Privacy Policy
Website: novomatica.com · Version 1.1 · Effective from 20 October 2026
1. Who is responsible for your data
The controller is Oleksandr Kaidannyk, a self-employed professional (trabajador autónomo) in Spain trading as Novomatica. NIF (NIE) Z2224087S. Address: CL Amplaries No 37, 10º 289, 12594 Oropesa del Mar (Castellón), Spain. Email hi@novomatica.com, telephone +34 633 581 436.
We have not appointed a Data Protection Officer because our processing does not require one. Messages sent to the address above reach the person who decides.
2. What we collect, and when
When you apply for a Fit Call. The form asks for your full name, work email, company website, company name and a description of the workflow you want to automate. Name, email and the workflow description are required. Without them we cannot answer you. Company name and website are optional. We also receive anything else you choose to write.
When you book a call. The booking page asks for your name and email and stores the appointment in our calendar.
When we talk or work together. Business contact details, correspondence by email, WhatsApp or video call, project information, payment details and the data needed to invoice you.
When you browse the site. Our server records technical data (IP address, browser, time of request) to keep the site running and protected. The contact form uses a bot check that processes your IP address and browser signals. If you accept analytics cookies, we also receive statistics about how the site is used. Statistics never include your name or email.
We do not ask for special categories of data such as health, religion or political opinions. Please do not send them through the form.
3. Why we process your data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your enquiry and preparing a proposal when you act for yourself, for example as a sole trader | Steps taken at your request before a contract (Art. 6(1)(b) GDPR) |
| Answering your enquiry when you contact us on behalf of a company | Our legitimate interest in business communication with the company you represent (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD) |
| Summarising and prioritising enquiries with an AI tool | Our legitimate interest in handling enquiries quickly and in a sensible order (Art. 6(1)(f) GDPR) |
| Running a project and managing the relationship | Performance of a contract (Art. 6(1)(b) GDPR) or, for company contacts, our legitimate interest (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD) |
| Invoicing and accounting | Legal obligation under Spanish tax and commercial law (Art. 6(1)(c) GDPR) |
| Keeping the site and the form secure | Our legitimate interest in protecting the service against abuse and technical failure (Art. 6(1)(f) GDPR) |
| Measuring how the site is used | Your consent, given in the cookie banner (Art. 6(1)(a) GDPR). You can withdraw it at any time |
How we use AI on enquiries
When an application arrives, an AI model summarises it and gives it a priority score. The score helps us decide what to read first. It never decides on its own: a person reads every application and makes every decision about whether and how to answer. We do not make automated decisions that have legal or similarly significant effects on you (Art. 22 GDPR).
The AI providers we use process the text under commercial terms that do not allow them to train their models on it. You can object to this processing at any time (section 7).
We do not use your data for advertising and we do not sell it.
4. How long we keep it
- Enquiries that do not lead to a project: 12 months after our last contact, then deleted from our CRM, mailbox and messaging tools.
- Contracts, project correspondence and project data: for the duration of the relationship. After that we keep them blocked for 5 years, the limitation period for contractual claims in Spain, and then delete them. Blocked data is kept apart and used only to deal with legal claims or requests from authorities (Art. 32 LOPDGDD).
- Invoices and accounting records: 6 years, as required by Article 30 of the Spanish Commercial Code.
- Technical logs from our server and automation platform: up to 30 days.
- Analytics data: 14 months.
- Your cookie choice: 13 months, after which the banner asks again.
5. Who receives your data
Service providers (processors). These act only on our instructions under a data processing agreement: website and automation hosting (Contabo, EU), email, calendar, video calls and documents (Google Workspace), bot protection (Cloudflare), CRM (Attio), internal notifications (Slack), project and records tools (Notion, Airtable), AI models (Anthropic, Google Gemini), video calls when you prefer Zoom (Zoom) and our external accountant in Spain. The full list, with the country of each provider and the safeguard used for any transfer, is published as our Sub-processor List.
Independent recipients. Some recipients process data under their own responsibility and their own privacy notices: your bank and payment providers when you pay us (Wise, Payoneer, Stripe), WhatsApp when you choose to contact us there, Upwork when we work through its platform and public authorities where the law requires it, for example the Spanish tax agency.
Transfers outside the EEA. Some providers are in the United States or the United Kingdom. For US providers we rely on the European Commission adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and on the Standard Contractual Clauses (EU) 2021/914 otherwise and as a fallback. The United Kingdom is covered by an EU adequacy decision.
6. When we work for our clients
When we automate processes inside a client’s systems, the client is the controller and we are the processor acting on documented instructions. In that role we sign a Data Processing Agreement (Art. 28 GDPR) as part of our service agreement.
We keep client data in the client’s own systems wherever possible. When a project needs a working copy, for example to build or test an automation, the copy stays in the tools listed in our Sub-processor List, we test with anonymised or synthetic data where the project allows, and we return or delete the data at the end of the project. AI tools are used on client data only when the client has authorised it in writing, and their output is reviewed by a person before it is used.
This policy describes what we do with data for our own purposes. The client’s own privacy notice covers the rest.
7. Your rights
You can ask us to access your data, correct it, delete it, restrict its processing or receive it in a portable format. You can object at any time to processing based on our legitimate interest, including the AI summary of your enquiry. Where processing relies on consent, you can withdraw consent at any time without affecting what we did before.
Write to hi@novomatica.com. We answer within one month. If a request is complex we may extend this by up to two more months and will tell you why. We may ask you to confirm your identity before we act.
If you are not satisfied, you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid (www.aepd.es). We would appreciate the chance to fix the matter first.
8. Security
We use encryption in transit, access controls and separate accounts for work, and we keep the personal data we hold to the minimum the work requires.
If a breach is likely to put your rights at risk, we notify the AEPD within 72 hours. If the risk is high, we also tell you directly.
9. Changes to this policy
We publish the current version on this page with its date. If a change materially affects you, we say so on this page before it takes effect.
Version 1.1 · Effective from 20 October 2026