ENES
Let's talk!

Privacy policy

Last updated 28 September 2026

This policy explains what personal data we process when you visit https://codergeist.com or write to us through the contact form, what we use it for, and what rights you have. It is written under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD).

This is a company website with a contact form: there are no user accounts, no private area, no payments, no advertising and no cookies. The policy is short because the processing is.

The Spanish version of this policy is the binding one; this English text is provided for convenience.

1. Data controller

  • Registered name: Codergeist S.L.
  • Tax ID (NIF): B19864339
  • Registered office: Carrer de Campeny 8, 08030 Barcelona, Spain
  • Commercial Registry: Registro Mercantil de Barcelona, folio 1, hoja B-6191467, inscripción 1ª (IRUS 1000426060053)
  • Email: legal@codergeist.com

We have not appointed a data protection officer: the processing described here does not meet any of the conditions in Article 37 GDPR. For anything concerning your data, write to legal@codergeist.com.

2. What data we process

Only what you give us, and what your browser necessarily sends so that we can serve you the page.

Contact form data. The form has six fields, three of them required:

  • Name (required)
  • Email (required)
  • Your message (required)
  • Company (optional)
  • Phone number (optional)
  • How did you hear about us? (optional)

Optional fields you leave blank are not sent and are not recorded anywhere.

IP address. When you submit the form we keep your IP address for at most six hours, to prevent repeated submissions. It is not stored in any database: it lives in the memory of the server that handled the request and is gone when that server restarts.

Visits. When you load a page we count the visit with Vercel Web Analytics, which records the page, the page you came from, your approximate location (country, region and city), your operating system, browser and device type, and the time. To tell one visitor from another within a day it derives an identifier from the request itself; that identifier is discarded after 24 hours and is never linked to your name, your email or anything you send through the form. Nothing is stored on your device to do this.

We do not process special categories of data (Article 9 GDPR), we do not build profiles and we make no automated decisions affecting you. We do not buy data from third parties, and we receive no data about you from anyone but you.

3. Purposes and legal bases

  • Answering your enquiry and, where appropriate, preparing a proposal. Legal basis: Article 6(1)(b) GDPR — steps taken at your request prior to entering into a contract. You write to discuss possible work, and processing your message is what makes a reply possible.
  • Preventing abuse of the form. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in a public form not being usable to send bulk mail. It is the only thing the IP address is used for, and the reason it is kept so briefly.
  • Knowing how the site is used — how many people visit, which pages they read and whether they leave after the first one. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in aggregate statistics about our own website. We only ever see totals, never an individual visitor. You can object as described in section 6.

We do not use your data to send you marketing. We have no mailing list. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

4. How long we keep it

  • Your message is delivered to a private Telegram conversation and stays there for as long as the enquiry lasts and, if it leads to a business relationship, for the limitation periods that apply by law. You can ask us to delete it sooner.
  • Your IP address: six hours at most, and in practice less, because any server restart erases it.
  • Visit records: the identifier that tells visitors apart is discarded after 24 hours. What remains are anonymous visit counts, available to us for twelve months; Vercel may keep them longer.

5. Who else has access

We do not sell or share your data. To operate, the site relies on three providers acting as processors or as necessary recipients:

  • Vercel Inc. — website hosting and visit statistics. Their servers handle every request, which includes the form data in transit, and count visits as described in section 2.
  • Telegram — form messages are delivered to a private Telegram conversation and kept there.
  • Google Ireland Limited (Google Workspace) — the company's email, including any reply we send you and anything you send us at legal@codergeist.com.

We may also disclose your data to public authorities and courts where a legal obligation requires it.

International transfers. Some of these providers are established outside the European Economic Area or may process data outside it. Those transfers rely on the mechanisms in Chapter V GDPR — an adequacy decision or standard contractual clauses, depending on the provider. You can ask us which safeguard applies to each at legal@codergeist.com.

6. Cookies and analytics

This site sets no cookies and stores nothing on your device. None: not technical, not session, not analytics, not advertising. We do not profile visitors.

Visits are counted with Vercel Web Analytics, which works without cookies or any other storage on your device, and whose script is served from our own domain. So are the fonts, so loading the page makes no third-party request from your browser. That is why you will not find a cookie banner here: there is nothing to consent to.

If you would rather your visit were not counted, turn on Global Privacy Control in your browser. While it is on, the site sends nothing to Vercel Web Analytics.

7. Your rights

You may exercise the following rights at any time:

  • Access — to know what data of yours we process, and obtain a copy.
  • Rectification — to correct data that is inaccurate or incomplete.
  • Erasure — to have it deleted when it is no longer necessary.
  • Objection — to object to processing based on our legitimate interest.
  • Restriction — to have us keep it but stop using it, in the cases the GDPR provides for.
  • Portability — to receive your data in a structured, commonly used format.

To exercise them, write to legal@codergeist.com saying which right you wish to exercise. We may ask you to prove your identity if we cannot otherwise confirm it. We will reply within one month of receiving your request, extendable by two further months if it is complex, in which case we will tell you.

If you believe we have not handled your request properly, you can complain to the supervisory authority where you live or work. Ours is the Agencia Española de Protección de Datos (https://www.aepd.es), calle Jorge Juan 6, 28001 Madrid.

8. Security

The site is served over HTTPS only, with HSTS and a set of security headers restricting framing of the site inside third-party pages, cross-origin referrer leakage, and access to the camera, microphone and geolocation. Form data travels encrypted.

No security measure is absolute and we cannot guarantee that no incident will occur. Should one occur that poses a risk to your rights, we will tell you and notify the supervisory authority as required by Articles 33 and 34 GDPR.

9. Minors

The site is aimed at businesses and professionals, not at children under 14, and we do not knowingly collect their data. If we learn that we have done so without the consent of whoever holds parental responsibility, we will delete the information.

10. Changes to this policy

If we change how we process your data, we will update this policy and the "last updated" date at the top. The published version is always the one in force.

11. Contact

For anything about this policy or your personal data: legal@codergeist.com.

For anything else, the site's contact form or info@codergeist.com.