Last updated: 10 September 2026
Privacy notice
This notice explains what personal data we process on scalewave.es, why, for how long, and what you can do about it. It is written to be read, not to cover our backs.
1. Who processes your data
The data controller is GEMDV Solutions, S.L., tax ID B75265207, with registered office at Calle O'Donnell 28, planta 5, 28009 Madrid, Spain, trading as ScaleWave Solutions.
Write to [email protected] or call +34 609 846 299 with anything relating to this notice or to your data.
2. What we process and why
We buy no lists and track no one off our own site. Everything we process arrives through one of these routes:
Contact form
- Data
- Name, email address, company, role, subject, and the message you write.
- Purpose
- To reply to you and, where relevant, prepare a proposal.
- Legal basis
- Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) and your consent in submitting the form (Art. 6(1)(a)).
- Retention
- 3 years from last contact.
Operating diagnostic (the test)
- Data
- The ten questionnaire answers, which do not identify you and which we score without asking you for anything. If you choose to request the full report: your name, your work email address, your company name and, optionally, a website and a phone number.
- Purpose
- To calculate your index and show it to you on screen, and — only if you give us your details — to generate the full report, email you the PDF, and prepare the follow-up conversation if you choose to have one.
- Legal basis
- Your consent, given via the checkbox when you request the report, after you have already seen your result on screen (Art. 6(1)(a) GDPR), and pre-contractual steps (Art. 6(1)(b)). If you tick nothing you still see your result, and we do not keep a record of who you are.
- Retention
- 3 years from completion.
Newsletter
- Data
- Your name and email address, if you tick the subscribe box in the diagnostic.
- Purpose
- To send you our notes on operations and automation. Nothing else: we do not share the list or use it for anything other than that.
- Legal basis
- Your consent, given through a separate, unticked box (Art. 6(1)(a) GDPR). Not subscribing changes nothing about the diagnostic you receive.
- Retention
- Until you unsubscribe. Every send carries an unsubscribe link, and you can also ask by writing to [email protected].
Contact-channel clicks
- Data
- We log when someone clicks our WhatsApp, email or phone links, along with the page they clicked from and the campaign parameters (UTM) they arrived with.
- Purpose
- To learn which campaigns and pages start real conversations, and not to lose someone who contacted us without filling in a form.
- Legal basis
- Our legitimate interest in measuring our marketing (Art. 6(1)(f) GDPR).
- Retention
- 24 months from the click.
Usage analytics
- Data
- Pages visited, time on page, device and browser, and where you came from. See section 8 on cookies.
- Purpose
- To understand which content earns its place and fix what does not work.
- Legal basis
- Your consent, given in the cookie notice the first time you arrive (Art. 6(1)(a) GDPR). Without it they do not load. You can withdraw it from the “Cookies” link in the footer.
- Retention
- Per each provider’s own retention periods, listed in section 4.
Technical logs
- Data
- Our server receives your IP address with every request and holds it in memory to limit how many submissions one origin can make. We do not store it against your diagnostic or your message.
- Purpose
- To prevent abuse and keep the service available.
- Legal basis
- Our legitimate interest in service security (Art. 6(1)(f) GDPR).
- Retention
- In memory, for minutes. Our hosting provider keeps its own access logs under its policy.
3. Use of artificial intelligence
Your diagnostic report is written by an Anthropic language model (Claude) from your answers. The scoring itself is deterministic and computed on our own server: the model writes the prose, it does not decide your result.
When you give your company name, we also search for publicly available information about it (website, digital presence, sector) to give the report context. We search about the company, not about you as an individual.
No automated decision producing legal or similarly significant effects on you is taken within the meaning of Article 22 GDPR. The report is guidance; any conversation that follows is with a person.
Under Anthropic’s terms of service for API customers, data sent through the API is not used to train their models.
4. Who we share your data with
We do not sell your data or hand it to third parties to advertise at you. We share it only with the providers we need in order to run the service, each acting as a processor under contract:
- Vercel Inc. — hosting for the site and its server functions (United States).
- Amazon Web Services — the database holding form submissions and diagnostics (region eu-north-1, Stockholm, inside the European Economic Area).
- Anthropic PBC — diagnostic report generation and public company lookup (United States).
- Google — corporate email, through which form submissions reach us, and Google Calendar for booking meetings.
- Google — reCAPTCHA, which checks that whoever submits a form is a person and not a bot. It receives your IP address and data about how you interacted with the page.
- Meta Platforms Ireland Ltd. — advertising measurement pixel.
- Microsoft Corporation — Microsoft Clarity, usage analytics.
- We may also disclose data to public authorities where the law requires it.
5. International transfers
Your form submission and your diagnostic are stored on a server inside the European Union (AWS, region eu-north-1, Stockholm), so the database itself never leaves the European Economic Area.
Some of the providers listed above are established in the United States: Vercel, Anthropic and Microsoft. Those transfers rely on the Standard Contractual Clauses approved by the European Commission and, where the provider is certified, on the EU–US Data Privacy Framework.
You can request a copy of the applicable safeguards by writing to [email protected].
6. How long we keep your data
Each period is given alongside its purpose in section 2. When it expires we delete the data or irreversibly anonymise it.
While a commercial relationship is active we keep what we need to maintain it, and afterwards for the applicable statutory limitation periods.
7. Your rights
You may exercise the following rights at any time, free of charge:
- Access: to know what data of yours we process.
- Rectification: to correct anything inaccurate.
- Erasure: to ask us to delete it.
- Restriction: to ask us to keep it but stop using it.
- Portability: to receive it in a structured, commonly used format.
- Objection: to object to processing based on our legitimate interest.
- Withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal.
Write to [email protected] saying which right you wish to exercise. We will respond within one month.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Security
The site is served entirely over HTTPS, data is encrypted in transit, and access to the internal panel where form submissions and diagnostics are read is restricted and authenticated.
Forms are protected with Google reCAPTCHA v3, which scores each submission to tell people from bots. It runs in the background without asking you to solve anything, and we use it for that alone — never to profile you and never for advertising.
No system is infallible. Should a breach occur that poses a high risk to your rights, we will tell you and notify the supervisory authority within the statutory deadlines.
10. Minors
This site is aimed at professionals and businesses. We do not knowingly collect data from minors. If you believe a minor has given us data, write to us and we will delete it.
11. Users in Mexico
If you give us your data from Mexico, this document also constitutes the privacy notice required by the Federal Law on Protection of Personal Data Held by Private Parties.
You may exercise your ARCO rights — access, rectification, cancellation and objection — and withdraw your consent, by writing to [email protected]. If you believe your right has not been honoured, you may turn to INAI.
12. Changes to this notice
If we change how we process your data we will update this document and the date at the top of the page. Where the change is substantial we will tell you through the contact details you gave us.