Privacy policy

1. Data controller

The controller of your data is the owner of this website, whose full identifying details appear in the Legal notice. You may contact them by email or telephone using the contact details published on this site.

2. What data we collect

Only what you voluntarily provide in the contact form:

• Name (required)
• Telephone number (required)
• Email address (optional)
• Town and type of service you are interested in (optional)
• The message you write (optional)

3. Why we process it

To respond to your enquiry, prepare and send the quote you requested, and maintain the contact needed to do so. Your data is not used for profiling or automated decision-making.

You will not receive marketing communications unrelated to your enquiry unless you expressly authorise this by other means.

4. Legal basis

The consent you give when submitting the form (art. 6.1.a GDPR) and the pre-contractual measures you request, such as the preparation of a quote (art. 6.1.b GDPR).

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.

5. How long we keep your data

For as long as needed to handle your enquiry and, if it does not result in an engagement, for a maximum of one year. If work is agreed, data will be kept for the periods required by tax and accounting law.

6. Recipients and processors

Data is not shared with third parties for commercial purposes. The following providers act as data processors in order to run the site, deliver the form and measure the audience:

• Cloudflare, Inc. — website hosting and form delivery
• Resend, Inc. — sending the email containing your enquiry
• Plausible Insights OÜ (Tartu, Estonia) — cookie-free audience measurement, with the data kept in the European Union

7. International transfers

Cloudflare and Resend are established in the United States, so processing may involve an international transfer of data. Such transfers rely on the safeguards set out in Chapter V of the GDPR (standard contractual clauses and/or applicable adequacy frameworks). Plausible processes and stores data in the European Union.

8. Cookies and audience measurement

This website uses no first-party or third-party cookies and no advertising tools.

To see how many people visit the site, which pages they read, where they come from (including campaign links, such as the one on our Google Business Profile), how long they spend on them and how far they scroll, which contact buttons they press, how many forms are sent successfully and whether anyone lands on a page that does not exist, we use Plausible Analytics, by Plausible Insights OÜ (Tartu, Estonia).

With each visit or action, your browser sends Plausible the page address, the referring page and the name of the action — never anything you type into the form. Like any server, Plausible also receives your IP address and browser details: it uses them to work out the device type, browser, operating system and approximate location (country, region and city), and to calculate an identifier using a random value that is changed and deleted every 24 hours, so one day’s identifier cannot be linked to the next; it does not store the IP address or those details in raw form. It records each visit and action with that daily identifier and shows them to us only as aggregate statistics. It uses no cookies, stores nothing on your device and creates no persistent identifiers.

The data is processed and stored in the European Union. Plausible acts as a data processor under an agreement accepted by using the service, and relies on European sub-processors named in its own policy: Hetzner (Germany), Bunny (Slovenia) and UpCloud (Finland).

This measurement is carried out solely on behalf of VARELUX and only to understand the site’s audience: it is not combined with other data, not shared with third parties and does not allow you to be followed across other websites. We commit to keeping these statistics for no more than 25 months. On this basis we rely on the consent exemption set out in the Spanish Data Protection Agency’s (AEPD) guidance on audience-measurement tools (January 2024), and for this reason no cookie banner is shown.

9. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by contacting the controller by email, stating the right you wish to exercise and enclosing a copy of a document proving your identity.

If you believe the processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

10. Security

The site is served entirely over an encrypted connection (HTTPS), and reasonable technical and organisational measures are applied to protect data against loss, misuse or unauthorised access.

11. Changes to this policy

This policy may be updated to reflect regulatory or service changes. The date of the latest revision appears at the top of this page.