Privacy Policy

1. Introduction

HydroViva ("HydroViva", "we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what information we collect when you use our website (hydroviva.es), how we use it, and what rights you have under the General Data Protection Regulation (GDPR — Regulation EU 2016/679).

This policy applies to all visitors and persons who submit a service enquiry through our website. Please read it carefully. By using our website, you acknowledge that you have read and understood this policy.

2. Data Controller

The data controller responsible for your personal data is:

3. Data We Collect

We collect the following categories of personal data:

a) Data you provide via the contact form:

• Full name — to address you properly and identify your request.
• Phone number — to contact you regarding your service request.
• Preferred appointment date — to schedule the service.
• Description of the issue — to prepare an accurate estimate.

b) Data collected automatically:

• IP address — recorded in server access logs for security and diagnostics.
• Cookie preferences — stored in your browser's localStorage to remember whether you have accepted or declined optional cookies.

We do not collect sensitive personal data (health, financial, racial/ethnic origin, etc.). We do not knowingly collect data from persons under 16 years of age.

4. How We Use Your Data

• Responding to your service request — your name, phone number, date, and issue description are used exclusively to process and reply to your enquiry.
• Service delivery — to schedule and carry out the requested work.
• Website analytics — only if you have given explicit consent via our cookie banner. Analytics help us understand how visitors use the site so we can improve it. If you decline, no analytics data is collected.
• Security and server maintenance — IP addresses in server logs are used solely to detect abuse and maintain website availability.

We do not use your data for automated decision-making or profiling. We do not send marketing emails or newsletters without your separate, explicit consent.

5. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

• Article 6(1)(b) — Contractual necessity: Processing your contact form submission (name, phone, date, description) is necessary to take steps at your request prior to entering into a service contract.
• Article 6(1)(a) — Consent: Website analytics cookies are only activated after you give your free, specific, and informed consent via our cookie preference banner. You may withdraw this consent at any time.
• Article 6(1)(f) — Legitimate interests: Server log retention (including IP addresses) is based on our legitimate interest in ensuring the security and availability of the website.

6. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We share data only as described below:

• Telegram Bot API (Telegram Messenger Inc.): When you submit a contact form, the data you provide (name, phone, date, description) is transmitted via the Telegram Bot API to a private Telegram account operated by HydroViva. This allows us to receive and respond to your enquiry promptly. Telegram's privacy policy is available at telegram.org/privacy.
• Analytics providers (conditional): Only if you accept analytics cookies, anonymised usage data may be shared with third-party analytics services. No personally identifiable information (name, phone) is sent to analytics providers.
• Hosting provider: Our website is hosted on Railway.app. Server-level logs (including IP addresses) may be accessible to Railway as part of infrastructure operations. Railway's privacy policy is available at railway.app/legal/privacy.

All data transfers outside the European Economic Area (EEA) are made with appropriate safeguards in place (Standard Contractual Clauses or adequacy decisions where applicable).

7. Cookies and Local Storage

Our website uses cookies and localStorage to provide basic functionality and, with your consent, to analyse website traffic.

• Strictly necessary: Used to remember your cookie preferences (stored in localStorage). These cannot be disabled as they are essential for the cookie consent mechanism to work.
• Analytics cookies (optional): Activated only with your explicit consent. Used to collect anonymised data about how visitors interact with the site (pages visited, session duration, referral source). No personal identifiers are collected.

You can manage or withdraw your cookie preferences at any time by clicking the cookie settings button displayed in the bottom-left corner of the screen, or by clearing your browser's localStorage for this site.

8. Data Retention

• Contact form submissions (name, phone, date, description): retained for up to 2 years from the date of submission, or until the purpose for which they were collected has been fulfilled, whichever comes first.
• Server access logs (including IP addresses): retained for 90 days and then automatically deleted.
• Cookie preferences (localStorage): stored in your browser until you clear your browser data or withdraw your consent.

After the applicable retention period expires, data is securely deleted or anonymised so that it can no longer be linked to an individual.

9. Your Rights Under GDPR (Articles 15–22)

As a data subject residing in the European Union, you have the following rights:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17): You may request that we delete your personal data ("right to be forgotten"), subject to applicable legal obligations.
• Right to restriction of processing (Art. 18): You may ask us to limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): Where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
• Right to object (Art. 21): You may object to processing based on our legitimate interests.
• Right to withdraw consent (Art. 7(3)): Where we rely on your consent (e.g. analytics cookies), you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint (Art. 77): You have the right to lodge a complaint with the Spanish supervisory authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain. Website: www.aepd.es

To exercise any of your rights (except the right to lodge a complaint with the AEPD), please contact us using the details in Section 10 below. We will respond within 30 days of receiving your request.

10. Contact Us

For any questions about this Privacy Policy or to exercise your data protection rights, please contact us:

We are committed to working with you to achieve a fair resolution to any privacy concerns. If you remain dissatisfied after contacting us, you may contact the AEPD as described in Section 9.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The "Last updated" date at the top of this page will always reflect the most recent revision.

We encourage you to review this policy periodically. Continued use of our website after any changes constitutes your acknowledgment of the updated policy.