Data controller
The data controller is Qrea Corporacion Empresarial SL. For questions about your personal data or to exercise your rights, email contacto@qreacorporacion.com with “Data protection” in the subject line.
The data we process
We process the information you provide when submitting an opportunity or contacting us: your name, email address, phone number if supplied, company or project, general location, proposal category, links and the information you include in your message.
The website and its services may generate limited connection, incident and security data, such as an IP address, date and time, requested path or technical browser information, as needed to deliver the service and prevent abuse. These data are not used for behavioural advertising.
The form identifies the fields needed to handle an enquiry. Other fields are optional. We do not request health data, medical records, patient information, identity documents or special categories of personal data. Please do not include them, and only disclose third-party information you are entitled to share.
Purposes and legal bases
Managing and assessing opportunities: we use the data to receive, organise, assess and respond to a proposal, conduct related communications and, where appropriate, prepare a potential transaction. When you act on your own behalf and request steps prior to entering into a contract, the basis is Article 6(1)(b) GDPR. Where you act as a representative, professional contact or intermediary, the basis is QREA’s and the parties’ legitimate interests in exploring and managing a business relationship under Article 6(1)(f) GDPR.
Corporate and professional enquiries: the basis is our legitimate interest in responding to communications voluntarily addressed to QREA and maintaining business relationships. Requests to exercise data rights and other legal requirements are handled on the basis of legal obligations under Article 6(1)(c) GDPR.
Security and abuse prevention: we process limited technical information to protect the website and its users, prevent abusive submissions and resolve incidents, based on our legitimate interest in maintaining a secure service.
Submitting a proposal does not subscribe you to a newsletter or unrelated advertising. If an additional purpose requires your consent in future, we will request it separately. This policy is not a request for blanket consent to any use of your data.
How long we retain information
Enquiries and opportunities are retained for as long as needed to manage the communication and assessment. If no relationship develops, they are erased or anonymised no later than twelve months after the last relevant interaction, unless specific data must be retained under a legal obligation or to establish, exercise or defend legal claims.
Where a transaction begins, information is provided about the processing and retention periods for that relationship. Data retained for legal liabilities are restricted and, where applicable, blocked for the required periods, not kept as a marketing contact portfolio.
Routine technical logs are retained for up to thirty days and auxiliary abuse-limiting identifiers for up to twenty-four hours, except where specific information is strictly necessary to investigate a particular incident. Backups follow a maximum thirty-five-day cycle; erasure actions must be reapplied if a backup is restored.
Who may access the data
Access is limited to authorised people who need the information to handle an enquiry or assess an opportunity. Hosting, infrastructure, maintenance, security and email providers may also process data under the conditions and safeguards required for each service.
We do not sell data or share them indiscriminately with every group company. If a transaction requires disclosure to a subsidiary, vehicle or third party acting as an independent controller, we will provide the relevant identity or category, purpose and legal basis where required, before making a disclosure not covered by this information. Data may also be disclosed to authorities where legally required.
International transfers
Technology services may involve processing or access from outside the European Economic Area. Where a provider needs to make an international transfer, QREA requires the appropriate mechanism under Chapter V GDPR, such as an applicable adequacy decision or standard contractual clauses, together with any necessary additional measures.
You may request information about the providers and countries involved and a copy or explanation of the relevant safeguards at contacto@qreacorporacion.com. Storage location alone does not rule out international access or processing.
Your rights
You may request access, rectification or erasure, restriction of processing and object to processing based on legitimate interests. Portability applies where the statutory conditions are met. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Send your request to QREA at contacto@qreacorporacion.com, explaining which right you wish to exercise. You do not need to attach an identity document automatically; proportionate additional information will only be requested if there are reasonable doubts about your identity.
Requests are generally handled within one month. Where a lawful extension applies, you will be informed of the extension and the reasons. You may complain to the Spanish Data Protection Agency at www.aepd.es without waiting for QREA’s response if you believe your rights have been infringed.
Automated decisions
Proposals received through this channel are not subject to decisions producing legal or similarly significant effects based solely on automated processing.
Security and updates
We apply appropriate technical and organisational measures in light of the service and its risks. No system can guarantee absolute security. Please avoid sensitive or confidential information at this initial stage.
This policy may be updated to reflect changes to the service or processing. Updates will not be used to retrospectively legitimise incompatible uses. Where a change requires specific information or consent, we will act in accordance with applicable law.