What follows applies to apply.es, to the contact form on it and to messages that reach any @apply.es address. It does not cover data we handle inside client systems while supporting them: there the client is the controller and Apply acts as processor under a data processing agreement in line with Article 28 GDPR.
Data controller
Your personal data is controlled by the company that runs the Apply brand and the apply.es website. It is incorporated outside the European Union, yet the GDPR still applies to it because it offers services to people and businesses in Spain and elsewhere in the EU (Article 3(2) GDPR).
- Legal name - Apply LLP, director Andrey Vasin
- Registered address - Bukhar Zhyrau Boulevard 62B, 050057 Almaty, Kazakhstan
- Identification number (BIN) - 220540005599, the business identification number in Kazakhstan
- Privacy contact - office@apply.es
Data protection messages sent to office@apply.es go straight to the team member who looks after this area. Other legal details are in the legal notice.
What we collect
We ask for the minimum required to reply or to deliver a contract. The site never asks for ID numbers, medical details or anything else in the special categories, and it is not aimed at anyone under 14.
- Enquiry form - your name, your company if you give it, whichever contact detail you choose for our reply, the topic picked and the message itself.
- Technical data at submission - the page the form was sent from, your IP address and the browser's user agent. They help filter out junk submissions and catch abuse.
- Business relationship - names and details of the people we deal with at the client, billing information and correspondence tied to the contract.
- Support requests - the description of the problem, the ticket trail and a log of the actions taken by the engineer.
- Payments from individuals - amount, date and payment reference. Card data is handled by the payment provider and never reaches Apply.
Never type a password into the form or into an ordinary email. Credentials for your systems travel only through an encrypted route set up beforehand.
Purposes
- Replying to your message and drawing up a quote.
- Concluding a contract with you or your organisation and carrying it out.
- Handling support tickets and documenting what was fixed.
- Invoicing and complying with bookkeeping and tax law.
- Keeping junk submissions, bots and intrusion attempts away from the site.
- Establishing, exercising or defending legal claims in the event of a disagreement.
We do no profiling, make no automated decisions that affect you and send no marketing without your consent.
Legal grounds and retention
Each purpose rests on a ground from Article 6 GDPR and has its own retention period. When that period ends, the data is blocked for as long as liability could still be claimed, as Article 32 LOPDGDD requires, and is then erased.
| Purpose | Legal ground | Retention |
|---|---|---|
| Replying to an enquiry sent by form or email | Art. 6(1)(b) GDPR (pre-contract steps you asked for) and 6(1)(f) (legitimate interest in replying to people who contact us) | While the enquiry and the exchange that follows it are open, or until you object |
| Contract delivery and support work | Art. 6(1)(b) GDPR (performance of a contract) | Throughout the contract, then until any related claims become time-barred |
| Invoices and accounting records | Art. 6(1)(c) GDPR (legal obligation under accounting and tax rules) | The periods set by the applicable commercial and tax legislation |
| Site security and abuse prevention | Art. 6(1)(f) GDPR (legitimate interest in protecting the site) | IP address and user agent: kept only while useful for spotting and looking into abuse |
| Preferences kept in your browser | Strictly necessary for basic functions | Until you clear them |
Cookies and browser storage
apply.es runs no analytics tools, no advertising pixels and no tracking cookies. It relies on technical cookies alone: a session cookie plus a CSRF token that protects the form. The form will not submit without them, and both vanish once the session times out. Because they are strictly necessary, Article 22(2) of Spain's LSSI-CE does not require consent for them.
On top of that, the browser's local storage (localStorage) holds three small preferences: the area chosen in the region picker, light or dark theme, and the fact that you have already seen the cookie notice. They stay on your device, never travel to our server, and can be cleared from the browser settings whenever you like. If analytics were ever introduced, this page would change beforehand and you would be asked to agree.
Recipients
Your data is never sold and never used for adverts. Outside access is restricted to the providers essential to running the business, always acting as processors under contract and on our instructions.
- Hosting provider - operates the machine that serves the website and keeps the form entries. Its details are given in the legal notice.
- Email provider - keeps the @apply.es inboxes and our client correspondence.
- Payment provider - processes card payments from private individuals.
- Authorities - only where a legal rule demands it, for instance an order from a tax authority or a court.
International transfers
To be upfront about it: Apply LLP has its registered address in Kazakhstan, a country for which the European Commission has not adopted an adequacy decision. The team also works remotely, and some people on it open the data from countries beyond the EEA. Your data may therefore be processed outside the EEA.
Where this amounts to an international transfer, it is covered by the standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR), together with technical safeguards: encrypted links, personal logins and 2FA. For data strictly needed to deliver a service you have signed up for, the transfer also relies on Article 49(1)(b) GDPR. You can ask for a copy of the safeguards in place by writing to office@apply.es.
Security and erasure
After the purposes listed above are fulfilled and the blocking stage has ended, the data is deleted, or anonymised to the point where no person can be recognised in it.
- Only staff whose tasks require the data can open it.
- Every login is personal, with 2FA switched on whenever a system offers it.
- Connections are encrypted and backups are held apart from the production environment.
- If a breach affecting personal data ever occurred, we would report it to the AEPD within 72 hours and, where the risk is high, tell the people affected as well.
Your rights
The GDPR and the LOPDGDD give you the following rights, which you may use at any time and free of charge:
- Access to your data and a copy of it (Article 15).
- Correction of inaccurate or outdated data (Article 16).
- Erasure of your data (Article 17).
- Restriction of processing, say during the review of a complaint (Article 18).
- Receiving your data in a structured, machine-readable file to take elsewhere (Article 20).
- Objecting to processing that relies on legitimate interest (Article 21).
- Not being subject to decisions based solely on automated processing (Article 22).
To use any of them, email office@apply.es and say which right you are exercising. If we have reasonable doubts about your identity, we may ask for extra information to confirm it. We reply as quickly as we can and in any case within one month, extendable by two further months for complex requests, in which case we would let you know within the first month.
If you feel your request was not handled properly, or that your data is being processed wrongly, you are entitled to lodge a complaint with the Spanish Data Protection Agency: aepd.es.
Invoices and accounting records cannot be erased before the statutory retention period runs out, even at your request. Until then they stay blocked and are used only to meet legal obligations; after that they are deleted.
Contact about your data
Questions on this policy and requests for access, correction or erasure go to office@apply.es. We check that mailbox Monday to Friday, 9:00-18:00 Spanish time (CET). All other channels are listed on the contact page.