Privacy policy.
How we process the personal data we receive through this site, its forms, and email. Adapted to the GDPR and Spanish data protection rules. This text remains provisional pending legal review.
- Controller
- Unlimited Blanco Limited, Sucursal en España
- Contact
- hola@quilla.group
- Updated
- April 2026
Who processes the data
The data controller for the personal data collected through this site is the entity operating Quilla in Spain.
| Field | Detail |
|---|---|
| Controller | Unlimited Blanco Limited, Sucursal en España |
| Brand | Quilla® |
| Registered address | Calle Naturista López Seoane, 27-27 Entresuelo H — 15403 Ferrol (A Coruña), Spain |
| hola@quilla.group | |
| DPO | Not appointed / [pending appointment] |
Categories of personal data
We process the data you voluntarily provide when you write to Quilla or request an initial conversation:
- Identification data: name, surname, and role.
- Professional data: company, industry, size, and work email.
- Content data: the text you send through the form or by email.
- Technical data: IP address, browser, and aggregated usage data where applicable.
We do not intentionally collect special categories of data. If you send them on your own initiative, we will erase them unless legal retention duties apply.
Why we use the data
- To answer questions or contact requests.
- To assess potential fit and prepare a proposal where relevant.
- To manage the contractual relationship if we start working together.
- To comply with legal, tax, and accounting obligations.
We do not use this data for automated decision-making or commercial profiling.
What legitimises each purpose
| Purpose | Legal basis |
|---|---|
| Answering contact requests | Consent / pre-contractual steps (art. 6.1.a and 6.1.b GDPR) |
| Performing contracts | Contract performance (art. 6.1.b GDPR) |
| Legal obligations | Compliance with law (art. 6.1.c GDPR) |
How long we keep the data
- Standalone enquiries: up to 12 months from the last contact.
- Clients: for the duration of the relationship and 6 years afterwards for accounting and tax duties.
- Technical and analytics data: up to 13 months.
Third parties and international transfers
We do not disclose data to third parties unless required by law. We may rely on processors—such as email, hosting, or management-tool providers—under contracts that comply with article 28 GDPR.
Some providers may operate outside the European Economic Area. In those cases, appropriate safeguards will be applied, including standard contractual clauses where needed.
Rights available to users
You may exercise the following rights at any time:
- Access to your data.
- Rectification of inaccurate data.
- Erasure when the data is no longer necessary.
- Objection to specific processing activities.
- Restriction of processing in the cases provided by law.
- Portability of the data to another controller.
- Withdrawal of consent at any time, without retroactive effect.
You can write to hola@quilla.group. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Measures proportionate to the risk
We apply technical and organisational measures proportionate to the risk, including encryption in transit, role-based access control, password policies, staff training, and periodic vendor reviews.
How updates are communicated
If we update this policy, we will publish the new version with a visible date. Material changes will be communicated by email to active clients where appropriate.
If you want to exercise a data right or verify the legal basis for a specific case, write to us with enough context to act.
We will reply with the right next step, the relevant documentation, or a clarification about the processing described in this policy.
Privacy policy