Skip to content 
Privacy Policy
clyvert.com · Last updated: August 2026
Contact: info@clyvert.com · Phone and WhatsApp: +34 602 64 33 21
At Clyvert we process the personal data of people who visit the website, request information, hire our services or receive our communications. This policy explains what data we process, for what purposes, on what legal basis, who we share it with and what rights you have.
Applicable legislation: Regulation (EU) 2016/679 (GDPR), Ley Orgánica 3/2018 (Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights, LOPDGDD) and Ley 34/2002 de Servicios de la Sociedad de la Información y de Comercio Electrónico (Spanish Law 34/2002 on Information Society Services and Electronic Commerce, LSSI-CE).
1. Our dual role: controller and processor
It is important to distinguish between two very different situations.
a) Clyvert as data controller. When we process data of website visitors, people who contact us, clients, business contacts, suppliers and subscribers. The rest of this policy refers to this scenario.
b) Clyvert as data processor. When, in providing our services, we access personal data of our clients' end customers: email marketing databases, CRM contacts, advertising audiences, forms on a website we develop, or WhatsApp and ManyChat conversations.
In these cases the controller is the client, who determines the purposes of the processing, and Clyvert acts on its behalf and in accordance with its documented instructions. This relationship is governed by the data processing agreement under Article 28 of the GDPR, which forms part of the terms of contract. Clyvert does not use that data for its own purposes or retain it for longer than necessary to provide the service.
2. Data we process and where it comes from
| Source | Data |
|---|---|
| Website contact form | Name, email, phone number and message content |
| WhatsApp, phone call or email | Name, phone number, email, content of the conversation and any documents you send us |
| Social media (Facebook, Instagram, LinkedIn, TikTok) | Profile name, direct messages, comments and data from lead generation forms |
| Contracting and invoicing | Identification and tax data, contact details of members of your team and bank details |
| Subscription to communications | Email, name and interaction data (opens and clicks) |
| Browsing the website | IP address, cookie identifiers, pages visited, device and browser |
| Publicly accessible sources | Business contact details published by the company itself (corporate website, directories, professional profiles) for business-to-business prospecting |
We do not process special categories of data (health, ideology, ethnic origin, biometrics, sexual orientation and the other cases set out in Article 9 of the GDPR). Please do not provide us with this type of information. If, due to the nature of your project, it were essential to process it, this will be expressly agreed in writing with the additional safeguards required by law.
The data you provide must be accurate and up to date. If you provide us with data relating to third parties, for example employees or partners, you must have informed them beforehand and have a legal basis for disclosing it to us.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to enquiries, quote requests and free audit requests | Taking pre-contractual steps at the request of the data subject (Art. 6.1.b GDPR) | 1 year from the last contact if no relationship is formalised |
| Providing the contracted services and managing the client relationship | Performance of the contract (Art. 6.1.b GDPR) | Duration of the relationship and limitation periods for legal actions |
| Invoicing, accounting and tax obligations | Legal obligation (Art. 6.1.c GDPR) | 6 years under the Código de Comercio (Spanish Commercial Code) and 4 years under tax legislation |
| Sending commercial communications to clients about services similar to those contracted | Article 21.2 of the LSSI, with the right to object in each communication | Until you unsubscribe |
| Sending commercial communications to non-clients and newsletter | Consent (Art. 6.1.a GDPR and Art. 21.1 LSSI) | Until you withdraw your consent |
| Managing relationships with sole traders and professionals based on their business contact details | Legitimate interest (Art. 6.1.f GDPR and Art. 19 LOPDGDD) | Until objection or 1 year without interaction |
| Web analytics and audience measurement | Consent given in the cookie panel | As set out in the Cookie Policy |
| Personalised advertising, remarketing and audience creation | Consent given in the cookie panel | As set out in the Cookie Policy |
| Publication of case studies and testimonials | Client's consent | Until revoked |
| Website security, fraud prevention and defence against claims | Legitimate interest (Art. 6.1.f GDPR) | Statutory limitation periods |
Once the stated periods have elapsed, the data is blocked and kept exclusively at the disposal of judges and courts, the Public Prosecutor's Office and the competent public authorities during the limitation periods, after which it is deleted.
4. Recipients and providers
We do not sell or transfer your personal data. We do disclose it, where necessary, to the following recipients.
Public authorities and bodies, where there is a legal obligation: the Spanish Tax Agency (Agencia Tributaria), Social Security, the State Security Forces and Corps, and courts and tribunals.
Tax and accounting advisers, banks and payment gateways, for the financial management of the relationship.
Technology providers acting as data processors, with a contract signed under Article 28 of the GDPR. These include, among others and depending on the service concerned:
- Hosting and corporate email.
- Communication with clients: WhatsApp (Meta Platforms Ireland Ltd.) and ManyChat, Inc.
- Email marketing and automation: Brevo (Sendinblue SAS) and, depending on the project, Mailchimp (Intuit Inc.) or Klaviyo, Inc.
