Privacy policy

This privacy policy explains how Lucsoft SL (“we”, “us”) handles personal data when you visit this website or contact us. It is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD).

This policy covers this website only. Mobile apps and other websites we operate or host have their own privacy policies.

1. Who is responsible for your data

The data controller is Lucsoft SL. Our company and contact details are shown on this page. For any privacy question or request, write to the email address listed there.

2. What data we collect

When you contact us through the contact form, by email, phone or WhatsApp, we receive the information you choose to share, such as:

• your name and email address
• your phone number and business or website name, if you provide them
• the type of project you are interested in and the content of your message

When you browse the website, we measure visits with two cookieless analytics services, Umami and Ahrefs Web Analytics. They do not set cookies, do not store anything on your device and do not follow you across other websites. They receive the address of the page you visit, the website that sent you, your browser and device type, the page’s loading speed and your IP address, which is used to estimate your country and city and to count unique visits without identifying you. We only see aggregated statistics, such as how many people visited a page or tapped a contact button, and we never combine them with other data to identify you.

With your consent, we also use Microsoft Clarity, provided by Microsoft Ireland Operations Ltd and Microsoft Corporation, to understand how our pages are used. Clarity records how you interact with a page, such as mouse movements, scrolling and clicks, and lets us replay these visits as session recordings, with the text on the page and anything you type masked. It sets two first-party cookies, _clck and _clsk (see section 6). The data is processed by Microsoft and transferred to the United States under the EU–US Data Privacy Framework. Clarity only runs after you click “Accept” in the cookie banner, and you can withdraw your consent at any time through “Cookie settings” at the bottom of every page.

We do not use advertising trackers or social media pixels. Our hosting provider automatically processes technical data needed to deliver the pages securely (such as IP address, browser type and time of the request) in server logs.

3. Why we use it and on what legal basis

Purpose	Legal basis
Answering your enquiry and preparing a proposal	Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and your consent (Art. 6(1)(a) GDPR)
Delivering the website securely and preventing abuse	Our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR)
Measuring, in aggregate, how the website is used, to improve it	Our legitimate interest in understanding and improving our website (Art. 6(1)(f) GDPR)
Session recordings and heatmaps with Microsoft Clarity	Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time
Performing a contract once you become a client, and invoicing	Performance of a contract and legal obligations (Art. 6(1)(b) and (c) GDPR)

We do not use your data for automated decision-making or profiling, and we do not send marketing communications unless you have asked us to.

4. Who we share it with

We never sell your data. We only share it with service providers that help us run the website and our business, acting on our instructions:

• Website hosting: Vercel Inc. hosts this website.
• Website analytics: Umami Software, Inc. (Umami) and Ahrefs Pte. Ltd. (Ahrefs Web Analytics) provide the cookieless visit statistics described above.
• Session recordings and heatmaps: Microsoft Ireland Operations Ltd and Microsoft Corporation (Microsoft Clarity), only if you accept cookies.
• Contact form delivery: Web3Forms, which forwards messages sent through the contact form to our inbox.
• Email: Zoho Corporation B.V. (Zoho Mail), which hosts our email account on servers in the European Union.
• Appointment booking: Cal.com, Inc., which processes the name, email address and any details you provide when you book a meeting with us.
• WhatsApp: if you choose to message us on WhatsApp, WhatsApp/Meta processes that conversation under its own terms.

Some of these providers are based outside the European Economic Area, mainly in the United States. Where that is the case, transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

We may also disclose data where required by law, for example to tax authorities for invoicing purposes.

5. How long we keep it

• Enquiries that do not lead to a project: up to 12 months after our last contact, then deleted.
• Client data: for the duration of the contract and afterwards for as long as required by Spanish tax and commercial law (generally up to 6 years).
• Server logs are kept by our hosting provider for a limited period for security purposes.
• Website analytics from Umami and Ahrefs are kept only as statistics that do not identify you.
• Clarity session recordings are kept by Microsoft for 30 days; a small number of saved or randomly sampled recordings are kept for up to 9 months.

6. Cookies

By default, this website does not set cookies: Umami and Ahrefs work without cookies, and fonts are served from our own website, not from third-party font services. We store your cookie choice in your browser’s local storage so that we do not ask again on every page.

Only if you click “Accept” in the cookie banner does Microsoft Clarity set these first-party cookies:

Cookie	Purpose	Lifetime
_clck	Keeps the pseudonymous Clarity user ID and its preferences, so visits by the same browser can be linked	1 year
_clsk	Connects the pages you view during one visit into a single session recording	1 day

You can withdraw your consent at any time through “Cookie settings” at the bottom of every page. We then delete these cookies and stop loading Clarity. You can also delete cookies in your browser settings.

7. Your rights

You can at any time:

• access the personal data we hold about you
• ask us to correct inaccurate data or delete your data
• object to or ask us to restrict certain processing
• receive your data in a portable format
• withdraw your consent, without affecting processing carried out before you withdrew it

To exercise any of these rights, email us from the address you contacted us with, or include enough information for us to identify you. We will reply within one month.

If you believe we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

8. Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS) across the website and access-controlled accounts for our email and tools.

9. Children

This website is aimed at businesses and is not intended for children under 14. We do not knowingly collect their data.

10. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top of the page always shows the current version.