Privacy policy

Last updated: 23 July 2026

1. Data controller

The data controller for this website is Asociación Social INDEED Projects, registered in Spain.

2. Data processed through the public website

This website does not use public user accounts, behavioural advertising, analytics profiles or a public newsletter subscription system.

When you use the contact form or write to us by email, we process the information you provide, which may include your name, email address, organisation, professional role and the content of your message. The contact form transmits your message directly by email to INDEED Projects; the message content is not stored in the website's content management system or in any content database. Limited delivery and security metadata (such as the date and outcome of the submission) may be logged for troubleshooting, without the message content.

Opening the contact page creates a temporary, strictly necessary first-party session cookie (`indeedpublicsess`) that stores only a security token used to confirm that a submission genuinely came from this website's own form (CSRF protection). This cookie does not store your message, your name, your email address or any other personal or profiling information, and it lasts only for the browser session.

The website's restricted administration area (`/admin/`) is managed locally by INDEED Projects through its own content management panel and uses a separate, strictly necessary, first-party session cookie (`indeedadminsess`) to keep an authorised administrator signed in; no third-party authentication provider is used. This cookie is only ever set when an administrator signs in, not for ordinary visitors.

Our hosting provider may process limited technical server logs, such as IP address, browser information, requested page, date and security logs, to deliver and protect the website.

3. Purposes and legal bases

We process contact information to respond to enquiries, explore cooperation and take steps requested by the person contacting us. The legal basis is the requester’s initiative and our legitimate interest in managing organisational correspondence and partnerships.

Technical data is processed for the legitimate interest of operating a secure, reliable and accessible website.

4. Recipients and processors

Information may be accessed by authorised INDEED Projects personnel and by service providers used for hosting, domain management, security and email delivery, only where necessary for their services.

This website is hosted on conventional web hosting infrastructure located in the European Union, without a database and without any third-party content management or authentication service.

5. International transfers

Where a service provider processes information outside the European Economic Area, INDEED Projects will rely on an applicable legal mechanism, such as an adequacy decision or European Commission standard contractual clauses.

6. Retention

Enquiry correspondence is retained for as long as necessary to respond, manage the relationship and meet applicable legal or accountability requirements. Technical security logs are retained for a limited period proportionate to operational and security needs.

7. Rights

You may request access, rectification, erasure, restriction, portability where applicable, or object to processing based on legitimate interests. You may also lodge a complaint with the Spanish Data Protection Agency.

Requests may be sent to office@indeedprojects.es.

8. External links and embedded services

This website links to external websites and social media. When you follow an external link, the third party processes information under its own privacy policy. We do not embed social-media feeds or advertising trackers on the public website.

9. Changes

This policy may be updated when website functions, service providers or legal requirements change. The current version and revision date will remain available on this page.