Privacy policy
This policy describes how BlueUP processes the personal data collected through this website (www.blueup.es), in compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and the guarantee of digital rights (LOPDGDD).
Last updated: 28 September 2026.
Data controller
| Item | Detail |
|---|---|
| Controller | BLUEUP M&M, S.L. |
| Tax ID (NIF) | B87782579 |
| Address | Calle Cañón del Río Lobos 7, 1.º A, 28030 Madrid (Spain) |
| Scope | Spain — website and form receiver hosted on Google Cloud (Europe) |
| Privacy contact | privacidad@blueup.es |
For any question regarding this policy or the processing of your data, the contact channel is the email address above.
Data we process
Through the website forms, only the data that the user voluntarily provides is processed; the website does not collect data from external sources or through advertising tracking. B2B commercial prospecting, which does use publicly available data, is described in its own section below.
| Source | Data collected |
|---|---|
| DORA calculator | Work email and the self-assessment result (maturity score per pillar) that the user generates in their own browser. |
| Whitepaper downloads | Name, work email and, optionally, company and sector. |
| Demo request | Name, company, work email, the message the user writes and, optionally, sector. |
The calculator score is computed in the user's browser and attached as commercial context; it does not constitute an automated decision with legal effects (see "Automated decisions").
Purpose of processing
Data is processed in order to:
- Handle the user's request: get in touch, schedule a demo session or send the requested material.
- Maintain commercial communications related to BlueUP's products and services, where the user has given consent.
Data is not used to build advertising profiles, nor is it shared for third-party marketing purposes.
Legal basis
The legal basis for processing is the consent of the data subject (Article 6.1.a GDPR), given by ticking the acceptance box on the form before submitting it. The user may withdraw this consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
B2B commercial prospecting (professional contacts)
Separately from the data collected through the website, BlueUP carries out business-to-business (B2B) prospecting: it identifies the appropriate contact person at companies in the financial sector for an initial professional approach.
- Data processed: professional data about the person in their work role (name, job title, company, public LinkedIn profile and, where applicable, work email). No special categories of data are processed.
- Source of the data: this data is not obtained from the data subject, but from publicly available sources (professional directories such as The Org or RocketReach, public LinkedIn profiles and press). This information is provided in compliance with Article 14 GDPR.
- Purpose: an initial commercial contact regarding BlueUP's consulting and compliance (AML/DORA) services.
- Legal basis: the controller's legitimate interest (Article 6.1.f GDPR) in promoting its services among sector professionals, balanced against the data subject's rights through a legitimate interest assessment. The data is professional and publicly available, and the impact on the data subject is low.
- Retention: contact data is deleted after 24 months without interaction.
- Recipients: internal use in a CRM system that runs on a local machine. It is not shared with third parties for marketing purposes.
Right to object: as the basis is legitimate interest, the data subject may object at any time to this processing (in addition to exercising the other rights in the "Your rights" section) by writing to privacidad@blueup.es. In addition, every commercial communication will include an easy way to opt out.
Recipients of the data
To provide the service, the data is sent to the following providers:
| Provider | Function | Data location |
|---|---|---|
| Google Cloud | Form reception and website hosting | Belgium (European Union) |
| Scaleway (Transactional Email) | Delivery of the email that transports the lead | France (European Union) |
| Google Workspace | Mailbox that receives the lead | No guaranteed region |
| OVH (Zimbra) | Mailbox that receives a copy of the lead | France (European Union) |
Lead data may then be integrated into a CRM system that runs on a local machine, with no cloud deployment. The data submitted through the forms is not disclosed to recipients other than those in the table, except where required by law.
International transfers
The data processing terms of these providers may allow them to process the data outside the European Economic Area, in addition to the locations stated in the table. Google's allow this in any country where Google or its subprocessors maintain facilities, subject to its data location and data transfer commitments, and, for transfers to a country they do not treat as adequate, apply the alternative transfer solution Google has adopted, such as the EU-US Data Privacy Framework, or, failing that, the European Commission's standard contractual clauses. Scaleway's provide for applying those standard contractual clauses to transfers outside the European Union or to a country without an adequacy decision, and OVH states that it has concluded standard contractual clauses with each of its subsidiaries for processing outside the European Economic Area. The EU-US Data Privacy Framework is based on a European Commission adequacy decision for the US companies certified under it, and the Commission publishes the text of the standard contractual clauses.
Retention period
Data is kept for as long as the commercial relationship or the user's interest is maintained and deletion is not requested. Once consent is withdrawn or the purpose is fulfilled, data is deleted or blocked for the periods legally required, after which it is erased.
Automated decisions
No automated decisions are made that produce legal effects on the user or that significantly affect them. The DORA calculator score is an indicative self-assessment tool generated on the user's own device.
Cookies and browser storage
This website sets no cookies and loads no analytics, advertising or tracking scripts. It does keep data in the browser's storage: the color theme (light or dark), from the first visit, and, if the search is used, the results view and the search text, the latter until the tab is closed. The only third-party content is YouTube videos: their thumbnails load with the page and the player only when play is pressed. The player runs inside a YouTube frame whose connections, cookies and storage are managed by Google, not by this website.
Your rights
The user may exercise the following rights over their data at any time:
- Access: find out what data is being processed.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request the deletion of the data.
- Objection: object to a specific processing.
- Restriction: request that processing be restricted.
- Portability: receive the data in a structured, commonly used format.
- Withdrawal of consent: revoke the consent given, with future effect.
How to exercise your rights
To exercise any of these rights, simply send a request to privacidad@blueup.es, stating the right you wish to exercise. The request will be handled within the periods established by the applicable regulations.
If the user considers that the processing does not comply with the regulations, they have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Changes to this policy
This policy may be updated to reflect legal changes or changes in processing. The version in force is always the one published on this page, together with its last-updated date.