en flag
en flag

Privacy Policy

This text constitutes the binding Privacy Policy of abionori.com. It is provided to explicitly detail the categories of personal data subject to collection, the corresponding legal and operational justifications for such processing, and the statutory rights granted to you as a user.

To ensure complete clarity, capitalized terms used in this policy (such as 'User', 'Owner', or 'Personal Data') are defined in the final section of this document under 'Definitions and legal references'.

Policy Status

Effective Date: 01.05.2026
Last Modified: 01.05.2026

Version: 1.1

This Privacy Policy is an active legal document. The Data Controller maintains comprehensive internal logs of all prior versions and amendments.

Table of contents

  • Summary

  • Owner and Data Controller

  • Types of Data collected

  • Mode and place of processing the Data

  • The purposes of processing

  • Detailed information on the processing of Personal Data

  • Cookie Policy

  • Further Information for Users in the European Union

  • Further information for Users in Switzerland

  • Additional information about Data collection and processing

  • Definitions and legal references

Summary

Automatically Processed Data

Technical information is gathered without active user input as a direct result of accessing the abionori.com infrastructure.

  • Browser information

  • Date of the message

  • Device information

  • Device logs

  • Essential Technical Telemetry (Server Logs)

  • IP address

  • Language

  • Operating systems

  • Time the message was sent

  • Technical Security Identifiers (e.g., bot-management cookies)

Authorized Third-Party Processors

  • Cloudflare, Inc.: Traffic optimisation, CDN distribution, and edge security.

  • Hostinger International Ltd.: Platform services and core web hosting.

  • Meta Platforms Ireland Limited: Managing support and contact requests (via WhatsApp)

How we use them

  • Managing support and contact requests

  • Platform services and hosting

  • Traffic optimisation and distribution

Manage privacy preferences HERE.

Data provided by the User

The Controller collects the data provided by the User, for example, when the User fills in a form.

  • Company name

  • Contents of the email or message

  • Data communicated while using the service

  • Email address

  • First name

  • Last name

  • Phone number

  • Profession

  • Any other Personal Data freely provided by the User within the message body of the contact form

Authorized Third-Party Processors

  • Google Ireland Limited

  • Hostinger International Ltd.

  • Meta Platforms Ireland Limited

How we use them

  • Contacting the User

  • Handling activities related to productivity

  • Managing support and contact requests

  • Managing web conferencing and online telephony

Owner and Data Controller

Abionori S.L.U.

Carrer Gremi de Sabaters, 21, 2º - B24

07009 Palma de Mallorca

Illes Balears, Spain

Registro Mercantil de Palma de Mallorca

NIF: B22648554

Owner contact email: [email protected]

Note: The Data Controller has formally evaluated the requirement to appoint a Data Protection Officer (DPO) and determined that, given the specific volume, scope, and nature of the data processed, it is not legally mandatory under Art. 37 of the GDPR or Art. 34 of the Spanish LOPDGDD.

Type of Data we collect

The categories of Personal Data processed by this Website, whether gathered directly by our Website or via integrated third-party services, include the following:

  • Any other Personal Data freely provided by the User within the message body of the contact form.

  • Browser information

  • Company name

  • Contents of the email or message

  • Data communicated while using the service

  • Date of the message

  • Device information

  • Device logs

  • Email address

  • Essential Technical Telemetry (Server Logs)

  • First name

  • IP Address

  • Language

  • Last name

  • Operating systems

  • Phone number

  • Profession

  • Technical Security Identifiers (e.g., bot-management cookies)

  • Time the message was sent

Complete details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the Data collection. Personal Data may be freely provided by the User, or, in the case of technical telemetry, collected automatically when using this Website.

The automatic collection of essential technical telemetry (such as IP addresses and browser information) is necessary for this Website to function securely and load properly on the User's device.

