Privacy Policy

Last updated: July 7, 2026

1. Data controller

The controller of the personal data collected through this website is:

Controller: Genís Barberà Gutiérrez, operating under the trade name Elume.

Postal address: 17463 Flaçà, Girona, Spain.

Email: privacidad@elume.es

Website: elume.es

You may contact the controller using the email address above regarding any matter related to this Privacy Policy or the processing of your personal data.

2. Scope

This Privacy Policy governs the processing of personal data provided through:

• Elume’s contact form.
• Communications sent by email.
• Requests for information, meetings, or sales proposals.
• The assessment, preparation, and management of potential pilots.
• Professional or contractual relationships that may be established with Elume.
• The browsing and technical use of the website.

3. Personal data processed

Depending on your relationship with Elume, the following categories of data may be processed:

Identification and contact information

• First and last name.
• Email address.
• Other contact information provided voluntarily.

Professional information

• Company name.
• Industry or type of company.
• Job title or professional role, when provided.
• Information related to the company’s business activities or sales operation.

Information included in communications

• The content of inquiries and messages.
• Information provided during meetings or subsequent communications.
• Needs, interests, and circumstances related to a potential collaboration, pilot, or engagement.

Contractual and administrative information

When a professional relationship is formalized, Elume may process the information necessary to prepare proposals, manage pilots, provide services, issue invoices, and comply with the corresponding legal obligations.

Technical information

While you browse the website, technical information may be processed, including your IP address, date and time of access, browser information, server logs, and information required to ensure the security and proper operation of the website.

Elume does not request special categories of personal data through the form. Please do not include particularly sensitive information in the message field.

4. Purposes and legal bases for processing

Handling contact requests

Personal data will be processed to:

• Respond to inquiries.
• Contact the data subject.
• Schedule a meeting.
• Understand the company’s sales operation.
• Provide information about Elume.
• Assess whether the platform could provide value to the organization.

The legal basis for processing will be taking steps at the request of the data subject prior to entering into a contract or, where this does not apply, Elume’s legitimate interest in responding to and managing the requests it receives.

Follow-up on sales opportunities

Elume may conduct reasonable follow-up regarding an inquiry, meeting, or sales opportunity initiated by the data subject in order to continue the conversation, answer questions, prepare a proposal, or assess a potential pilot.

The legal basis for processing will be taking steps prior to entering into a contract and, where applicable, Elume’s legitimate interest in managing its professional and business relationships.

The data subject may object to this follow-up at any time.

Management of pilots, clients, and contractual relationships

If a pilot, collaboration, or contractual relationship is formalized, personal data will be used to:

• Prepare and manage proposals.
• Define and develop the scope of the pilot.
• Provide the agreed services.
• Maintain professional communications.
• Manage administrative, accounting, and billing tasks.
• Comply with applicable legal obligations.

The legal basis for processing will be the performance of a contract or taking steps prior to entering into a contract, as well as compliance with legal obligations.

Marketing communications and newsletters

Elume may send updates, content, or marketing communications only when the person has previously provided consent through a specific checkbox or other dedicated mechanism.

Subscription is voluntary, and consent may be withdrawn at any time using the unsubscribe link included in the communications or by writing to Elume’s contact email address.

The checkbox confirming that the Privacy Policy has been read does not, by itself, constitute authorization to receive newsletters or advertising.

Website security and operation

Technical information may be processed to:

• Ensure the proper operation of the website.
• Prevent abusive or fraudulent use.
• Detect errors or security incidents.
• Protect systems and information.
• Maintain technical logs when necessary.

The legal basis for processing will be Elume’s legitimate interest in ensuring the security and proper operation of its systems.

5. Required information

Fields marked as required in the form are necessary to process the request.

If this information is not provided, Elume may be unable to respond to or properly manage the inquiry.

Fields not marked as required are optional.

The user confirms that the information provided is accurate, complete, and up to date and agrees to communicate any relevant changes.

6. Retention periods

Inquiries that do not result in a contractual relationship

Information related to inquiries, meetings, and sales opportunities that do not result in a client relationship will be retained for a maximum of two years from the last relevant interaction.

It may be deleted earlier if the person requests its erasure or if it is determined that the information is no longer necessary.

Pilots and clients

Personal data will be retained for as long as the professional or contractual relationship remains in effect.

Once the relationship has ended, the data will be retained in a blocked state for the periods necessary to address potential liabilities and comply with legal, tax, accounting, or contractual obligations.

