Privacy Policy

1. Data controller

   Controller: Cortizo Visual Studio (trading as CRTZ Agency). Tax ID (NIF): B56901200. Address: Barrio Oural N7, Fornelos da Ribeira, Pontevedra, 36455, Spain. Email: hello@cortizo.agency. Phone: +34 634 408 572.

2. Data we process

   Depending on what you do on the Service, we process the following data:

   1. Meeting form: full name, email address, phone number, business name and location, services of interest, reason, website or Instagram, approximate budget, how you found us and anything else you choose to tell us.
   2. Newsletter and resources: email address, name (if you give it), language, the resource you request, whether you accepted the newsletter, and the subscription status (confirmed, unsubscribed, bounced or reported as spam).
   3. Technical data sent with any form: date and time, the page you sent it from, time zone, browser and campaign parameters (UTM) from the link you arrived through.
   4. Meeting bookings: name, email address, phone number, anything you tell us when booking, the date you choose and, if you arrive from one of our emails, an internal identifier that tells us which email you booked from.
   5. Business prospecting: business name, business email address and phone number, website, Instagram, city and type of business, as they appear in public sources (Google Maps, business directories and the business’s own website).

3. What we use your data for, and on what basis

   We use your data only for the following purposes:

   1. Handling your meeting request and preparing a proposal: a pre-contractual measure taken at your request (Art. 6(1)(b) GDPR).
   2. Sending you the resource you asked for: with your consent, given when you submit the form (Art. 6(1)(a) GDPR).
   3. Sending you the CRTZ Agency newsletter: only if you tick the box, which is unticked by default, and confirm your email through the message we send you (Art. 6(1)(a) GDPR). You can withdraw your consent at any time without affecting what was processed before.
   4. Writing to businesses we think may be interested in our services: CRTZ Agency’s legitimate interest in making its work known to other professionals (Art. 6(1)(f) GDPR and Art. 19 of Spain’s LOPDGDD). We only use business contact data. See "If we wrote to you out of the blue" below.

   Requesting a resource does not subscribe you to the newsletter, and joining the newsletter does not oblige you to request anything. We do not make automated decisions about you.

   If we want to use your data for another purpose, we will ask you first.

4. Who receives your data

   We do not sell or give away your data. To provide the service we rely on the following providers, who act as data processors:

   1. Brevo (Sendinblue SAS, France): sending the emails.
   2. Listmonk: managing the newsletter list and unsubscriptions. It is self-hosted on a CRTZ Agency server.
   3. n8n: automation that receives the forms, creates the subscription and notifies the team. It is hosted on a CRTZ Agency server.
   4. Cal.com: booking calendar for meetings. It is self-hosted on a CRTZ Agency server.
   5. Plausible Analytics: aggregate statistics of visits to the website (pageviews, referrer, country and device type). It uses no cookies, stores nothing on your device and does not identify you. It is self-hosted on a CRTZ Agency server.
   6. Google Meet (Google Ireland Limited): video calls for meetings.

   Brevo may technically record the delivery of emails and, where applicable, opens and clicks, always as a data processor acting on behalf of CRTZ Agency. You can unsubscribe at any time.

   We do not plan to transfer your data outside the European Economic Area. If Google processes video-call data outside the EEA, it does so under the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses. We will only disclose your data to third parties if the law requires us to.

5. If we wrote to you out of the blue

   Sometimes we write to clinics and businesses that do not know us yet to introduce our work. If you received one of those emails, we took your business contact from public sources: Google Maps, business directories or your own website.

   We only use your business email and business details, based on CRTZ Agency’s legitimate interest in making its services known to other professionals (Art. 6(1)(f) GDPR and Art. 19 of Spain’s LOPDGDD). We do not use data about your private life or combine it with other sources.

   For that email we measure, in aggregate and without knowing who is who, how many people open it and how many click its links. If you book a meeting from the email, the link carries an internal identifier so we know which email you came from.

   We keep this data until you unsubscribe or object and, at most, for 12 months after sending if we have not spoken since. If you unsubscribe, we keep only your address, blocked, so we do not write to you again.

   You can object at any time with the "Darme de baja" (unsubscribe) link in the email or by writing to hello@cortizo.agency.

6. How long we keep it

   Meeting and proposal: for as long as our conversation lasts and, afterwards, for 3 years to deal with possible claims.

   Newsletter: until you unsubscribe. After that we keep only your address, blocked, so we do not write to you again.

   Business prospecting: until you unsubscribe or object and, at most, for 12 months after sending if we have not spoken since.

   Resources: we keep your request for as long as needed to deliver it and to answer any later question about it.

7. How to unsubscribe

   All our emails, including prospecting ones, contain a link to unsubscribe at any time, in one click. You can also write to us at hello@cortizo.agency.

8. Your rights

   You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to hello@cortizo.agency, and you can withdraw your consent at any time. We will reply within the period set by law.

   If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

   More information on the AEPD website: www.aepd.es .

9. Cookies

   To find out how we use cookies and what choices you have, see our Cookie Policy .

10. Security

    We apply reasonable technical and organisational measures to protect your data from loss, unauthorised access or misuse. Even so, no transmission over the internet is completely secure.