Note: The legally binding version of this Privacy Policy is the Spanish Política de Privacidad. This English version is provided for informational convenience only. In case of discrepancy, the Spanish version prevails.
1. Data Controller
| Name | CANARYmedtech S.L.U. |
|---|---|
| Address | Calle los Dragos 3, 11 · 35508 Costa Teguise, Las Palmas, Spain |
| CIF | B22917884 |
| info@canarymedtech.es | |
| Phone | +34 828 124 990 |
CANARYmedtech S.L.U. does not have a Data Protection Officer (DPO) subject to mandatory appointment under Art. 37 GDPR. Data protection enquiries may be directed to the contact details above.
2. Data We Collect and Why
2.1 Contact form
When you submit the contact form, we collect: first name, last name, organisation, email address, subject of enquiry and any additional information you provide voluntarily. Purpose: to respond to your enquiry and initiate a business relationship. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at the request of the data subject) and Art. 6(1)(a) GDPR (consent).
2.2 Server log files
Our hosting provider automatically collects: IP address, browser type, operating system, referring URL, date and time of request. Purpose: technical operation and security of the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Retention: 30 days.
2.3 Cookies
This website uses only technically necessary cookies required for basic functionality. No tracking or marketing cookies are set without your explicit consent. For details, see our Cookie Notice.
2a. Third-Party Services and Tracking Technologies
Google Analytics 4 (GA4)
This website uses Google Analytics 4, a web analytics service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), operated in the EU through Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
Google Analytics uses cookies and similar technologies to collect anonymised information about how visitors use this website. The following data may be processed: pages visited, time on page, browser and device type, screen resolution, approximate geographic location (country/city level), traffic source and user interactions.
IP anonymisation: IP anonymisation is enabled. Your IP address is shortened before transmission to Google's servers within EU/EEA member states.
Legal basis: Art. 6(1)(a) GDPR — your explicit consent, requested via our cookie consent mechanism before any analytics cookies are set.
Data transfer: Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, 13 July 2023). Data may additionally be protected by Google's standard contractual clauses pursuant to Art. 46 GDPR.
Retention: Analytics data is retained for 14 months and then automatically deleted.
Opt-out: You may prevent Google Analytics from collecting your data by installing the Google Analytics Opt-out Browser Add-on. Alternatively, withdraw your consent via our cookie settings at any time.
Google's privacy policy: https://policies.google.com/privacy
HubSpot CRM & Forms
This website uses HubSpot, a CRM and inbound marketing platform provided by HubSpot Inc. (25 First Street, 2nd Floor, Cambridge, MA 02141, USA), with its European operations through HubSpot Ireland Ltd.
HubSpot is used for the following purposes on this website:
- Contact forms: When you submit the contact form, your data (name, organisation, email, and message) is transmitted to and stored in HubSpot CRM for the purpose of processing your enquiry.
- Analytics tracking: HubSpot may set cookies to track website visitor behaviour and map form submissions to individual contact records.
Legal basis: Art. 6(1)(b) GDPR (processing necessary for pre-contractual measures) for form data; Art. 6(1)(a) GDPR (consent) for tracking cookies.
Data transfer: HubSpot Inc. is certified under the EU-US Data Privacy Framework. Transfers to the US are protected under the adequacy decision and/or standard contractual clauses (Art. 46 GDPR). A data processing agreement (DPA) is in place between CANARYmedtech S.L.U. and HubSpot in accordance with Art. 28 GDPR.
Retention: Contact records are retained for the duration of the business relationship plus the statutory limitation periods (generally 3–10 years). You may request deletion at any time by contacting us.
HubSpot's privacy policy: https://legal.hubspot.com/privacy-policy
Cookie Categories Summary
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Strictly necessary | Session cookies | Website functionality | Art. 6(1)(f) legitimate interest |
| Analytics | Google Analytics (_ga, _gid) | Usage statistics (anonymised) | Art. 6(1)(a) consent |
| Marketing / CRM | HubSpot (hubspotutk, __hstc) | Lead tracking, form submission attribution | Art. 6(1)(a) consent |
You can manage your cookie preferences at any time via the cookie settings link in the footer or by clearing cookies in your browser settings.
3. Legal Basis for Processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to contact enquiries | Art. 6(1)(a) consent; Art. 6(1)(b) pre-contractual measures |
| Provision of contracted services | Art. 6(1)(b) contract performance |
| Compliance with legal obligations | Art. 6(1)(c) legal obligation |
| Website security and operation | Art. 6(1)(f) legitimate interest |
4. Data Sharing and Recipients
We do not sell, rent or share your personal data with third parties for commercial purposes. Data may be shared with:
- Hosting and infrastructure providers acting as data processors under Art. 28 GDPR agreements
- HubSpot Inc. — CRM and form processing. HubSpot is certified under the EU-US Data Privacy Framework. Data may be transferred to the United States under Art. 46 GDPR standard contractual clauses.
- Competent authorities — where required by law or court order
5. International Data Transfers
When using HubSpot for form processing, data may be transferred to the United States. This transfer is protected by the EU-US Data Privacy Framework (adequacy decision) and/or standard contractual clauses pursuant to Art. 46 GDPR.
6. Data Retention
| Category | Retention period |
|---|---|
| Contact form submissions | 3 years from last contact, or until deletion is requested |
| Contract-related data | 10 years (commercial law obligation, HGB / Spanish Commercial Code) |
| Server log files | 30 days |
7. Your Rights
Under the GDPR and Spanish LOPDGDD, you have the following rights:
- Right of access (Art. 15 GDPR) — you may request a copy of your personal data
- Right to rectification (Art. 16 GDPR) — you may request correction of inaccurate data
- Right to erasure (Art. 17 GDPR) — you may request deletion of your data where no legal obligation requires retention
- Right to restriction (Art. 18 GDPR) — you may request limitation of processing in certain circumstances
- Right to data portability (Art. 20 GDPR) — you may request your data in a structured, machine-readable format
- Right to object (Art. 21 GDPR) — you may object to processing based on legitimate interest
- Right to withdraw consent (Art. 7(3) GDPR) — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at info@canarymedtech.es. We will respond within 30 days.
8. Right to Lodge a Complaint
You have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD — Agencia Española de Protección de Datos): www.aepd.es · C/ Jorge Juan 6, 28001 Madrid.
9. Changes to This Policy
We may update this Privacy Policy from time to time. The current version is always available on this page. Material changes will be communicated via the website or by email where appropriate. Last updated: April 2026.