This does not mean that all sales information will be retained for the same period. Information that is no longer necessary will be deleted or anonymized.

Marketing communications

Information used for newsletters or marketing communications will be retained until the person withdraws consent or unsubscribes.

Elume may review and delete the information of subscribers who remain inactive for an extended period.

Technical information

Technical and security logs will be retained only for as long as necessary to ensure the operation of the service, investigate incidents, and comply with applicable obligations.

7. Recipients and service providers

Elume does not sell or otherwise commercially distribute the personal data provided by users.

Personal data may be processed by technology providers that supply services required for the operation of the website and the management of communications.

Web hosting

The website is hosted using EasyWP, a cloud hosting service optimized for WordPress and contracted through Spaceship. Information submitted through the form is initially stored in the WordPress installation hosted through this service.

Email

Form notifications and corporate communications are managed using Spacemail, an email service contracted through Spaceship.

Forms

The contact form is managed using the SureForms plugin installed in WordPress. Under the current configuration, submissions are sent directly to the Elume domain, and the responses are stored in its WordPress installation.

These providers will act as data processors when they process personal data on behalf of Elume and will be subject to their corresponding terms, security measures, and data processing agreements.

Personal data may also be disclosed to public administrations, courts, authorities, or other bodies when required by law.

8. International data transfers

Some technology providers used by Elume may process personal data in countries outside the European Economic Area.

Spaceship states that data associated with its services may be processed in the United States or other territories and that, where necessary, it uses mechanisms recognized under applicable regulations, such as the Standard Contractual Clauses incorporated into its Data Processing Agreement.

Where international data transfers take place, Elume will seek to ensure that they are covered by an adequacy decision, Standard Contractual Clauses, or another valid safeguard under the General Data Protection Regulation.

9. Google Fonts

The website currently uses Google Fonts to display the Poppins and Amiri typefaces.

When accessing the website, the browser may connect to Google’s servers to download these files. As a result, Google may receive technical information such as the IP address, requested URL, and browser data.

Google states that Google Fonts does not set cookies through this operation, although it does receive the technical information required to provide the fonts.

Elume may change this configuration in the future and host the typefaces locally.

10. Automated decision-making

Elume does not currently make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them based on the information collected through the website.

The website, in its current configuration, does not conduct automated profiling for advertising purposes.

11. Rights of data subjects

Data subjects may exercise the following rights:

• Access: obtain information about the personal data processed by Elume.
• Rectification: request the correction of inaccurate or incomplete personal data.
• Erasure: request the deletion of personal data when it is no longer necessary.
• Objection: object to certain processing activities based on legitimate interests.
• Restriction: request the restriction of processing under certain circumstances.
• Data portability: receive the personal data provided in a structured, commonly used, and machine-readable format, where applicable.
• Withdrawal of consent: withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

To exercise these rights, a request may be sent to the email address provided in the section identifying the data controller.

The request must specify the right the person wishes to exercise and provide the information necessary to verify the identity of the applicant where there are reasonable doubts.

The data subject may also lodge a complaint with the Spanish Data Protection Agency if they believe that their personal data has not been processed appropriately.

12. Security measures

Elume will implement appropriate technical and organizational measures to protect personal data against:

• Unauthorized access.
• Accidental loss or destruction.
• Unlawful alteration.
• Unauthorized disclosure.
• Fraudulent use.
• Security incidents.

These measures will be reviewed and adapted based on the nature of the data, the state of the art, and the existing risks.

Nevertheless, no transmission or system connected to the Internet can be considered completely immune to all risks.

13. Third-party personal data

If a person provides personal data relating to third parties, they confirm that they have sufficient authorization to do so and that they have informed those third parties of the contents of this Privacy Policy where necessary.

Personal data relating to third parties should not be included in the form unless it is essential for handling the inquiry.

14. Third-party links and services

The website may contain links to pages or profiles managed by third parties, such as LinkedIn.

Elume does not control the privacy policies or practices of those services. Users should review the applicable terms and policies when accessing them.

The inclusion of a link to an external service does not mean that Elume automatically discloses the information entered in the form to that service.

15. Changes to this Privacy Policy

Elume may amend this Privacy Policy in response to:

• Legal or regulatory changes.
• New personal data processing activities.
• The addition of tools, providers, or integrations.
• Changes to the form or the website’s features.
• Changes to Elume’s activities.

The current version will be the one published on this website together with the date on which it was last updated.