Privacy policy
Data controller
AJUTIA, a project from the Terres de l'Ebre in the process of being constituted as a cooperative. The current controller, until the cooperative is constituted, is Robert Vlad Ulica (NIF X7631252J).
- Name: Robert Vlad Ulica
- NIF: X7631252J
- Email: admin@ajutia.com
Data we collect
We collect the data you provide in the portal forms:
Contact form: name, email, phone (optional), organization (optional), segment, message (optional).
Pilot form: organization, contact person, email, phone (optional), segment, organization type, municipality, population, needs, timeline.
Newsletter: email.
Additionally, the backend functions read the request IP to apply the submission rate limit; the IP is kept in temporary memory and is not persisted to the database. The hosting platform may generate technical logs according to its own configuration.
Purposes and legal bases
We process your data to handle your contact or pilot request and, if you register your interest in the newsletter, to record that interest in the internal list. There are currently no active campaigns or communications being sent; the list remains inactive. Any future communication will require reviewing the purpose and legal basis and the conditions before activation, and the current consent does not authorise any future sending. The legal basis for this interest registration is your consent (Art. 6.1.a GDPR).
Recipients
Contact, pilot and newsletter requests are recorded in the application's backend, hosted on the Base44 platform. After saving the request, the portal attempts to send an email notice (via the platform's email integration) to the admin role, with the request type and a link to the admin panel; this notice does not include the data you filled in the form. The send may fail and does not guarantee delivery.
The diagnostic link sends only the visit and the «from=portal» attribution parameter to the external destination; it does not send the form responses. The external destination is an independent service, whose processing is governed by its own privacy notice (see «External redirect (diagnostic)» below).
Base44 is mentioned here only as the platform used by the application; this page does not dictate its legal role as controller or processor.
The portal loads fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). This load transmits to Google at least the IP address of the request; Google may process it according to its own policy, which AJUTIA does not control. We do not send the provider the data you fill in the forms. You can block this load; the portal works with system fonts.
Retention
We retain the data for as long as necessary to handle your request. [PENDING LEGAL REVIEW: specific retention period]. We do not have an automated deadline-based deletion mechanism; you can request deletion of your data at any time.
Deletion is carried out by the application administrator at your request, and covers contact and pilot data stored in the Portal backend. We record it through an internal log that stores a hash of the email, the date, the administrator who requests it and the number of affected records according to the pre-deletion snapshot (not verified). Deletion is performed on the Lead and PilotRequest entities via deleteMany, which is not transactional: if one entity fails, the other may be partially deleted. We do not cover deletion in idempotency receipts, backups or platform logs, which may retain data according to their own policy. Data export (access right) does not paginate and may be incomplete for emails with many records. Processing is human and verified manually.
To detect duplicate submissions, the backend stores an internal receipt for each request with the idempotency key and a SHA-256 hash (unsalted) of the normalized content. This hash is not pseudonymisation: an unsalted hash of predictable inputs (such as email) can be correlated via dictionary attacks. Receipts are accessible to administrators only (RLS).
Rights
You can exercise your rights of access, rectification, erasure, restriction of processing, objection and portability by writing to admin@ajutia.com.
You can also lodge a complaint with the competent supervisory authority: the Spanish Data Protection Agency (AEPD), based in Madrid (c/ Jorge Juan, 6, 28001 Madrid). You can submit the complaint through the AEPD electronic site (www.aepd.es) or by any of the means established in article 16.4 of the LOPDGDD.
External redirect (diagnostic)
The diagnostic opens on another domain. The AJUTIA Portal does not send your answers or filled-in data there; only the visit and the «from=portal» parameter. Any processing at the destination must be explained in the destination's own privacy notice; AJUTIA has not verified its legal identity or its notice. Before entering personal or confidential data, review it; if it is not clear, contact AJUTIA.