Data protection
Privacy policy
How TalumCore handles data from enquiries, demo requests and website visits.
Last reviewed: 1 September 2026
1. Data controller
- Website owner
- Pere Antón Mola Solá
- Tax ID
- 47683093E
- Registered address
- Passatge Gaspar Balcells, 3, 25600, Balaguer, Lleida
- Contact email
- administracio@holisticcentre.es
- Data rights contact
- administracio@holisticcentre.es
2. Data, purposes and legal basis
Contact and demo forms process the visitor’s name, email, clinic, team size and message, together with the language, originating page and a technical request identifier. When an enquiry is sent from a campaign URL, it may also include UTM parameters and advertising identifiers present in that URL and, only in that case, the origin —without path or query— of the referring website. This information is used to reply, understand requirements and attribute the enquiry to the relevant campaign. To preserve attribution while the visitor navigates, campaign parameters are stored temporarily in the tab’s sessionStorage and deleted when the tab closes; no form field is stored there.
Name and email are required for every request. Clinic and team size are required for a demo request; the message is required for a contact enquiry. Without those details, the request cannot be handled. Fields identified as optional may be left blank.
The legal basis is taking pre-contractual steps requested by the data subject and, for general enquiries, the legitimate interest in answering professional communications. Measuring the source of enquiries is based on the legitimate interest in evaluating and improving commercial acquisition using limited information, without creating a persistent browsing profile. You may object to this processing by writing to the address in the rights section. The data is not used for newsletters or advertising without a separate legal basis. Patient data must not be submitted.
If you choose to book a meeting, the link opens an external Google Calendar page. Data entered there is sent directly to Google and TalumCore receives the details needed to organise the meeting. This processing is necessary to take pre-contractual steps requested by the data subject.
3. Retention
Commercial enquiries that do not result in a contractual relationship are retained for no longer than 12 months after the last interaction. They are then deleted unless applicable law requires longer retention to meet obligations or handle legal claims. If a contractual relationship begins, the necessary data is retained while it remains in force and afterwards for the applicable statutory periods.
4. Analytics, advertising measurement and security
Vercel hosts this website and provides Web Analytics and Speed Insights. The current Web Analytics setup records aggregate page and event metrics without third-party cookies or persistent cross-site identifiers. Events do not contain names, email addresses or form content.
The Google Ads tag loads on every page using Advanced Consent Mode. Before a choice is made, or when consent is denied, Google advertising storage, advertising user data, personalisation and analytics remain denied. In that state Google may receive limited cookieless technical signals —such as consent state, IP address, date and time, browser or device data, and page or referrer information with advertising identifiers such as gclid redacted— for technical diagnostics and aggregate measurement modelling. This limited processing is based on TalumCore’s legitimate interest in checking that its tag works and obtaining aggregate measurement with a restrictive setup. TalumCore sends no request or conversion event without consent. Advertising storage and measurement are enabled only after acceptance to attribute whether a visit results in a contact or demo request confirmed by the server. The automatic page-view event, enhanced conversions and advertising personalisation remain disabled. TalumCore does not add names, email addresses, clinic names, team sizes, messages or any other form content to the tag or event.
The OpenAI ChatGPT Ads pixel does not load before consent. After acceptance, it may retain the oppref advertising reference in a first-party cookie and sends the standard lead_created event only when the server confirms a request. The event includes a unique technical identifier and is opted out of personalisation. OpenAI automatic advanced matching may detect supported contact details, normalise them and generate a SHA-256 hash in the browser; OpenAI does not receive those details in plain text or the message content. Patient data must not be entered. Consent can be withdrawn at any time using the “Manage cookies” button.
The hosting provider may also process technical metadata and logs needed to provide the service, detect abuse and protect the website, based on the legitimate interest in keeping it secure.
5. Providers and international transfers
Vercel provides hosting, analytics and performance monitoring; Resend transmits form emails; Google hosts the receiving mailbox; Google Ads receives limited cookieless signals while consent is denied and, after acceptance, measures confirmed advertising conversions; and OpenAI loads its pixel and measures confirmed leads only after acceptance. These providers operate under their respective agreements and policies. Where data is processed outside the European Economic Area, the safeguards set out in the relevant agreements apply, such as Standard Contractual Clauses or an applicable adequacy mechanism.
Google provides the external Google Calendar booking page and processes appointment data and metadata under its policy. The page is not embedded in this website and no Google Calendar technology loads until the visitor clicks the booking link.
- Vercel — Privacy and compliance (opens in a new tab)
- Resend — Data Processing Addendum (opens in a new tab)
- Google — privacy (opens in a new tab)
- Google Calendar — Privacy Policy (opens in a new tab)
- Google Ads — Privacy Policy (opens in a new tab)
- Google — Cookie information (opens in a new tab)
- OpenAI — Privacy Policy (opens in a new tab)
- OpenAI — Conversion Terms (opens in a new tab)
6. Your rights
You may request access, rectification, erasure, restriction, objection and portability by writing to administracio@holisticcentre.es. You may also complain to the Spanish Data Protection Agency. TalumCore does not use this data for legally significant automated decisions and does not sell personal data.
7. Changes
This policy will be reviewed when processing activities, providers or legal requirements change. The review date identifies the current version.