Privacy Policy

Last updated: 8 April 2026

1. Data Controller

In compliance with Regulation (EU) 2016/679, of the European Parliament and of the Council, of 27 April 2016 (GDPR), and Organic Law 3/2018, of 5 December (LOPDGDD), we inform you about the processing of your personal data.

Data Controller
ESFERICAL SYSTEMS S.L.
Tax identification number (NIF): B86915188
Registered office: Avenida Comunidad de Madrid 10, Pozuelo de Alarcón, 28224, Madrid, Spain

2. Data Protection Officer

ESFERICAL SYSTEMS S.L. has appointed a Data Protection Officer (DPO):

Contact email address: dpo@esferical.com

You can contact this address for any questions regarding the processing of your personal data or to exercise your rights.

3. Scope

This Privacy Policy applies to the processing of personal data obtained through:

  • The Esferical website;
  • Contact or information request forms;
  • Email or other professional communication channels with Esferical;
  • Business-related requests regarding our services;
  • Recruitment or candidate selection processes, where applicable;
  • And, in general, any interaction in which a natural person provides us with their data.

This Privacy Policy exclusively regulates the processing of personal data related to the Esferical corporate website, its contact forms, commercial communications, and, where applicable, Esferical's own recruitment processes.

It does not regulate the processing of data through platforms, evaluation tools, outplacement programmes, talent optimisation, restructuring, or talent databases managed as part of services provided to clients, which will be governed by their specific informative clauses or privacy policies.

4. What data we collect

We may collect the following categories of data, depending on the relationship you have with Esferical:

  • Identifiable data, such as name and surname;
  • Contact data, such as email address, phone number, or company;
  • Professional data, such as job title, organisation, or information related to the application submitted;
  • Information included in messages sent to us through forms, email, or other channels;
  • Data related to an application, such as resume, work experience, education, or professional profile;
  • Technical navigation data, IP address, online identifiers, logs, and data obtained through cookies or similar technologies, in accordance with the consent settings applicable.

Please do not provide special category or sensitive data (for example, health data, political opinions, religion, trade union membership, sexual orientation or biometric data) unless it is strictly necessary and there is a valid legal basis for doing so.

5. Purposes of processing, legal basis, and retention periods

Esferical may periodically review the applicable retention periods to delete, block, or anonymize data when it is no longer necessary for the purpose for which it was processed.

5.1. To respond to inquiries, requests for information, or requests made through the website or by email

Purpose: To address your inquiry, provide a response, and maintain the necessary communications resulting from your request.
Legal basis: The application of pre-contractual measures will be carried out at the request of the interested party when the request relates to Esferical's services, and, in such cases, Esferical's legitimate interest in managing received communications appropriately. If consent is required for a specific purpose, it will be obtained specifically and separately.
Data processed: name, company, email address, phone number, and message content.
Retention: for as long as necessary to deal with the request and, once it has been resolved, for a maximum of 12 months, unless the enquiry leads to a contractual or commercial relationship or a legal obligation to retain the data for longer.

5.2. Manage the business and professional relationship with potential clients, customers, collaborators, or company contacts.

Purpose: Managing meetings, proposals, commercial exchanges, service provision, tracking professional opportunities, and maintaining commercial or professional relationships.
Legal basis: Executing a contract, implementing pre-contractual measures, and having a legitimate interest in the development and maintenance of professional and commercial relationships.
Data processed: Identifying, contact, and professional data.
Retention: As long as the relationship continues, and subsequently, during the legally required periods, or, if applicable, until any potential liabilities expire.

5.3. Sending commercial or informative communications

Purpose: Providing information about services, content, news, or commercial communications related to Esferical's activities.
Legal basis: Obtaining the consent of the interested party when requesting or explicitly accepting to receive commercial or informative communications from Esferical. When applicable regulations allow for the sending of certain communications due to a prior relationship, Esferical will act within the legally applicable limits.
Data processed: Name, email address, and, if applicable, company or position.
Retention: Until you withdraw your consent, object to the processing, or request to be removed from the mailing list.

At any time, you can unsubscribe through the link provided in electronic communications, if applicable, or by writing to: dpo@esferical.com.

5.4. Manage recruitment processes and unsolicited applications

Purpose: Evaluate applications for current and, if applicable, future internal vacancies at Esferical during the specified retention period.
Legal basis: Implement pre-contractual measures, obtain candidate consent when necessary, and ensure legitimate interest in the management of recruitment processes.
Data processed: Identifiable data, contact details, academic and professional information, and any other information contained in the resume or submitted documentation.
Retention: as a general rule, for a maximum of 12 months from receipt of the application, unless the data subject requests erasure sooner or a legal retention obligation applies.

This refers exclusively to selection processes specific to Esferical and not to candidacies or profiles handled within the framework of services provided to third-party clients.

5.5. Comply with legal obligations and respond to requests from authorities.

Purpose: Comply with legal, tax, accounting, administrative, data protection, or respond to valid requests from public or judicial authorities.
Legal basis: Compliance with legal obligations.
Retention: Within the timeframes established by applicable regulations, and, if applicable, until the expiration of liabilities.

