Privacy Policy

This policy explains how CT Retention Loop, S.L. handles your personal data when you visit the CTRL website, email us or fill in the contact form. It follows the General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD).

1. Data controller

CT Retention Loop, S.L.
Tax ID (NIF): B05620372
Registered office: Via Laietana, 46, Principal 1ª, 08003 Barcelona
Phone: +34 617 092 083
Privacy contact: legal@askctrl.com

2. Scope

This policy covers the CTRL website and the contacts that reach us through it or by email. For all of them we are the data controller.

If you are an end customer of a store that works with CTRL, that store is the controller of your data. We process it on the store's behalf and under our contract with it, so requests about that data should go to the store.

3. What data we process and where it comes from

Most of this data comes from you. The rest is generated when you use the site: the page, language and date of a form submission and the technical connection data your browser sends.

• Contact and demo form. Name, email and message, which are required because we can't reply without them. Optionally, phone, company, website, your store's annual GMV and the service you are interested in. With each submission we also keep the page you sent it from, the language and the date.
• Emails you send us. Your email address and whatever you tell us in the message.
• Inbox check. The answers you tick on the Contact page stay in your browser and never reach us. We only receive them if you send them inside the contact form.
• Technical connection data. To serve the site, our server processes your IP address, browser, the page you request, the page you came from and the time, so it can deliver the page and protect it from abuse. We also use your IP to limit the number of form submissions.
• Measurement and session recordings, only if you accept them. With your consent in the cookie banner, Google Analytics records the pages you visit, how you got here, your approximate location, device and browser, under a pseudonymous identifier. Microsoft Clarity records clicks, scrolling and mouse movement, with all text and form fields masked. Neither tool receives your name or email address.

The site uses no advertising tools. Please don't include health data or other special categories of data, or data about your own customers, in the form.

4. Why we use it and on what legal basis

• Replying to your request and preparing the demo or proposal you ask for. Legal basis: steps taken at your request before entering into a contract (Art. 6.1.b GDPR).
• Following up on that request with the company you represent. Legal basis: our legitimate interest in handling and developing the business relationship (Art. 6.1.f GDPR).
• Protecting the site and the form from abuse, through the form's submission limit and the server's technical logs. Legal basis: our legitimate interest in the security of the site (Art. 6.1.f GDPR).
• Meeting legal obligations, such as answering requests from authorities or keeping records. Legal basis: legal obligation (Art. 6.1.c GDPR).
• Measuring how the site is used and improving it, with Google Analytics and Microsoft Clarity. Legal basis: your consent (Art. 6.1.a GDPR and Art. 22.2 of Spain's LSSI), which you give or refuse in the cookie banner and can withdraw at any time from “Cookie settings” in the footer.

Where we rely on legitimate interest, we consider that your interests and rights do not override it, because this is business contact data you give us and the use is what you would expect when you write to us. You can object at any time by writing to legal@askctrl.com.

Using the form does not sign you up to any mailing list. We will only send you marketing you haven't asked for if you give us your consent (Art. 6.1.a GDPR), and you can withdraw it whenever you like.

5. How long we keep it

• Form requests and emails. 3 years from the last contact, unless a business relationship follows.
• If you become a client. For the length of the contract plus 6 years, in line with Spanish limitation periods.
• Copy of each submission in the automation tool. 14 days, then deleted automatically. The original stays in the sales team's inbox, under the period for requests.
• IP address for the submission limit. Counted in the server's memory and forgotten within 20 minutes at most. Like any visit, the submission also appears in the server's technical logs.
• Server technical logs. 90 days, then deleted.
• Record of the notice sent through Brevo. 6 months, then deleted automatically. Brevo keeps no copy of the message content.
• Measurement (Google Analytics). 14 months; its cookies expire after 13 months.
• Session recordings (Microsoft Clarity). 30 days. Microsoft may keep recordings we mark as favourites and a random sample for up to 9 months.
• Records the law requires us to keep. The period each law sets, generally 5 to 6 years.

When each period ends, the data is blocked for as long as liability arising from its processing can be claimed, and then deleted.

6. Who we share it with

We do not sell your data. Only the providers we need to run the site and the form can access it. They process it on our behalf, directly or as sub-processors of our providers, under contract and following our instructions.

• Hostinger International Ltd. (Cyprus), which hosts the site on a server in Paris, France.
• Our technical provider, which runs the automation tool (n8n, on a server in Frankfurt, Germany) that receives each form request and forwards it to the sales team.
• Brevo (France), which emails the sales team a notice of each request.
• Google Ireland Limited (Google Workspace), which runs our email, including the mailboxes you write to.
• Google Ireland Limited (Google Analytics), which measures visits on our behalf if you accept measurement.

If you accept session recordings, Microsoft Ireland Operations Limited (Microsoft Clarity) receives that data as a controller in its own right, under the Microsoft Privacy Statement.

We may also disclose data to courts, authorities or law enforcement when the law requires it. If the company merges or sells its business, the data would pass to the new owner with the same safeguards.

7. International transfers

The site and the automation tool run on servers in the European Economic Area. Google may process the data in our email outside it; that transfer relies on the Standard Contractual Clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914), which are part of its data processing terms.

Google may also process measurement data outside the European Economic Area, under the same clauses in its data processing terms. Microsoft transfers Clarity data from Microsoft Ireland Operations Limited to Microsoft Corporation (United States) under Standard Contractual Clauses; Microsoft Corporation is also certified under the EU-U.S. Data Privacy Framework.

If any other provider processes data outside the European Economic Area, we apply the same safeguard. You can ask for a copy of the clauses at legal@askctrl.com.

8. Automated decisions

The site makes no automated decisions about you and does not build profiles from your data. If you accept measurement and recordings, we use them to improve the site: we look at overall figures and at individual recordings, never to make decisions about a person.

9. Your rights

You can exercise these rights at any time:

• Access, to find out what data we hold about you and get a copy.
• Rectification, to correct inaccurate or incomplete data.
• Erasure, to have your data deleted when it is no longer needed or there is no basis to process it.
• Objection, to processing based on our legitimate interest.
• Restriction, to have us stop using your data while a complaint or a question about its accuracy is resolved.
• Portability, to receive the data you gave us in a structured, commonly used format, or to have us send it to another controller.
• Withdrawal of consent, where you gave it, without affecting earlier processing.

Write to legal@askctrl.com and tell us which right you want to exercise. We reply within one month, extendable by two more if the request is complex, and we may ask you to verify your identity. It is free, unless the request is manifestly unfounded or excessive.

If you think we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid, Spain) or with the supervisory authority in your country of residence within the European Economic Area.

10. Children

The site is not aimed at children under 16, and we do not knowingly collect their data. If we find out we have, we delete it. You can let us know at legal@askctrl.com.

11. Security

We apply technical and organisational measures suited to the risk. The site and form submissions always travel over an encrypted connection (HTTPS), only the team members who need the data can access it, and we work with providers that offer security guarantees.

If a security breach affected your data, we would notify the Spanish Data Protection Agency within 72 hours and you as well where the law requires it.

12. Cookies

The site only sets measurement cookies (Google Analytics and Microsoft Clarity) if you accept them in the banner, and you can change your choice at any time. The Cookie Policy lists what is stored and why.

13. Changes to this policy

If we change this policy, we will post the new version on this page with its date. If the change is significant, we will also flag it clearly on the site.