Editorial note: this policy requires confirmation of actual processing activities, providers, retention periods and international transfers before publication.
GraCity Investments, S.L., with Spanish Tax Identification Number B22848246 and registered office at Avenida Los Catedráticos, 11, 28430 Alpedrete, Madrid, Spain, acts as the controller for the processing described in this policy where it determines the purposes and means of that processing.
Privacy contact: gracity.organisation@gmail.com.
[PENDING: Confirm whether a Data Protection Officer has been appointed. If so, include their contact details.]
This policy explains how we process personal data relating to people who contact GraCity, request information, maintain professional relationships with us or use our services where we act as controller.
Where GraCity processes personal data on behalf of a customer organisation, processing is governed by that organisation’s instructions and the applicable data processing agreement. The customer organisation is responsible for providing the privacy information required of it as controller.
Depending on your relationship with GraCity, we may process:
Identification and professional contact details.
Organisation, job role and information relevant to your enquiry.
Administrative, contractual and billing information.
Account information and usage records needed to manage access and support.
Technical browsing and security information, depending on the service configuration.
Other information you voluntarily provide in communications or documents.
Please do not provide sensitive personal data or personal information that is unnecessary for your request.
[PENDING: Check this list against the forms, logs and functions actually used.]
| Purpose | Legal basis |
|---|---|
| Responding to an individual’s request for a proposal or contract | Taking steps at that individual’s request before entering into a contract |
| Managing contracts with individuals who are parties to them | Performance of a contract |
| Communicating with representatives and contacts of organisations | Legitimate interests in managing professional relationships, subject to an appropriate assessment |
| Meeting tax, accounting and other legal obligations | Compliance with legal obligations |
| Sending promotional communications requested by the recipient | Consent |
| Protecting systems and managing security incidents | Legitimate interests in maintaining security, using proportionate measures |
| Using non-exempt tracking technologies | Consent, as explained in the Cookie Policy |
[PENDING: Assign the appropriate legal basis to general enquiries and each platform-user processing activity. Remove any purpose that does not apply.]
Submitting an enquiry does not subscribe you to promotional communications.
Personal data may be provided directly by you or by the organisation that administers your access to the service.
[PENDING: Add any other actual sources of personal data and the corresponding information.]
Required form fields will be identified. If information necessary to respond to a request or provide a service is not supplied, we may be unable to do so.
We retain personal data for as long as necessary for the relevant purpose and, where applicable, for the periods required by law or necessary to establish, exercise or defend legal claims.
[PENDING: Specify sufficiently precise retention periods or criteria for enquiries, commercial contacts, accounts, security logs and contractual documents.]
Personal data may be accessed by service providers where necessary to support GraCity’s operations, subject to the applicable contractual and confidentiality obligations.
Data may also be disclosed to public authorities or other recipients where legally required.
[PENDING: Identify the actual categories of providers and recipients, including hosting, email, customer relationship management, support, billing, analytics and any others used.]
[PENDING: Identify whether personal data is transferred outside the European Economic Area. Where it is, specify the destinations, applicable transfer mechanism and how individuals can obtain information about the safeguards. Do not state that no transfers occur without checking the actual arrangements.]
Where applicable, you may request access to, rectification or erasure of your personal data, restriction of processing, data portability, or object to processing.
To exercise your rights, contact gracity.organisation@gmail.com.
Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
If we have reasonable doubts about your identity, we may request only the additional information necessary to confirm it.
We will generally respond within one month, subject to any extensions permitted by law.
You may also lodge a complaint with the Spanish Data Protection Agency or another competent supervisory authority.
[PENDING: Confirm whether any decisions concerning individuals are made solely by automated means and produce legal or similarly significant effects. Environmental indicator calculations should not be confused with this type of decision-making.]
We will update this policy when our processing activities change. Where appropriate, we will notify individuals of material changes.
Privacy Policy Cookie Policy (EU) Legal Notice Website Terms of Use SaaS Terms of Service Contact
® Gracity Investments S.L. 2026 B-22848246