Privacy policy
This policy describes how BlueUP processes the personal data collected through this website (www.blueup.es), in compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and the guarantee of digital rights (LOPDGDD).
Last updated: 7 June 2026.
Data controller
| Item | Detail |
|---|---|
| Controller | BlueUP Technology |
| Scope | Spain — infrastructure deployed on Google Cloud (Europe) |
| Privacy contact | arturo@navarro-bores.com |
For any question regarding this policy or the processing of your data, the contact channel is the email address above.
Data we process
Only the data that the user voluntarily provides through the website forms is processed. No data is collected from external sources or through advertising tracking.
| Source | Data collected |
|---|---|
| DORA calculator | Work email and the self-assessment result (maturity score per pillar) that the user generates in their own browser. |
| Whitepaper downloads | Name, work email and, optionally, company and sector. |
The calculator score is computed in the user's browser and attached as commercial context; it does not constitute an automated decision with legal effects (see "Automated decisions").
Purpose of processing
Data is processed in order to:
- Handle the user's request: get in touch, schedule a demo session or send the requested material.
- Maintain commercial communications related to BlueUP's products and services, where the user has given consent.
Data is not used to build advertising profiles, nor is it shared for third-party marketing purposes.
Legal basis
The legal basis for processing is the consent of the data subject (Article 6.1.a GDPR), given by ticking the acceptance box on the form before submitting it. The user may withdraw this consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Recipients and processors
To provide the service, data may be processed by the following providers, which act as processors under the corresponding agreement:
| Processor | Function | Data location |
|---|---|---|
| Scaleway (Transactional Email) | Delivery of the email that transports the lead | France (European Union) |
| Google (Workspace and Cloud) | Email reception and website hosting | European Union regions |
Lead data is integrated into an in-house CRM hosted on infrastructure controlled by the controller, with restricted access. Personal data is not shared with third parties other than those above, except where required by law.
International transfers
Processing takes place on servers located in the European Union. Where a provider belongs to a group whose parent company is outside the European Economic Area, the appropriate safeguards are based on the European Commission's standard contractual clauses and, where applicable, on the EU-US Data Privacy Framework.
Retention period
Data is kept for as long as the commercial relationship or the user's interest is maintained and deletion is not requested. Once consent is withdrawn or the purpose is fulfilled, data is deleted or blocked for the periods legally required, after which it is erased.
Automated decisions
No automated decisions are made that produce legal effects on the user or that significantly affect them. The DORA calculator score is an indicative self-assessment tool generated on the user's own device.
Cookies and local storage
This website does not use tracking cookies, third-party analytics or advertising. It only uses the browser's local storage (localStorage) to remember the user's functional preferences, such as language and theme (light/dark). These preferences do not identify the individual and are not transmitted to external servers.
Your rights
The user may exercise the following rights over their data at any time:
- Access: find out what data is being processed.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request the deletion of the data.
- Objection: object to a specific processing.
- Restriction: request that processing be restricted.
- Portability: receive the data in a structured, commonly used format.
- Withdrawal of consent: revoke the consent given, with future effect.
How to exercise your rights
To exercise any of these rights, simply send a request to arturo@navarro-bores.com, stating the right you wish to exercise. The request will be handled within the periods established by the applicable regulations.
If the user considers that the processing does not comply with the regulations, they have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Changes to this policy
This policy may be updated to reflect legal changes or changes in processing. The version in force is always the one published on this page, together with its last-updated date.