OBRALIAPrivacy Policy
Last updated: 12 October 2026
At OBRALIA we process your personal data in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), and Law 34/2002 on information society services (LSSI-CE). This policy explains what data we collect on obralia3d.com, for what purposes, for how long, and what rights you have.
1. Data controller
- Controller: OBRALIA PROSERVICE, S.L.
- Registered address: Calle Carrero 9, Bajo, 12500 Vinaròs (Castellón, Spain)
- Tax ID (NIF) and email address: shown by means of the “Show details” button on this page (anti-bot verification)
- Trade names: OBRALIA 3D and UNIMODUL
- Data Protection Officer: not appointed, as the conditions of Art. 37 GDPR and Art. 34 LOPDGDD are not met. Privacy enquiries are handled by the controller through the channels indicated.
2. What data we process and where it comes from
We process only the data that you provide yourself or that is generated when you use the website:
- Contact form and valuation request: name, email address, telephone number (optional), town or city (optional), type of enquiry, message and, if you arrive through a campaign link, the UTM source parameters.
- “Project and technology news” newsletter: name (optional), email address, language and the interests you select.
- Automated assistant and tools (calculator, map, technology test): the text you type and the options you choose. The assistant’s answers are generic; you must not enter personal data into it.
- Technical visit data: IP address, date and time, browser and pages requested, necessary to serve the website, prevent abuse and protect the forms.
- Web analytics (Google Analytics 4): only if you accept analytics cookies; see the Cookie Policy.
We do not request special categories of data (Art. 9 GDPR). Please do not include them in free-text messages. The website is not directed at children under 14; if you are a minor, you need the consent of your parent or guardian (Art. 7 LOPDGDD).
3. Purposes, legal basis and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Handling your enquiry or valuation request and, where applicable, preparing a proposal | Taking pre-contractual steps at your request (Art. 6.1.b GDPR) and consent given by submitting the form (Art. 6.1.a) | Six years from the close of the enquiry (blocked retention period, Art. 32 LOPDGDD) |
| Management of the contractual relationship, invoicing and legal obligations (if you engage our services) | Performance of the contract (Art. 6.1.b) and legal obligation (Art. 6.1.c) | The applicable legal periods: six years for commercial records (Art. 30 of the Commercial Code) and tax periods |
| Sending the newsletter and commercial communications by email | Your consent (Art. 6.1.a GDPR and Art. 21 LSSI-CE), confirmed by double opt-in | Until you unsubscribe or withdraw your consent; afterwards, blocked for six years |
| Website security: request rate limiting, anti-bot checks and abuse prevention | Legitimate interest in protecting the systems and forms (Art. 6.1.f GDPR) | Short-lived technical logs, not exceeding 30 days, except in the event of a security incident |
| Website usage statistics | Your consent through the cookie banner (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE) | According to the Google Analytics configuration (maximum 14 months); you may withdraw your consent at any time |
We do not take automated decisions producing legal effects concerning you, nor do we carry out profiling (Art. 22 GDPR). The website assistant is an informational tool; the calculator’s estimate is indicative and non-binding.
4. Recipients and data processors
We do not sell or transfer your data. Only service providers acting as data processors under a contract compliant with Art. 28 GDPR have access to it:
- Brevo (Sendinblue SAS, France): sending the newsletter and confirmation emails, and contact management.
- Vercel Inc. (United States): hosting and delivery of the website; processes technical data such as the IP address.
- OBRALIA’s corporate email provider: receipt of enquiries submitted through the form.
- Google Ireland Limited: web analytics (Google Analytics 4), only with your consent.
- If the assistant’s natural-language mode is activated in the future, the messages you write will be sent to Anthropic, PBC (United States) to generate the response; we will indicate this in the assistant itself and in this policy.
We may also disclose data to Public Administrations, courts and tribunals and law enforcement authorities where there is a legal obligation to do so.
5. International transfers
Some providers (Vercel, Google, Anthropic) may process data in the United States. These transfers are covered by the European Commission’s adequacy decision on the EU-US Data Privacy Framework (for certified entities) or, failing that, by the European Commission’s standard contractual clauses (Art. 46 GDPR). You may request information from us about the safeguards applied.
6. Your rights
You may exercise at any time your rights of access, rectification, erasure, restriction of processing, objection and portability, as well as withdraw the consent you have given without affecting the lawfulness of the processing carried out beforehand (Arts. 15 to 22 GDPR and 7.3 GDPR).
- How: through the contact form, stating “Exercise of data protection rights”, or by email to legalia2026@gmail.com. We reply within a maximum of one month, extendable by two further months in complex cases (Art. 12.3 GDPR).
- To prevent impersonation, we may ask you to prove your identity.
- Unsubscribing from the newsletter: unsubscribe link included in every email.
- Complaints: if you consider that we have not properly handled your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es; C/ Jorge Juan, 6, 28001 Madrid).
More detail on the exercise of rights, security measures and breach management can be found on our Data Protection page.
7. Security
We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR): encrypted communications (HTTPS), security headers, anti-bot protection and request rate limiting on forms, data minimisation and restricted access. The company’s contact details are not published in the website code: they are provided only after verification.
8. Changes to this policy
We may update this policy to reflect legal or website changes. The date of the latest version appears at the top. If the change is significant, we will notify you by appropriate means.
Tax ID (NIF) and email address, visible after an anti-bot verification.
For security, the phone number, email and tax ID are shown on request (anti-spam protection).