This privacy policy explains how Orvela Partners handles personal data collected through this website, and the rights available to you under the GDPR and other applicable data protection laws.
1. Data controllers
"Orvela Partners" is a trade name. The joint controllers of your data, within the meaning of Article 26 GDPR, are the two independent professionals who operate under the Orvela Partners trade name. You may request their identity and the essential terms of our joint controller arrangement at any time by writing to hello@orvelapartners.com. See also the legal notice.
We have agreed between us how we share these responsibilities. Whichever of us you contact, you may exercise all of your rights against either.
Contact: hello@orvelapartners.com
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.
2. What we collect and where it is stored
Contact form: name, work email, company and website, and your message. These are stored in a database hosted on our website platform, and also reach us by email.
Direct email: whatever you choose to send us.
Resources: name and email, where you download a guide.
Technical data: IP address and pages visited, through the analytics built into our hosting platform.
We do not intentionally collect special category data under Article 9 GDPR. Please do not send us health information about identifiable individuals through this website.
3. Legal basis for processing
We rely on the following legal bases under Article 6 GDPR:
Your consent (Art. 6.1.a): when you submit the contact form, or ask us to send you a resource. You can withdraw this at any time, and withdrawing it does not affect processing we carried out before you did.
Performance of a contract (Art. 6.1.b): when we are working with you under an engagement, or taking steps at your request before entering into one.
Our legitimate interests (Art. 6.1.f): to keep records of our business correspondence, to keep this website secure and functioning, and to understand in aggregate how the site is used. We have weighed these interests against your rights and consider them proportionate, given that the data involved is professional contact information and that we do not profile or target anyone. You can object to this processing at any time.
Compliance with a legal obligation (Art. 6.1.c): to meet our accounting, invoicing and tax obligations.
4. Purpose of processing
We use personal data to:
- answer your enquiry and assess honestly whether we are the right partner for what you are building;
- deliver the services we agree with you, and manage the engagement, including invoicing;
- send you a guide, scorecard or other resource you have asked for;
- keep this website secure, available and working correctly, and understand in aggregate which pages are read.
We will not add you to a marketing list because you contacted us. If you download a resource, we will only send you further material if you have asked us to, and every message will include a way to stop.
We do not take automated decisions with legal or similarly significant effects, and we do not carry out profiling.
5. Data retention
Enquiries that do not lead to an engagement: 12 months from our last exchange, after which we delete them from both our inbox and the website database.
Client records: for the duration of the engagement and for 6 years afterwards, which is the period we are required to keep accounting records for under Spanish commercial law. Tax records are kept for as long as the relevant tax authority may review them.
Resource downloads: until you ask us to delete your details, or until 24 months of no contact, whichever comes first.
Technical and analytics data: 14 months.
When a retention period ends, we delete the data or irreversibly anonymise it.
6. Processors and international transfers
Website hosting, database and platform analytics: Lovable Labs Incorporated (United States), under a data processing agreement and the European Commission's Standard Contractual Clauses (Decision 2021/914). A list of its own sub-processors is available at trust.lovable.dev/subprocessors.
Content delivery and security: Cloudflare, Inc.
We do not sell or rent personal data.
7. Your rights
You have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data deleted (Art. 17);
- restrict how we use it (Art. 18);
- receive it in a portable, machine-readable format, or have it sent to another provider (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw your consent at any time, where consent is what we rely on (Art. 7.3).
To exercise any of these, write to hello@orvelapartners.com. We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else. We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you within the first month if we need to.
Exercising these rights is free. We may charge a reasonable fee, or decline, only if a request is manifestly unfounded or excessive, and we will explain why if that ever happens.
If you are not satisfied with how we have handled your data, you can lodge a complaint with the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (www.aepd.es), or with the supervisory authority in the country where you live or work.
8. Contact
For any privacy question, or to exercise your rights, contact us at: hello@orvelapartners.com
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.