1. Who is responsible for your data
Controller: Completar razón social Tax ID: Completar NIF Registered address: Completar domicilio Email for privacy and data-subject rights: legal@matrivex.es Data Protection Officer: Completar si aplica Brand used on this website: Activo Inteligente
2. What data we may process
The website is designed to collect little data and only for a defined purpose.
2.1. Requests for assessment
When you send the form, we may process:
- name;
- company;
- email address and/or telephone number;
- description of the work, problem or improvement you want us to study;
- systems or tools involved, if you choose to provide them;
- approximate frequency or volume, if you choose to provide it;
- additional comments, if included;
- language of the request;
- date and time of receipt;
- the immediate entry context to the form, where applicable, such as the block or CTA from which it was opened, without keeping a browsing history;
- the version of the privacy information shown;
- evidence of the commercial communications choice, where applicable.
We do not need internal documents, passwords, special-category personal data or personal information about unrelated third parties in order to receive an initial assessment request. If a case proceeds and additional information is required, the appropriate channel and safeguards will be decided at that point.
2.2. Security and operation
Systems serving the website may generate technical logs such as IP address, date and time, requested resource, response code, basic technical headers and other information needed to diagnose errors, detect abuse, automated malicious activity or security incidents.
2.3. Analytics
If you accept analytics, Google Analytics 4 will process identifiers and browsing data needed to produce website usage statistics. The analytics tag is not loaded before consent.
2.4. Commercial communications
If you select the optional box in the form, evidence of that consent is also stored so that we may send occasional electronic commercial communications from Activo Inteligente about automation, products and news.
2.5. Referral access
The private /referidos/ route embeds the external referral application in an iframe. The public shell does not collect the associate identifier or TOTP code and does not manage the session: those data are entered inside the referral application and sent directly to its API. The shell and the application exchange only the technical UI messages REFERRAL_APP_READY and REFERRAL_APP_HEIGHT; identifiers, credentials, session tokens, TOTP values and opportunity data are not sent through that channel. The external application uses strictly necessary authentication and CSRF-protection cookies independently of analytics consent on the public website. Where the service requires acceptance of current terms or legal information, that acceptance is handled inside the application before functional access is enabled.
3. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Request by an individual acting on their own behalf | Assess the case and take requested steps before a possible contract | Steps at the request of the data subject prior to entering a contract (Art. 6(1)(b) GDPR) |
| Request by a professional acting for a company or organisation | Manage the opportunity and maintain the professional relationship with the organisation represented | Legitimate interests (Art. 6(1)(f) GDPR); where its conditions are met, Art. 19 Spanish LOPDGDD for professional contact data |
| Technical logs and endpoint protection | Security, abuse prevention, diagnostics and protection of infrastructure | Legitimate interests in protecting systems (Art. 6(1)(f) GDPR) |
| Legal obligations and valid requests | Comply with obligations binding on the controller | Legal obligation (Art. 6(1)(c) GDPR) |
| Google Analytics 4 | Measure website use and improve content, navigation and conversion | Consent (Art. 6(1)(a) GDPR and applicable Spanish ePrivacy/LSSI rules for non-exempt storage or access) |
| Optional commercial communications | Send occasional electronic information about Activo Inteligente | Consent (Art. 6(1)(a) GDPR and the applicable electronic communications regime) |
The required privacy acknowledgement box is not the legal basis for processing. It is used to make clear that the person has had access to the information. The commercial communications box is separate, optional and never preselected.
4. Which data is required
To submit a request we need:
- name;
- company;
- a sufficiently clear description of the problem;
- at least one contact method: email or telephone.
Systems, volume and additional comments are optional. Commercial consent is not required in order to send or assess a request.
5. Who may receive or access the data
Personal data is not sold and is not disclosed to third parties for their own commercial use.
Access may be provided, only where necessary, to hosting, infrastructure or maintenance providers acting as processors; the analytics provider when analytics has been accepted; providers later incorporated into the operation when required and properly covered by the relevant agreement and information; and public authorities, courts or other competent bodies where disclosure is legally required.
The actual list of processors used in production must be checked before publication and kept internally up to date.
6. International transfers
The infrastructure of the controller will be reviewed before publication to identify any international transfers. If Google Analytics is enabled after consent, data may be processed by Google entities or infrastructure located outside the European Economic Area. The applicable transfer mechanism and contractual safeguards will be verified against the contracts and configuration actually used at launch.
No provider will be described here as offering a particular transfer safeguard unless that safeguard is actually in place for the production service.
7. Retention periods
Assessment requests that do not become a project
They will be retained for the time reasonably necessary to review, respond to and follow the commercial opportunity, and afterwards for a limited period needed to resolve possible questions or avoid losing the context of a recently discussed opportunity. The operational retention period must be fixed internally before launch and applied to the database, not merely stated in this policy.
Opportunities that become a proposal, customer or contractual relationship
The information required for the commercial or contractual relationship may be retained for the periods required by the relationship and by applicable legal obligations.
Commercial communications
Until consent is withdrawn or the communication programme is ended, without prejudice to retaining the minimum evidence necessary to demonstrate the consent previously given and its withdrawal.
Security logs
For the limited period established in the production logging policy, proportionate to the security purpose.
Google Analytics 4
User and event data retention will be configured to 14 months. Browser cookies have the separate duration described in the Cookie policy.
8. Your rights
Where the applicable conditions are met, you may request access, rectification, erasure, restriction, objection or portability of your personal data and may withdraw consent at any time without affecting processing already carried out lawfully before withdrawal.
To exercise your rights, contact legal@matrivex.es. We may request the information reasonably necessary to verify identity and understand the request.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or another competent supervisory authority where appropriate.
9. Automated decisions and profiling
This public website does not use the information in the assessment form to make decisions producing legal or similarly significant effects through an automated system, and it does not use commercial profiling to decide whether a request will be accepted.
Analytics, where consented to, is used for aggregate website measurement rather than to make individual project decisions.
10. External contact channels
Telephone, WhatsApp and Telegram are external communication channels. If you choose to use them, the provider of the relevant channel will also process data under its own rules. Activo Inteligente does not load WhatsApp or Telegram widgets simply by displaying their links on the website.
11. Security
The website and assessment endpoint are designed to minimise the public attack surface. Security measures include server-side validation, request-size limits, rate limiting, least-privilege database access, prepared statements, restrictive security headers, TLS and controlled logging. Security measures are reviewed against the production deployment rather than assumed from the frontend alone.
12. Minors
The offer is directed at companies and professional users and the assessment form is not intended for minors.
13. Changes to this policy
This policy may be updated when the website, providers, processing activities or applicable rules change.
Last updated: 13 August 2026