Last updated: March 24, 2026
Privacy Policy
This Privacy Policy explains how GuruSup Tech S.L. collects, uses, and protects personal data through the website gurusup.com (the "Website"), in compliance with Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD).
1. Data Controller
- Company: GuruSup Tech S.L.
- VAT number: ESB21975784
- Address: Calle Guillem de Castro 9, 7ª planta, 46007 Valencia, Spain
- Phone: +34 627 648 100
- Privacy contact: privacy@gurusup.com
2. Data Protection Officer
GuruSup Tech S.L. has not appointed a Data Protection Officer, as our processing activities do not meet the thresholds set out in Article 37 GDPR. For any privacy-related query, please contact privacy@gurusup.com.
3. Personal Data We Process
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact / demo form | Name, email, phone, company | Respond to inquiry; manage sales pipeline | Legitimate interest (Art. 6.1.f) | 2 years from last contact |
| Partners form | Name, email, phone, company | Evaluate partnership opportunity | Legitimate interest (Art. 6.1.f) | 1 year from submission |
| WhatsApp follow-up | Phone number | Send initial inquiry confirmation via WhatsApp | Legitimate interest (Art. 6.1.f) | Until inquiry is closed |
| Website analytics | IP address, device, pages visited, events | Understand usage; improve the product | Consent (Art. 6.1.a) | 14 months |
| Advertising | IP address, cookies, browsing behaviour | Measure ad conversions; retargeting | Consent (Art. 6.1.a) | Until consent withdrawn |
| Website hosting | IP address, server request logs | Service delivery and security | Legitimate interest (Art. 6.1.f) | 90 days |
4. Recipients and Third-Party Processors
We share data only with processors that provide sufficient guarantees under Article 28 GDPR:
- HubSpot Inc. (USA) — CRM and lead management. Transfer: EU–US DPF.
- Google LLC (USA) — Analytics (GA4) and advertising. Transfer: EU–US DPF. Acts as independent controller for advertising. Email addresses submitted via forms are hashed with SHA-256 before being sent to Google Ads for enhanced conversion measurement.
- Meta Platforms Inc. (USA) — Advertising (Meta Pixel) and WhatsApp Business. Transfer: EU–US DPF.
- Mixpanel Inc. (USA) — Product analytics (EU endpoint). Transfer: Standard Contractual Clauses (SCCs).
- Vercel Inc. (USA) — Website hosting. Transfer: EU–US DPF.
- Microsoft Corporation (USA) — Session analytics (Clarity). Transfer: EU–US DPF.
We do not sell, rent, or trade personal data with third parties for their own marketing purposes.
5. International Data Transfers
Transfers to US-based processors are covered by the EU–US Data Privacy Framework (European Commission adequacy decision, July 2023) for certified companies, or by Standard Contractual Clauses (SCCs) where DPF certification is unavailable. Verify DPF certifications at dataprivacyframework.gov.
6. Data Retention
- Active leads: 2 years from last activity.
- Cold leads (no response): 2 years from submission.
- Closed deals (customers): contract duration plus 5 years (Spanish Commercial Code).
- Analytics data: maximum 14 months.
- Server logs: 90 days.
- Suppression list (opt-outs): retained indefinitely to prevent re-contact.
- Consent records: 3 years after consent is withdrawn.
7. Your Rights
Under GDPR and LOPDGDD you have the right to:
- Access (Art. 15) — obtain a copy of your personal data.
- Rectification (Art. 16) — correct inaccurate or incomplete data.
- Erasure (Art. 17) — request deletion of your data.
- Restriction (Art. 18) — limit processing in certain circumstances.
- Portability (Art. 20) — receive your data in machine-readable format.
- Object (Art. 21) — object to processing based on legitimate interest. We will stop unless we have compelling grounds.
Email privacy@gurusup.com with subject "Data Subject Request" and proof of identity. We respond within 30 days.
8. Supervisory Authority
You have the right to lodge a complaint with:
- Agencia Española de Protección de Datos (AEPD)
- C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es — Tel.: 901 100 099
9. Children
Our services target business professionals and are not directed at persons under 16. We do not knowingly collect data from children. Contact privacy@gurusup.com to request immediate deletion.
10. Updates
We may update this policy periodically. Material changes will be reflected in the "Last updated" date above.