Updated: 10 October 2026.
Who is responsible
Heartbit S.L. (NIF B19733666) is responsible for the processing described here. Our address is Gran Vía de les Corts Catalanes, 583, Barcelona, 08011, España. Contact us about your data at [email protected].
This notice covers heartbit.technology, inquiries sent to us and applications for our current vacancies. It does not cover other websites linked from this website.
What we process and why
- Website delivery and security. Our host, Cloudflare, receives connection and request information, including IP address, requested page, browser/header details, timestamps and security signals. It may also receive network-error reports. Our legitimate interest is to deliver this website, keep it available and diagnose or prevent failures and abuse (GDPR article 6(1)(f)).
- Inquiries. We receive your email address, name if provided, message and attachments you send. We use what is necessary to answer your request and discuss relevant services. Necessary steps you request towards a contract with you rely on article 6(1)(b). Correspondence with a company’s representatives, and other questions, relies on our legitimate interest in answering the sender and maintaining the relevant business relationship (article 6(1)(f)). We do not treat an email as blanket consent for other uses.
- Current recruitment. We receive the CV, contact details, experience, qualifications, cover note and project links you choose to send. We use relevant information to assess and discuss your application for a current role, as requested steps towards an employment contract (article 6(1)(b)). We do not keep a candidate pool for future vacancies.
- Legal records. Where required, we retain business records and protect data that must be blocked after correction or deletion. These activities rely on the applicable legal duties (article 6(1)(c)), including Commercial Code article 30 and LOPDGDD article 32.
There are no website accounts, inquiry forms or checkout on this brochure. You can browse without emailing us. To reply or assess an application we need contact details and the information relevant to your request or the role; without them we may be unable to respond or assess it. Other information is optional. Please avoid sending ID copies, health information or other sensitive details that are unnecessary for your inquiry or application.
This brochure does not make automated decisions with legal or similarly significant effects. Inquiries and CVs are received in our company mailbox; we do not send them to an external AI service for assessment.
Analytics and browser technologies
We use Cloudflare Web Analytics to understand aggregate page usage and loading performance, using only its dashboard and without exporting analytics data. Browser measurement can include visited and referring pages, browser/device details and performance timings, with transient IP handling.
Our configuration excludes browser analytics for requests served through Cloudflare data centres in the EEA, United Kingdom and Switzerland. This is based on the data centre handling the request, rather than your residence; analytics can run for requests served elsewhere.
Cloudflare describes its measurement service as using no analytics cookies or persistent visitor identifiers and not tracking individual visitors across its customers’ websites. This does not mean our host never processes personal data. Where personal data is involved in this limited measurement, we rely on our legitimate interest in understanding website usage and improving its performance (article 6(1)(f)). You can object on grounds relating to your particular situation using the privacy contact below.
Cloudflare can also apply security challenges and receive technical network diagnostics, separately from optional audience measurement. Conditional security checks can use browser technologies, including challenge cookies. Email-address protection uses a script to display our public address.
Who receives data and international processing
Cloudflare provides website hosting, delivery, security and analytics. Its processor services are covered by its customer data processing addendum; its agreement also describes its own network-data purposes, including operating, securing and improving its network. Google Workspace provides our company email under its Cloud Data Processing Addendum. Only the company owner has access to inquiries and CVs. Mail is also synchronized with Gmail and Apple Mail; relevant local copies are subject to the same retention rules. No forwarding is configured.
These providers use relevant infrastructure and support subprocessors, and processing may take place outside the EEA, including in the United States. Their agreements provide transfer arrangements, including standard contractual clauses and applicable adequacy arrangements. We do not promise EU-only processing. You can read the safeguards and recipient information in Cloudflare’s DPA, Cloudflare’s subprocessor list, Google’s CDPA, Google’s transfer notice and Google’s Workspace subprocessor list. You can also contact us for a copy of the relevant transfer safeguards.
Correspondence necessarily reaches its intended recipients and their mail providers. Authorities or courts may receive data where legally required.
How long we keep data
- Inquiries that do not become projects: 12 months from the last substantive contact, except records required by a separate legal duty.
- Recruitment: while the current selection process is active. On closure or withdrawal we stop using the data for recruitment and remove unnecessary CVs and copies, subject to required statutory blocking. For a hired applicant, only necessary information moves into the employment record under its own retention rules. We do not reuse unsuccessful CVs for future vacancies.
- Required business records: six years from the last relevant book entry under Commercial Code article 30, subject to applicable special duties.
- Blocked data: only for the applicable liability limitation periods, restricted from ordinary use, then destroyed. This does not authorize a blanket indefinite CV archive.
- Website/provider records: for request handling and the periods necessary for the provider’s applicable service, security and legal purposes. We do not keep our own visitor-log exports. Cloudflare describes seven days of unsampled Web Analytics data followed by sampled longer-term data, and six months of dashboard access; that access window is not a guarantee that every provider copy is deleted then.
Deletion from our mail account and relevant local copies is distinct from a provider’s deletion process. Google’s CDPA allows up to 180 days to execute an unrecoverable customer deletion instruction, subject to legal storage duties. We review retention monthly and when a recruitment process closes.
Your rights
You can request access, correction, deletion or restriction of your personal data. Where the conditions apply, you can request portability. You can object to processing based on legitimate interests on grounds relating to your particular situation, and withdraw consent where processing relies on it.
Write to [email protected] describing your request. We may ask for proportionate information to confirm your identity if needed. The usual response deadline is one month. If a permitted extension is needed, we will explain it within that month. Legal retention or blocking duties can limit immediate erasure.
You can complain to the Agencia Española de Protección de Datos if you consider your data has been handled improperly.