However, any Personal Data provided via contact forms, emails, or messaging applications is provided entirely voluntarily by the User. Users are free not to communicate this Data without any consequences to their ability to browse the Website, though failure to provide such Data may make it impossible for us to respond to inquiries or schedule consultations.

We provide digital business cards for our employees hosted on our own servers. When the User clicks 'Save Contact' or 'Play Video,' no data is shared with third-party providers like Google or YouTube. We process only the necessary technical data to deliver the file to the User's device.

The Controller does not store or process profile images from third-party platforms (WhatsApp/Google). Such images are only visible as part of the interface provided by the respective platform.

Users who are uncertain about which Personal Data is mandatory for specific requests are welcome to contact us through the provided email.

Any use of Cookies or other local storage technologies by this Website is limited to technical delivery, network security, and (subject to explicit User consent) optional statistical analysis, in accordance with our privacy-by-design architecture. Detailed specifications are available in our Cookie Policy.

We use only necessary security cookies (Cloudflare) and additionally, we offer optional, privacy-focused analytics (Amplitude) which are deactivated by default and only activated upon the User's explicit consent. No advertising or cross-site tracking cookies are used. Detailed Cookie Table.

Mode and Place of Processing, and International Data Transfers

Methods of Processing and Cybersecurity Architecture

The Data Controller processes User Data employing enterprise-grade security protocols designed to prevent unauthorized access, disclosure, modification, or unlawful destruction of the Data. The processing is executed utilizing advanced IT and telematics infrastructure, following organizational procedures and logical modes directly tethered to the stated operational purposes. In addition to the Controller, Data may be accessible to formally authorized internal personnel (administration, sales, legal, system administration) or vetted external technical entities (hosting providers, cybersecurity networks, communications agencies) legally appointed as Data Processors.

Primary Place of Processing (EU/EEA)

The core processing and hosting of Personal Data occur at the Data Controller’s registered operating offices in Spain and within the localized data centers of our primary infrastructure providers situated within the European Union and the European Economic Area (EEA), such as Hostinger International Ltd. Cyprus.

Depending on the User's location, data transfers may involve transferring the User's Data to a country other than their own. To find out more about the place of processing of such transferred Data, Users can check the section containing details about the processing of Personal Data.

International Data Transfers (Outside the EEA)

To ensure global network security, low-latency content delivery, and the functionality of specific enterprise communication tools, certain data may be transferred to and processed by specialized third-party providers located in third countries outside the EEA (specifically the United States, utilizing providers such as Cloudflare, Inc., Google LLC, and Meta Platforms, Inc.).

Statutory Safeguards for International Transfers

The Data Controller guarantees that any transfer of Personal Data outside the EEA is executed in compliance with Chapter V of the GDPR. Such cross-border transfers are legally anchored on the following statutory mechanisms:

Adequacy Decisions: Transfers to US-based entities actively certified under the EU-US Data Privacy Framework (DPF), which has been formally recognized by the European Commission as providing an adequate level of data protection (https://www.dataprivacyframework.gov/).

Standard Contractual Clauses (SCCs): Where an Adequacy Decision does not apply, or as an additional fail-safe, transfers are safeguarded by binding Data Processing Agreements (DPAs). These agreements incorporate the Standard Contractual Clauses explicitly approved by the European Commission (Implementing Decision (EU) 2021/914), coupled with supplementary technical measures (such as robust SSL/TLS encryption in transit and at rest) to shield European data from unauthorized foreign access.

Furthermore, the Data Controller conducts internal Transfer Impact Assessments (TIAs) to validate the efficacy of these safeguards.

