Privacy policy.

The data controller for the personal data collected through this site is the entity operating Quilla in Spain.

We process the data you voluntarily provide when you write to Quilla or request an initial conversation:

• ●Identification data: name, surname, and role.
• ●Professional data: company, industry, size, and work email.
• ●Content data: the text you send through the form or by email.
• ●Technical data: IP address, browser, and aggregated usage data where applicable.

We do not intentionally collect special categories of data. If you send them on your own initiative, we will erase them unless legal retention duties apply.

• ●To answer questions or contact requests.
• ●To assess potential fit and prepare a proposal where relevant.
• ●To manage the contractual relationship if we start working together.
• ●To comply with legal, tax, and accounting obligations.

We do not use this data for automated decision-making or commercial profiling.

• ●Standalone enquiries: up to 12 months from the last contact.
• ●Clients: for the duration of the relationship and 6 years afterwards for accounting and tax duties.
• ●Technical and analytics data: up to 13 months.

We do not disclose data to third parties unless required by law. We may rely on processors—such as email, hosting, or management-tool providers—under contracts that comply with article 28 GDPR.

Some providers may operate outside the European Economic Area. In those cases, appropriate safeguards will be applied, including standard contractual clauses where needed.

You may exercise the following rights at any time:

• ●Access to your data.
• ●Rectification of inaccurate data.
• ●Erasure when the data is no longer necessary.
• ●Objection to specific processing activities.
• ●Restriction of processing in the cases provided by law.
• ●Portability of the data to another controller.
• ●Withdrawal of consent at any time, without retroactive effect.

You can write to hola@quilla.group. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

We apply technical and organisational measures proportionate to the risk, including encryption in transit, role-based access control, password policies, staff training, and periodic vendor reviews.

If we update this policy, we will publish the new version with a visible date. Material changes will be communicated by email to active clients where appropriate.