Privacy policy

1. Data controller

EVOLUTE SYSTEMS, S.L.U.
Tax ID (NIF): B05749197
Registered office: Calle Tampico 34, 28027 Madrid (Spain)
Phone: +34 91 742 02 33 · Email: info@evolute.es
Registration details: registered with the Madrid Commercial Registry, section 8, sheet M-899599, entry 1, dated 13 October 2026 (BORME no. 202 of 20 October 2026, notice 465810)

For any data protection matter you can write to lopd@evolute.es.

2. What data we process

• Website visitors: browsing data (IP address, browser, pages visited) and, only if you accept them, analytics cookie data. See the cookie policy.
• People who contact us: name, email address, phone number and the content of the enquiry.
• Platform users: identification and contact details (name, email address), the organisation they belong to, language, login data and technical usage and security logs. If the user signs in with Google or Microsoft, we receive their identifier, name and email address from those providers; we do not receive their password.
• Customer data in their systems: the platform connects to each customer’s ERP (Odoo) and other tools and processes the data they contain on the customer’s behalf. See section 10.

3. Purposes and legal bases

We do not take automated decisions with legal effects on individuals or build profiles for commercial purposes.

4. How long we keep data

For as long as the relationship with the customer or user lasts, and afterwards for the limitation periods of any claims that may arise and those required by law (for example, six years for commercial records and four for tax records). The platform session expires after seven days. Google Analytics keeps the data of each visit for 14 months; after that only aggregated reports, which identify no one, are kept. Technical and security logs are kept for a maximum of 12 months.

5. Who we share data with

We do not disclose data to third parties unless required by law. To provide the service we use providers that process data on our behalf, under a data processing agreement in accordance with article 28 GDPR:

• Amazon Web Services (AWS): hosting of the website and platform, in the region that corresponds to each customer (section 6).
• Google: sign-in with Google and, if you accept it, Google Analytics.
• Microsoft: sign-in with Microsoft.

6. Where we host data

The platform is hosted on the infrastructure of Amazon Web Services (AWS), the world’s largest cloud services provider. AWS holds, among others, ISO/IEC 27001, 27017 and 27018 certifications, SOC 1, SOC 2 and SOC 3 reports and certification under the Spanish National Security Framework (ENS) at high category.

To reduce latency and comply with local regulations, the data of each customer and its users is hosted in the AWS region closest to its area of influence, which is assigned when the customer signs up, based on its registered address:

Data, including its backups, stays in the assigned region and is not moved to another without the customer’s agreement. The customer may request a different region from the one assigned, for example so that its data remains in the European Union. The public pages of this website, which contain no customer personal data, are served from Europe (Ireland) through the AWS content delivery network (Amazon CloudFront).

7. International transfers

Some providers (Google and Microsoft) may process data outside the European Economic Area, and the data of customers outside Europe is hosted in the AWS region of their area (section 6). These transfers rely, where one exists, on an adequacy decision of the European Commission (for example, for the United Kingdom, Switzerland, Canada, Japan, South Korea or New Zealand); for the United States, on the EU-US Data Privacy Framework for certified entities; and otherwise on the European Commission’s standard contractual clauses, included in each provider’s data processing agreement.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to lopd@evolute.es or to the postal address above, with a copy of your ID if we cannot identify you otherwise. If you are not satisfied, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

9. Security

We apply technical and organisational measures appropriate to the risk, including: encryption of communications (HTTPS) and of stored data; sign-in with corporate Google or Microsoft accounts; access control by organisation and role, with the least privilege needed; protected session cookies; credentials and access keys stored in dedicated AWS services, never in the code; automatic deletion of temporary files; and activity logs to detect and analyse incidents.

10. Data we process on behalf of our customers

When the platform processes data from a customer’s systems (for example, its ERP), evolute acts as data processor and the customer is the controller. That processing is governed by the data processing agreement that forms part of the terms of service the customer accepts when purchasing; individuals whose data is held in those systems should contact the customer to exercise their rights.

11. Changes to this policy

We may update this policy to adapt it to regulatory or service changes. The version in force is the one published on this page, with its update date; if the change is significant, we will inform platform users.

This English version is provided for convenience; in the event of any discrepancy, the Spanish version prevails.