5.6. Ensure the security of the website, prevent abuse, and maintain the integrity of our systems.

Purpose: Protect the website, manage technical issues, prevent unauthorized access, fraud, abuse, or misuse, and maintain the security of information.
Legal basis: A legitimate interest in ensuring the security of our systems, networks, services, and digital assets.
Data processed: Technical navigation data, IP address, logs, device identifiers, and security events.
Retention: For the strictly necessary period to achieve these purposes, and, where applicable, for the period required for the formulation, exercise, or defense of claims.

5.7. Analytics and Cookies

Purpose: To enable the technical functioning of the website and, where applicable, to carry out usage, analytics, or personalisation measurements in accordance with the current Cookie Policy.
Legal basis: For technical or necessary cookies, a legitimate interest or technical necessity to provide the requested service; for analytical or personalisation cookies that are not necessary, user consent.
Retention: depending on the type of cookie or technology used, as set out in the Cookie Policy and in the consent management tool.

6. Mandatory or optional nature of the data

The fields marked as required on our forms will be necessary to process your request or provide the corresponding service. Refusal to provide them may prevent us from handling your inquiry or relationship with Esferical.

7. Recipients of the data

Your personal data may be disclosed or made available to:

  • technology and web hosting providers;
  • email, CRM, commercial automation, form, or professional communication tool providers;
  • maintenance, technical support, and security providers;
  • legal, tax, or accounting advisors, when necessary;
  • Financial institutions, if necessary for the management of collections or payments;
  • Public administrations, judges, courts, law enforcement agencies, or other competent authorities when there is a legal obligation or valid request.

When a third party acts on behalf of Esferical, a corresponding data processing agreement will be formalized, if appropriate, in accordance with the requirements of data protection regulations.

8. International data transfers

Generally, Esferical will ensure that the treatments described in this Privacy Policy are carried out within the European Economic Area.

If any of the service providers involved involve international data transfers, Esferical will take the appropriate measures required by applicable regulations, such as the signing of standard contractual clauses approved by the European Commission or other valid mechanisms at all times, and will inform about this in this Policy or in the relevant specific information.

9. Automated decisions and profiling

Esferical does not make decisions based solely on automated processes that produce legal effects for you or significantly affect you in a similar manner, nor does it create profiles for such purposes, unless it is explicitly informed of this in the future and a valid legal basis exists.

10. Rights of Interested Parties

You may exercise, in accordance with applicable regulations, the following rights:

  • Access: to know what data we process and obtain a copy of it.
  • Rectification: to request the correction of inaccurate or incomplete data.
  • Erasure: Request the deletion of your data when it is no longer needed, withdraw your consent, or another legal basis applies.
  • Objection: Oppose certain treatments based on legitimate interests or carried out for commercial purposes.
  • Restriction of processing: Request that we temporarily limit the processing of your data in certain circumstances.
  • Data portability: Receive your data in a structured format, and, when technically possible, request its transmission to another controller.
  • Withdrawal of consent: When treatment is based on your consent, you can withdraw it at any time without affecting the legality of the previous treatment.

To exercise your rights, you can write to dpo@esferical.com, clearly stating the right you wish to exercise and attaching, if necessary, documentation to verify your identity.

Furthermore, if you believe that the processing of your data does not comply with the regulations, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD).

11. Data provided by third parties

If you provide personal data of third parties, you declare that you have sufficient authorization for doing so and agree to inform them in advance of the information contained in this Privacy Policy, thereby releasing Esferical from any liability arising from the failure to comply with this obligation.

12. Minors

The services and content of the Esferical website are not intended for individuals under the age of 14. If the processing of personal data is based on consent and affects individuals under the age of 14, that consent must be obtained by the person with parental authority or guardianship, in accordance with applicable regulations.

If we detect that we have received personal data from a minor without sufficient legal basis, we will be able to proceed with its deletion.

13. Information Security

Esferical implements appropriate technical and organisational measures to protect personal data from destruction, loss, alteration, unauthorized access, or illicit communication, taking into account the state of the art, the nature of the data, the context, and the risks of processing.

However, no internet transmission or storage system can guarantee absolute security. Therefore, although we apply reasonable and appropriate measures to protect information, we cannot guarantee complete security against any eventual event.

14. Links to third-party websites and social media

The Esferical website may include links to third-party websites or social media profiles. Esferical is not responsible for the privacy practices of these external sites, platforms, or services. We recommend that you review their privacy policies before providing them with personal data.

15. Cookie Policy

Information regarding the use of cookies and similar technologies is specifically regulated in Cookie Policy of the website. This policy complements the present Privacy Policy and should be consulted together with the consent settings displayed when accessing the website.

16. Modifications to this Privacy Policy

Esferical may update this Privacy Policy to adapt it to changes in regulations, case law, technical or functional requirements, as well as modifications to the processing activities.

When the changes are significant, reasonable measures will be taken to inform users appropriately.

17. Contact

For any inquiries regarding this Privacy Policy or regarding the processing of your personal data, you can write to the data protection officer.