Privacy Policy for the website and services
Last updated: 2026-10-28 · Official and binding version: Catalan.
1. Data controller
The controller of the personal data collected through this website and the contact channels is:
- Owner: NOEMA AUTOMATIONS, S.L.
- Tax ID (NIF): B88880364
- Address: Carrer Cabrera 15, 08519 Folgueroles (Barcelona)
- Privacy contact email: info@noemaautomations.com
- Data Protection Officer (DPO): Not appointed, as the conditions of art. 37 GDPR do not apply; queries to info@noemaautomations.com.
2. What data we collect and through which channels
| Channel | Data collected |
|---|---|
| Contact form / demo request | Name, company, phone, email, sector and message. |
| “Call me” form (noemaautomations.com/truca) | Name, clinic name, phone number, number of centres and, if you write it, what you are interested in; the language, page and ad you came from (UTM parameters). As proof of consent, the exact text you accepted, its version and the date. We do not store your IP address with the request. |
| Email and phone | Contact details and content of the communication. |
| Browsing and cookies | IP address, device identifiers and browsing data (see the Cookie Policy). |
| Content subscription / newsletter | Email and language. As proof of consent, the exact text you accepted, the policy version, the language and the date. We do not store your IP address with the subscription. |
| Professional networks (e.g. LinkedIn) and B2B prospecting | Professional contact details of companies and their representatives. |
3. Purposes and legal bases
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Handling enquiries and contact or demo requests | Pre-contractual measures at the data subject's request (art. 6.1.b). |
| Calling you to talk about the service when you ask us to with the “Call me” form. The call is made by a member of the team. | Consent (art. 6.1.a), which you can withdraw at any time: by telling us on the call or by writing to info@noemaautomations.com. |
| Remembering that you do not want to be called again (internal “do not call” list) | Legitimate interest (art. 6.1.f) in respecting your objection. We only keep the phone number. |
| Managing the contractual relationship with clients | Performance of a contract (art. 6.1.b). |
| Sending commercial communications about similar own services to clients | Legitimate interest (art. 6.1.f), with the right to object; or consent (art. 6.1.a) for non-clients. |
| Sending the newsletter (product news and new AI agents) to people who subscribe from the website | Consent (art. 6.1.a), which you can withdraw at any time with the unsubscribe link in every email. |
| B2B commercial prospecting to companies | Legitimate interest (art. 6.1.f), in accordance with the LSSI for electronic communications. |
| Compliance with legal obligations (tax, accounting) | Legal obligation (art. 6.1.c). |
| Marketing pixel (non-essential technology; see the Cookie Policy) | Consent (art. 6.1.a), which you give or withdraw in the cookie banner. |
| Aggregate visit measurement, without cookies (Vercel Web Analytics) | Legitimate interest (art. 6.1.f) in knowing how the website is used. |
| Website security and fraud prevention | Legitimate interest (art. 6.1.f). |
4. Retention periods
- Enquiries and contacts without contracting: up to 1 year from the last contact.
- “Call me” form requests: 12 months from the request if you do not become a client; after that they are deleted automatically. If you ask us not to call you, the number stays on the “do not call” list for as long as needed to respect it; if you fill in the form again, it is removed from it.
- Client data (contractual relationship): for the duration of the contract and, thereafter, for the statutory limitation periods (up to 6 years for commercial and accounting obligations, plus the applicable tax periods).
- Commercial communications / newsletter: until the data subject withdraws consent or objects. Every newsletter email has a link to unsubscribe. When someone unsubscribes we stop sending the newsletter; the address is kept marked as unsubscribed, with the consent record, so that it is not written to again by mistake and to be able to prove it, and it is deleted completely on request.
- B2B prospecting data: while the commercial interest is maintained and there is no objection.
- Browsing and cookie data: according to the duration stated in the Cookie Policy.
5. Recipients and international transfers
Data is not disclosed to third parties for their own purposes. The following providers may process it on the Agency's behalf, only to provide the relevant service and as data processors under a contract compliant with article 28 GDPR:
| Provider | What for |
|---|---|
| Vercel Inc. | Website hosting and aggregate, cookieless visit measurement. |
| Supabase | Database where contact, demo and call requests and newsletter subscriptions are stored (servers in the EU, Ireland). |
| Hetzner Online GmbH | Noema's server in Germany (internal management and email-sending tools). |
| Zoho (Zoho Mail) | Contact email (info@noemaautomations.com). |
| Google (Google Workspace) | Sales email. |
| Slack | Internal alert to the team when a contact, demo or call request arrives (the call alert does not include the phone number). |
| HubSpot | Management of business contacts (CRM). |
| Cal.com | Booking of the 30-minute session. |
| Anthropic | Replies from the website chat assistant, based on the text you type. |
| ElevenLabs and Twilio | Voice agent demo (conversation in the browser or a call to the number you give us). |
| Leadsy.ai / Instantly | Marketing pixel, only if you accept it in the cookie banner (see the Cookie Policy). |
Some providers may be located outside the European Economic Area. In such cases, international transfers are carried out with the appropriate safeguards set out in Chapter V of the GDPR, mainly the European Commission's Standard Contractual Clauses or valid adequacy decisions.
6. Use of artificial intelligence
The Agency uses artificial-intelligence tools in its activity. Through this website, no automated decisions with legal or significant effects are taken about users within the meaning of article 22 GDPR. Should any specific service incorporate such decisions, the data subject would be specifically informed and granted the corresponding rights (human intervention, expression of their point of view and the right to contest the decision).
7. Rights of data subjects
Anyone has the right to obtain confirmation as to whether we process their data and to exercise the rights of access, rectification, erasure, restriction of processing, portability and objection, as well as not to be subject to automated individual decisions. These may be exercised by sending a request to info@noemaautomations.com or to Carrer Cabrera 15, 08519 Folgueroles (Barcelona), stating the right being exercised and enclosing a copy of an identity document. Consent given may also be withdrawn at any time, without retroactive effect.
8. Right to lodge a complaint with the supervisory authority
If you consider that the processing of your data does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), c/ Jorge Juan 6, 28001 Madrid (www.aepd.es), or with the Catalan Data Protection Authority (APDCAT) where competent.
9. Security
The Agency applies appropriate technical and organisational measures to ensure data security and prevent its loss, misuse or unauthorised access (encryption, access control, backups, access logging).
10. Updates and versioning
This Privacy Policy may be updated to adapt it to regulatory or operational changes. Version: 1.3. Last updated: 2026-10-28.