The purposes of processing

Personal Data is processed by the Owner to ensure the effective delivery of the Service, fulfill statutory legal requirements, address formal enforcement inquiries, and safeguard the rights and legitimate interests of the Website, its Users, and associated third parties. Furthermore, Data is utilized to identify and prevent fraudulent or malicious activities, in addition to the following operational objectives:

  • Contacting the User

  • Handling activities related to productivity

  • Managing support and contact requests

  • Managing web conferencing and online telephony

  • Platform services and hosting

  • Spam and bots protection

  • Traffic optimisation and distribution

Detailed information on the processing of Personal Data

Contacting the User

Direct Inquiry via Contact Form

Users may initiate direct communication with the Data Controller utilizing the digital contact forms provided on this Website or via official generic email addresses. The Controller processes the transmitted Personal Data for the exclusive purpose of organizing, addressing, and resolving the User's specific inquiry.

Commercial Electronic Communications (LSSI-CE Compliance)

In accordance with Art. 21 of the Spanish LSSI-CE and the European GDPR, we will not send promotional or commercial communications via email unless explicitly requested or expressly authorized by the User.

Users may withdraw their consent to receive commercial communications at any time, free of charge. To ensure this withdrawal is as easy as the initial consent (Art. 7(3) GDPR), our commercial mailings include an automated "Unsubscribe" link for immediate removal. Alternatively, or for direct 1-on-1 business communications, Users may simply reply to the email with the word "BAJA" or "UNSUBSCRIBE". Such manual requests are honored and processed promptly without undue delay.

Personal Data processed

The exact scope of data depends entirely on the User's input. We adhere to the principle of data minimization:

  • Mandatory Data: Email Address. (Without this, we are technically unable to process or respond to the inquiry).

  • Voluntary Data: First Name, Last Name, Company Name, Phone Number, and any additional Personal Data the User freely elects to include within the message body of the contact form. (Provision of this data is optional and intended only to facilitate a more tailored response).

Operations Management and Productivity

Services in this category enable the Owner to coordinate internal tasks, facilitate professional collaboration, and manage business workflows. When these services are utilized, User Data is processed and retained as required by the specific nature of the business activity. These platforms may interface with other third-party services mentioned in this policy to allow for the secure transfer, import, or export of information necessary for project fulfillment.

Google Workspace

Google Workspace is a professional suite of cloud-based productivity and collaboration tools. We utilize this infrastructure for secure communication and document management. In compliance with privacy standards, data within these services (including Gmail) is not scanned or utilized by the provider for advertising purposes, nor is it harvested to create marketing profiles.

Personal Data processed:

  • Data communicated while using the service

  • Email address

Statutory Legal Basis for Processing:

  • Contractual Necessity (Art. 6(1)(b) GDPR): For processing data directly related to the fulfillment of client IT integration projects and consulting agreements.

  • Legitimate Interest (Art. 6(1)(f) GDPR): For general internal administration, secure document storage, and corporate communication.

Service provided by:

Platform services and hosting

Services within this classification supply the fundamental technical architecture required to host, execute, and maintain the core components of this Website. By utilizing these platforms, the Owner is able to deliver a secure, unified, and highly available online presence. To ensure network security, monitor server performance, and facilitate the reliable transmission of web content, the hosting provider automatically processes specific technical telemetry and network data on behalf of the Data Controller.

Hostinger

We utilize Hostinger, supplied by Hostinger International Ltd., as our primary web hosting and server infrastructure provider.

Personal Data processed:

  • Browser information

  • Device information

  • Device logs

  • Essential Technical Telemetry

  • IP Address

  • Language

  • Operating systems

Service provided by:

Network Performance, Security Routing, and Content Delivery

Services within this architectural tier are engineered to globally distribute Website content via geographically decentralized server networks, thereby minimizing latency and optimizing overall platform performance. Crucially, these systems function as an essential reverse proxy and security filter between the User’s client (browser) and the primary hosting infrastructure. The specific scope of Personal Data processed is dictated by the technical requirements necessary to establish secure connections, mitigate cyber threats, and deliver encrypted content.

