the cookie banner, we use Google Analytics to see how the site is used, and Google Ads together with the Meta Pixel and Meta's Conversions API to measure our advertising — for example which ad led to a contact — and to show relevant ads. These tools set cookies and send data to Google and Meta: an online identifier and, when you send us a request, a hashed (irreversible) form of your email that lets Meta match the conversion. Google and Meta process this data under their own terms and as controllers for their part.

We load these tools only after your consent (Art. 6(1)(a) GDPR), through Google Consent Mode for the Google tags, and never before. You can withdraw your consent at any time under "Cookie settings" in the footer. The exact cookies are listed in our cookie policy.

Job applications

If you apply to work with us, we use your application and the material you send only to assess it, on the basis of the steps you ask us to take before a possible contract (Art. 6(1)(b) GDPR). If we do not hire you, we delete it within one year unless you agree that we keep it for future openings.

Who helps us process data

We use these suppliers as data processors, under data processing agreements:

• Vercel Inc. (website hosting, bot protection and access to AI models)
• Neon (part of Databricks; the database for statistics, requests and WhatsApp chats, hosted in Frankfurt, EU)
• Google LLC and Anthropic PBC (AI models that run the chat, summarise requests and transcribe voice input)
• Microsoft Ireland Operations Ltd (email, Microsoft 365, and the call booking calendar Microsoft Bookings, which only loads when you open it and receives the name, email and notes you enter)
• WhatsApp Ireland Ltd (only if you choose to contact us on WhatsApp)
• Google Ireland Ltd (Google Analytics, Google Ads and Google Tag Manager, only with your consent)
• Meta Platforms Ireland Ltd (the Meta Pixel and Conversions API, only with your consent)

Transfers outside the EU

Some of these suppliers are based in the United States. Those transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

How long we keep data

For as long as we are handling your enquiry and, if we work together, for the duration of the relationship and any period the law requires. If no project follows, we delete your data once it is no longer needed or when you ask us to.

Your rights

You can access, rectify and erase your data, object to or restrict its processing and ask for a portable copy by writing to hola@calimasolutions.com. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).