- Advertising and analytics: Google Ireland Ltd. and Google LLC (Google Ads, Google Analytics 4, Google Tag Manager and Google Business Profile), Meta Platforms Ireland Ltd. (Facebook and Instagram), LinkedIn Ireland Unlimited Company, TikTok Technology Ltd. and Amazon Ads.
- Work tools and CRM: HubSpot, Shopify, Figma and SEO analysis tools such as SEMrush and Screaming Frog.
- External collaborators (designers, developers, copywriters and media specialists) bound by a confidentiality agreement and, where applicable, by a data processing agreement.
The specific list of providers may vary depending on technological developments and the needs of each project. You can request the up-to-date list by writing to info@clyvert.com.
5. International data transfers
Some of the above providers belong to groups whose parent company is based in the United States, so an international transfer of data may take place. These transfers are covered by one of the mechanisms provided for in Chapter V of the GDPR:
- The European Commission adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795) on the EU-US Data Privacy Framework, for providers certified under that framework. This decision was upheld by the judgment of the General Court of the European Union of 3 September 2025 (Case T-553/23).
- The Standard Contractual Clauses approved by the European Commission, supplemented where appropriate by additional technical and organisational measures and by the corresponding transfer impact assessment.
Brevo, as a European provider, processes data within the European Union. You can request information about the safeguards applied to a specific provider by writing to info@clyvert.com.
6. Commercial communications
If you are a client, we may send you information about services similar to those you have contracted, under Article 21.2 of the LSSI. In any other case, we will only send you commercial communications by electronic means if you have given us your prior consent.
In all cases you can unsubscribe using the link included in each communication or by writing to info@clyvert.com. Unsubscribing is immediate and free of charge, and does not affect operational notices relating to an ongoing service, such as deliveries, incidents or invoicing.
7. Cookies, pixels and measurement tools
The website uses cookies and measurement and advertising technologies, which are only activated once you have given your consent and are described in detail in the Cookie Policy, where you can also change or withdraw your preferences at any time.
With regard to the collection and transmission of data through the Meta pixel, Clyvert and Meta Platforms act as joint controllers under the terms of the judgment of the Court of Justice of the European Union of 29 July 2019 (Case C-40/17, Fashion ID), with joint responsibility limited to that collection and transmission stage. Any subsequent processing carried out by Meta on its own behalf is governed by its own policies.
8. Communication via WhatsApp
If you contact us via WhatsApp, we process your data as controllers in order to respond to your enquiry and manage the business relationship (Articles 6.1.b and 6.1.f of the GDPR). WhatsApp acts as the messaging service provider in accordance with its own terms and privacy policies, which include the processing of communication metadata.
We recommend that you do not use this channel to send us special categories of data or sensitive documents. If you prefer another channel, you can write to us at info@clyvert.com.
9. Automated decision-making and profiling
We do not make decisions that produce legal effects concerning you based solely on automated processing.
As is standard practice in digital marketing, we do use the platforms' advertising targeting and optimisation systems (Google, Meta, LinkedIn and TikTok) to show ads to audiences with certain characteristics. This targeting does not produce legal effects concerning you or similarly significantly affect you, and you can avoid it by not consenting to marketing cookies and by adjusting the advertising preferences on each platform.
10. Data security
We apply technical and organisational measures appropriate to the risk: encryption in transit using an SSL/TLS certificate, profile-based access control, strong authentication on the tools that allow it, backups, confidentiality agreements with the team and collaborators, and periodic review of providers.
No system is invulnerable. If a security breach were to occur that poses a high risk to your rights and freedoms, we will inform you without undue delay and notify the Agencia Española de Protección de Datos (Spanish Data Protection Agency) in accordance with Articles 33 and 34 of the GDPR.
11. Minors
Our services and this website are aimed at companies, freelancers, sole traders and professionals. We do not knowingly process data of children under 14. If we discover that we have received data from a minor under that age without the consent of their parents or guardians, we will delete it.
12. Your rights
You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as the right not to be subject to automated individual decision-making and to withdraw the consent you have given, without affecting the lawfulness of the processing carried out beforehand.
How to exercise them: simply send an email to info@clyvert.com stating the right you wish to exercise, from an address that allows us to identify you. You do not need any specific form or format and you do not need to attach a copy of your ID card (DNI). We will only ask you for additional identification documents if there are reasonable doubts about your identity, in accordance with Article 12.6 of the GDPR.
We will respond within a maximum of one month, which may be extended by a further two months if the request is particularly complex, in which case we will inform you of the extension and the reasons for it.
Complaints to the supervisory authority. If you consider that we have not handled your request correctly, you can lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es, calle Jorge Juan 6, 28001 Madrid). We would be grateful if, before doing so, you gave us the opportunity to resolve the matter by writing to us.
13. Changes to this policy
We may update this policy to adapt it to regulatory changes, new services or changes in our providers. The current version is always the one published on this page, with its update date. If the changes are substantial and affect processing based on your consent, we will let you know.