Who we are
The data controller for the data collected via this site is Sundata Lab, a company incorporated under Spanish law (Sociedad de Responsabilidad Limitada), CIF B72456676, with its registered office at Centro de Negocios Puerta de Banús, Edificio B, 29660 Nueva Andalucía, Marbella (Málaga), Spain. Given the nature and volume of the data processed, Sundata Lab is not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR; any question regarding your data may nonetheless be addressed via our Contact page, which serves as our privacy point of contact.
Data we collect
We collect only the data you provide to us directly or the data technically generated by your browsing:
- Identification and contact data: name, job title, company, professional email address, phone number (optional), entered in our forms (contact, meeting request, diagnostic request).
- Content of your request: subject and message you write, and any information you choose to attach to it.
- Data provided as part of a service engagement: if you commission a compliance diagnostic assignment or custom development, the information required to carry it out (inventory of your tools, description of your processes) is processed in accordance with the contractual terms agreed with you, solely for the purpose of performing the service.
- Technical browsing data: no audience measurement tool is currently deployed on this site; should such a tool be added, this policy would be updated to specify the technical browsing data then collected (IP address, browser type, pages viewed, visit duration).
We apply the principle of data minimization: only the data strictly necessary for the purpose pursued is collected. No sensitive data within the meaning of Article 9 of the GDPR (health, racial or ethnic origin, political, religious or trade union opinions, sexual orientation) is collected via this site.
Purposes and legal bases
- Responding to your contact requests (audit, demo, diagnostic, question): legal basis, pre-contractual measures taken at your request.
- Providing you with Isalis or our custom services, should you become a client: legal basis, performance of a contract.
- Carrying out an audit or compliance diagnostic that you have commissioned: legal basis, performance of a contract.
- Complying with our legal obligations, in particular accounting, tax and regulatory obligations: legal basis, legal obligation.
- Ensuring the security of the site and preventing fraud: legal basis, legitimate interest.
- Sending you our guides or news, where you have consented to this: legal basis, consent, revocable at any time.
Retention period
We retain your data for a period proportionate to the purpose pursued, in accordance with the GDPR's storage limitation principle:
- Contact request with no commercial follow-up: 3 years from the last exchange, then deletion or anonymization.
- Contractual relationship (client): for the entire duration of the contract, then archiving in accordance with applicable statutory limitation periods (up to 10 years for accounting records).
- Browsing data from any future audience measurement tool, should one be deployed: 13 months maximum, in accordance with the usual periods recommended for this type of tracker.
Recipients and processors
Your data is intended for Sundata Lab teams authorized to process your request. It may be shared with the following technical service providers, in compliance with the GDPR:
- Infomaniak Network SA (Geneva, Switzerland): hosting of the site and associated data, in ISO 27001 certified data centers.
- FormSubmit: technical processing of the site's contact form submissions.
We do not sell or rent your data to third parties, and do not share it for commercial purposes without your consent.
Transfers outside the European Union
Our data is hosted in Switzerland, a country recognized by an adequacy decision of the European Commission as offering a level of protection equivalent to that of the European Union: no additional safeguard is therefore required for this transfer. Should any of our service providers process data outside the European Union or outside a country covered by an adequacy decision, such transfer would be governed by the safeguards provided for under the GDPR, in particular the European Commission's standard contractual clauses.
Your rights
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access, rectification and erasure of your data;
- Right to restriction of and objection to processing;
- Right to the portability of the data you have provided to us;
- Right to withdraw your consent at any time, where processing is based on it.
You may exercise these rights by writing to us via our Contact page. We undertake to respond within one month, which may be extended by a further two months for complex requests, in accordance with Article 12 of the GDPR. As Sundata Lab is established in Spain, the competent supervisory authority is the Agencia Española de Protección de Datos (AEPD, Spanish Data Protection Agency, aepd.es). If you reside in another Member State of the European Union, you may also lodge a complaint with the data protection authority of your own country, for example the Commission nationale de l'informatique et des libertés (CNIL) for French residents, in accordance with Article 77 of the GDPR.
Security
We implement technical and organizational measures proportionate to the risk to protect your data against unauthorized access, loss, alteration or disclosure:
- Encryption of exchanges between your browser and the site (HTTPS/TLS);
- Hosting in infrastructure certified ISO 27001, ISO 14001 and ISO 50001 (see our legal notice);
- Access to data restricted to authorized personnel, limited to the scope of their duties;
- Confidentiality commitments applicable to anyone handling your data, including our service providers.
Cookies and trackers
This site operates without cookies: no audience measurement, advertising or personalization tool is deployed on it. Fonts are loaded from Google Fonts servers (fonts.googleapis.com, fonts.gstatic.com), which does not set any cookie but does transmit the visitor's IP address to Google, which is necessary to deliver the font file. When submitting a form, you are redirected to the formsubmit.co domain, a third-party provider whose potential cookies are not covered by this policy and are governed by its own terms. Should an audience measurement tool or any other tracker be added, this page would be updated accordingly, with your prior consent obtained where required.
Minors
This site is intended for business executives and professionals. It is not intended for minors, and we do not knowingly collect data concerning them. If you believe a minor has provided us with data by mistake, please contact us via our Contact page so that we can delete it.
Changes to this policy
This policy may be updated to reflect changes in our practices, our tools or applicable regulations. The version in force is the one published on this page. Last updated: August 18, 2026.
Contact us
For any question regarding this policy or the exercise of your rights: via our Contact page, or by mail to Sundata Lab, Centro de Negocios Puerta de Banús, Edificio B, 29660 Nueva Andalucía, Marbella (Málaga), Spain.
