Privacy policy
What personal data modelo-036.com handles, why, who receives it, how long it is kept and how to exercise your rights.
Data controller
ONBOARDING, S.L. (sociedad unipersonal), tax number B26924142, Calle Pau Claris 97, 4.º 1.ª, 08009 Barcelona (Spain). Email: contacto@modelo-036.com. This policy follows Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD).
What data we handle
- When you send the form: your first and last name, email address, phone number, your situation (the option you pick in the list) and, if you write one, your message. With them go the page's language, its address with any campaign parameters it carries (utm_source, gclid…), the page you came from (the referrer) if your browser gives it, an id for the request, the date and time it was sent, and your consent with the date of the wording you agreed to.
- The anti-robot check: Cloudflare Turnstile, which only loads once you start filling in the form, checks that you're not a robot from technical data about your connection and browser (such as your IP address). Our server also limits the number of sends per IP address.
- Your visit: as for any website, our hosting provider receives the technical data of each request (IP address, browser, page requested) to serve the site and protect it.
- Nothing else: we use no analytics or advertising tools, set no cookies of our own and store nothing on your device (see the cookie policy).
Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Passing your request to CasitaTax (ZAHARD LTD) so that it contacts you about it | Your consent (art. 6(1)(a) GDPR), given by ticking the form's box, which you can withdraw at any time |
| Protecting the form from robots and abuse (Turnstile, a limit on sends) | Our legitimate interest in the site's security (art. 6(1)(f) GDPR) |
| Serving the website and protecting it (technical request data) | Our legitimate interest in a site that is available and secure (art. 6(1)(f) GDPR) |
Every field is required except the message: without them, and without your consent, we can't pass your request on. Withdrawing your consent doesn't undo a hand-off already made; for the data CasitaTax already holds, you can also contact it directly.
Who receives your data
- CasitaTax, of ZAHARD LTD (71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom), if you consent. Your request is saved in its register of requests, and from then on CasitaTax handles it as controller, under its own privacy policy. It keeps each request for 12 months after its last exchange with you, unless you become a customer.
- Cloudflare, Inc., as processor: it hosts the site, runs the server that receives the form and provides the Turnstile check.
- n8n, our group's automation tool, as processor: it passes your request to CasitaTax's register and keeps no copy of the sends that go through.
- Discord, Inc., as processor: it tells the team about each new request in a message that only shows the site, the form, your situation, the language, your email masked (the first two characters before and after the @ and the domain's ending), your phone's country code, whether there is a message and its length, the page without its parameters, the referring domain, the ad platform or the campaign (source, medium, name and content), the names of any click ids (never their values), the date of the consent wording and a link to the record. Never your name, your full email or phone number, your message or the click ids' values.
International transfers
The United Kingdom, where CasitaTax is, is covered by a European Commission adequacy decision: Implementing Decision (EU) 2021/1772 of 28 June 2021, as amended by Implementing Decision (EU) 2025/2574 of 19 December 2025, valid until 27 December 2031.
Cloudflare and Discord are US companies. Transfers to them rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
How long we keep it
- ONBOARDING, S.L. keeps no copy of your request: it goes straight to CasitaTax's register, which keeps it for 12 months after the last exchange with you, unless you become a customer.
- Our server's error logs contain none of your data; Cloudflare keeps technical request data under its own policy.
- The Discord notification, with the masked data described above, stays in the team's channel.
Your rights
You can ask to access your data, have it corrected or erased, restrict its use or receive it in a portable format, object to its use, and withdraw your consent at any time, by writing to contacto@modelo-036.com. We reply within one month.
If you think we've mishandled your data, you can complain to the Agencia Española de Protección de Datos, Spain's data protection authority (aepd.es), Paseo de la Castellana, 141, 9th floor (Edificio Cuzco IV), 28046 Madrid, or to the authority of the EU country where you live.
Changes
If what the site does changes, we update this policy and its date. If we ever used analytics or advertising cookies, we would ask for your consent first.