Cloudflare

We implement Cloudflare, supplied by Cloudflare, Inc., as our primary Content Delivery Network (CDN) and edge security proxy. By design, all inbound traffic to this Website is routed through Cloudflare’s infrastructure to proactively filter malicious requests, ensure SSL/TLS encryption, and accelerate data delivery.

Personal Data processed:

  • Browser information

  • IP Address

  • Technical Security Identifiers (e.g., bot-management cookies)

Service provided by:

Cloudflare DNS

Cloudflare DNS is utilized as an enterprise-grade Managed Domain Name System (DNS). This service translates domain requests into IP addresses, ensuring that network traffic is routed with maximum cryptographic security and operational resilience.

Personal Data processed:

  • Essential Technical Telemetry

Service provided by:

Managing web conferencing and online telephony

Purpose of Processing

We utilize digital telecommunications and video conferencing infrastructure to conduct online meetings, client consultations, and business negotiations. These services facilitate real-time, cross-border communication and may interface with our internal administrative tools (e.g., calendar scheduling and CRM management).

No Recording Guarantee

We explicitly state that audio and video streams conducted via these platforms are not recorded, saved, or archived by the Data Controller unless an explicit, separate consent agreement is executed in advance of a specific meeting.

Google Meet

We deploy Google Meet, a secure video conferencing platform provided by Google Ireland Limited, as our primary online meeting infrastructure.

Categories of Personal Data Processed

The scope of data processed depends on the User’s interaction with the platform and the information voluntarily disclosed during the session.

  • User Information: Email Address. Additional data, such as First Name, Last Name. Company Name and Profession, are processed on a voluntary basis, dependent upon the information the User explicitly elects to share or has publicly configured within their Google account profile.

  • Communication Content: Any textual data shared within the in-meeting chat function, and the transient audio/video streams generated during the live call.

  • Technical Metadata (Processed by Google): To facilitate the encrypted connection, Google processes necessary technical telemetry, including IP addresses, device type, operating system version, meeting duration (join/leave timestamps), and connection quality metrics.

Statutory Legal Basis for Processing

  • Contractual & Pre-Contractual (Art. 6(1)(b) GDPR): For meetings conducted to negotiate, establish, or fulfill a business contract with the User.

  • Legitimate Interest (Art. 6(1)(f) GDPR): For general communications, support, and the efficient administration of digital business meetings.

Service Provider & Data Processor:

Note: International data transfers associated with this service are legally safeguarded primarily by Google's active certification under the EU-US Data Privacy Framework (DPF) and, residually, by Standard Contractual Clauses (SCCs) incorporated within our formal Data Processing Agreement.

Managing support and contact requests

Services within this category equip the Owner with the necessary infrastructure to securely process, organize, and reply to User inquiries. We provide multiple distinct channels for communication (including email, direct phone, and contact forms). The exact scope of Personal Data processed is inherently dependent upon the communication medium the User explicitly chooses to utilize and the specific information they voluntarily disclose.

WhatsApp Business

We offer WhatsApp Business as an entirely optional, real-time communication interface. Communication via WhatsApp occurs on an external platform. By clicking the WhatsApp link, the User leaves our Website and interacts directly with Meta Platforms. We do not control the technical telemetry Meta collects during that transition. When a User voluntarily elects to bypass standard channels and contact us via this platform, the interaction and associated message content are routed through the provider's infrastructure to resolve the inquiry.

Personal Data processed:

  • Contents of the message

  • Data communicated while using the service

  • Date of the message

  • First name

  • Last name

  • Phone number

  • Time the message was sent

Service provided by:

Statutory Legal Basis for Processing

  • Consent (Art. 6(1)(a) GDPR): The initiation of the WhatsApp chat relies entirely on the User's explicit, voluntary action (Consent) to click the designated contact link, having been provided with a pre-click warning regarding the transfer to an external platform.

  • Contractual Necessity (Art. 6(1)(b) GDPR): Once the chat is initiated, the processing of the actual message content to resolve the User's inquiry is based on pre-contractual or contractual necessity.

External Links and Third-Party Platforms

This Website contains direct hyperlinks to external platforms, applications, and social media networks. By clicking these links, the USer intentionally leaves this Website. We explicitly state that we have no technical or legal control over the data processing, tracking cookies, or telemetry deployed by these third-party operators once the User exits our Website. We advise reviewing the respective privacy policies of those external platforms upon arrival.

External Corporate Presences and Social Media Profiles

Modular Applicability to Social Media Profiles

This Privacy Policy functions as a modular framework for our external corporate profiles. The provisions regarding Social Media Joint Controllership (Art. 26 GDPR) are triggered exclusively by the presence of an active link from a specific social media profile to this document.

Data processing under this section is limited to the platforms actively maintained by the Controller. Users can identify our active platforms via the "Social Media Coverage Checklist" located in the Annex at the bottom of this document. For any platform listed below that is NOT marked as 'Active' in said Annex, no data processing is conducted by the Controller, and no Joint Controllership agreement is in effect.

Purpose and Scope of Processing

If the User interacts with an active corporate profile (e.g., by commenting, liking, or sending a direct message), we process the data the User voluntarily provides to answer the inquiry or engage with the feedback.

Statutory Legal Basis for Processing by the Data Controller

  • Legitimate Interest (Art. 6(1)(f) GDPR): Our operation of these profiles is based on our legitimate interest in modern corporate communication, brand visibility, and target-audience engagement.

  • Contractual Necessity (Art. 6(1)(b) GDPR): If the User's interaction aims at concluding a contract or requesting specific customer support, this forms the legal basis for processing the User's message.

Data Processing by the Platform Operators (Third-Party Risk)

We point out that we do not have full control over the overarching data processing operations of these social media platforms. When the User visits our profiles, the platform operators (e.g., Meta, LinkedIn, Google) use cookies and tracking technologies to collect extensive behavioral data, create user profiles, and deploy targeted advertising, regardless of whether the User is logged into a platform account. We hold no liability for the primary data harvesting conducted by these platform operators.

Joint Controllership (Art. 26 GDPR) and Analytics

For specific analytical data provided to us by the platforms (commonly referred to as "Page Insights"), we operate as a Joint Controller alongside the respective platform operator, as mandated by the European Court of Justice (CJEU). Where a platform is marked as active in our Annex, the following Joint Controller agreements apply:

  • Meta (Facebook & Instagram): We have executed a Joint Controller Addendum with Meta Platforms Ireland Ltd., which defines that Meta holds the primary responsibility for fulfilling Data Subject Rights regarding Insights data. (View Meta's Joint Controller Agreement).

  • LinkedIn: A similar Joint Controller arrangement exists with LinkedIn Ireland Unlimited Company for "Page Insights" data. (View LinkedIn's Page Insights Addendum).

  • TikTok: We act as a Joint Controller with TikTok Technology Ltd. under their Jurisdiction-Specific Terms. (View TikTok's Page Insights Addendum).

  • X (formerly Twitter): We act as a Joint Controller with X Internet Unlimited Company. (View X's Page Insights Addendum).

  • Google: Google (Google Business Profile, YouTube & Google Maps): We act as a Joint Controller with Google Ireland Ltd. under their Controller-Controller terms, in respect of the business listing, its reviews and its profile statistics. (View Google's Page Insights Addendum).

International Data Transfers

Because many of these platform operators are subsidiaries of US-based corporations, the User's data may be transferred to and processed in the United States. Such transfers are safeguarded by the EU-US Data Privacy Framework (DPF) certifications held by the parent companies, or via Standard Contractual Clauses (SCCs) implemented by the platform operators.

Platform Privacy Policies and Rights Exercise

For comprehensive details on how each operator processes the User's data, their exact storage periods, and how to exercise the right to object (Opt-Out) directly against their tracking, please consult their respective privacy policies: