Legal
Privacy policy
What data we process, why, on what legal basis, and what you can do about it. No filler clauses: if we don't do something, we say so.
01Data controller
- Controller
- Incu Tech Solutions S.L.
- Tax ID (NIF)
- B23929623
- Registered office
- Plaza de Calla 1, piso 2, oficina 4, 28013 Madrid, Spain
- Trading name
- Incu
- Website
- incu.tech
- Privacy contact
- privacidad@incu.tech
Incu operates from Madrid and Buenos Aires. The Spanish entity above is the controller for the processing described in this policy. When the Buenos Aires team accesses that data to deliver the service, it does so under the instructions and safeguards described in section 06.
02Scope of this policy
This policy covers two different things:
- The incu.tech website and the data of anyone who visits it or writes through the contact form. Here Incu is the controller (sections 03 to 08).
- Client projects, where doing the work requires access to personal data held in the client's systems. Here the client is the controller and Incu is the processor (section 09).
It does not cover our product sites (ways.sh, registry.ways.sh, steering.sh), our GitHub profile, or any other third-party service we link to: each is governed by its own privacy information.
03What we process, why, and on what legal basis
incu.tech is a static site with no database and no CMS. There are no user accounts, there is no login, and the site does not store your enquiry: it delivers it by email to our corporate mailbox and nothing else.
| Data | Source | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Name, email, company (optional), message, language | What you type into the contact form | Answering your enquiry and assessing a possible project | Art. 6(1)(b) GDPR — pre-contractual steps at your request | 12 months from the last contact if no commercial relationship follows. If one does, for its duration and the statutory periods in section 07 |
| IP address | x-forwarded-for header on the form submission | Limiting submissions per IP to stop automated spam | Art. 6(1)(f) GDPR — legitimate interest in protecting the form | In server memory, a 10-minute window. Never persisted or written to any log |
| IP, user agent, requested URL, timestamp, response code | Server logs, automatic on any web request | Running the site, diagnosing errors and detecting abuse | Art. 6(1)(f) GDPR — legitimate interest in the security and availability of the service | Kept by our hosting provider under its plan's retention (days, not months). Incu does not export or archive them separately |
| Aggregate usage metrics: page views, country, device type, referrer | Vercel Web Analytics, cookieless | Knowing which parts of the site get read | Art. 6(1)(f) GDPR — legitimate interest in aggregate measurement, with no persistent identifier on your device | Aggregated by our provider. No identifiable data about you |
| Performance metrics: LCP, CLS, INP and load times | Vercel Speed Insights, cookieless | Finding and fixing speed problems | Art. 6(1)(f) GDPR — legitimate interest in the technical quality of the site | Aggregated by our provider |
Cookie identifiers, IP, navigation events (cta_click, lang_switch, contact_submit, outbound_tools) | Google Analytics 4, only if you accept in the banner | Understanding how the site is used in order to improve it | Art. 6(1)(a) GDPR — your consent, withdrawable at any time | 14 months in Google Analytics. Stops the moment you withdraw consent |
Your cookie choice (granted or denied) | The button you press in the banner | Remembering your decision and being able to evidence it | Art. 22.2 LSSI — strictly necessary to provide the service you asked for (remembering your choice); Art. 7(1) GDPR to evidence consent | Browser local storage, until you clear or change it |
04Cookies and local storage
The site writes no cookie until you accept one. We implement Google Consent Mode v2: before any measurement script loads, analytics_storage, ad_storage, ad_user_data and ad_personalization all start as denied. Only analytics_storage moves to granted if you press "Accept analytics". The three advertising permissions stay denied permanently: incu.tech carries no advertising, remarketing or audience building.
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
incu-consent | Local storage (not a cookie: it never travels with requests) | Incu — first party | Remembering whether you accepted or declined analytics | Until you clear or change it |
_ga | Cookie | Distinguishing visitors | 2 years | |
_ga_<ID> | Cookie | Keeping analytics session state | 2 years |
The _ga and _ga_<ID> cookies are written only with your consent. If you decline or withdraw it, they are not created and any existing ones are deleted. The site's typefaces are served from our own domain (font-src 'self' in the content security policy): there are no requests to Google Fonts or third-party CDNs that could see your IP.
You can also clear cookies and local storage from your browser settings. If you clear incu-consent, the banner comes back on your next visit.
05Who we share data with
We do not sell, rent or trade personal data. The only third parties that process it are providers acting as processors, under an Art. 28 GDPR agreement and only for what is stated here:
| Provider | Role | Data it accesses | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Site hosting, aggregate analytics and performance metrics | Server logs (IP, user agent), aggregate usage metrics | United States, served from EU edge infrastructure | DPA with EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) |
| Google Ireland Limited | Google Analytics 4 — only with your consent | Cookie identifiers, IP, navigation events | Ireland (EU), with possible access from the United States | Google Ads Data Processing Terms with Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Delivering the email generated by the contact form | The name, email, company and message you typed | United States | DPA with Standard Contractual Clauses |
| Google Workspace (Google Ireland Limited) | The corporate mailbox where we receive and keep your enquiry | The name, email, company and message you typed | Ireland (EU), with possible access from the United States | Google's Cloud Data Processing Addendum with Standard Contractual Clauses |
We may also disclose data to public authorities, courts or law enforcement where a legal obligation exists, and to our legal or accounting advisers where necessary to defend a right. Nothing beyond that.
06International transfers
Argentina. Part of our team works from Buenos Aires and may access contact data to answer your enquiry or deliver a project. The European Commission recognises Argentina as providing an adequate level of protection (Decision 2003/490/EC), so these transfers require no additional safeguards.
United States. Vercel and Resend are US providers. Those transfers rely on the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), supplemented by encryption in transit and by minimising the data they receive.
You can request a copy of the applicable safeguards at privacidad@incu.tech.
07Retention and deletion
We keep each item for the period stated in the table in section 03 and, once it expires, we delete or anonymise it. The criteria are these:
- Enquiries that lead nowhere commercially: 12 months from the last contact. They are then deleted from the mailbox.
- Clients: for the whole relationship and afterwards while liabilities can still arise from the contract.
- Accounting and tax records: 6 years (Art. 30 of the Spanish Commercial Code) and the 4-year tax limitation period (Law 58/2003), counted from the last financial year affected.
- Backups: data already deleted may survive in backups until the provider's rotation cycle overwrites it. It is never restored for another purpose.
08Information security
The site applies technical measures you can verify from your own browser:
- All traffic runs over HTTPS, and cleartext requests are upgraded (
upgrade-insecure-requests). - Strict Content Security Policy: only resources from our own domain load (
default-src 'self'), plugins are blocked (object-src), the site cannot be embedded in someone else's iframe (frame-ancestors) and the form cannot post to another domain (form-action). - X-Content-Type-Options set to
nosniffand Referrer-Policy tostrict-origin-when-cross-origin. - A Permissions-Policy that denies camera, microphone and geolocation: the site cannot request them even by mistake.
- No data surface: the site is static, with no database and no admin panel. Your enquiry is delivered by email and is not stored on the website.
- The form is protected by a honeypot field and a per-IP submission limit, rather than a CAPTCHA that would send your data to a third party.
Internally we apply named, least-privilege access control, mandatory second factor on work tools, encryption in transit and at rest, activity logging and an incident response procedure. No measure guarantees absolute security; if a breach occurs that poses a high risk to your rights, we will notify you with the information required by Art. 34 GDPR, and the supervisory authority within 72 hours where applicable (Art. 33 GDPR).
09Incu as a processor
In the projects we deliver for clients — architecture, development, Strike & Embed, SWAT Team, staff augmentation — accessing personal data held in the client's systems can be necessary. In that scenario the client is the controller and Incu is the processor: we never use that data for any purpose of our own. Our commitments:
- A contract before access. We sign the Art. 28 GDPR processing agreement (or the data processing annex to the master agreement) before receiving any access to personal data.
- Documented instructions only, with a duty to warn the controller if an instruction appears to breach data protection law.
- Minimal, named access. Every team member uses their own identity — never shared accounts — with the least privilege that allows the work, revoked when their involvement ends.
- No real data in non-production environments. We work with anonymised, masked or synthetic data in development and testing wherever technically possible; where it is not, it is agreed with the client in writing.
- Team confidentiality by contract, subcontractors included, with obligations that survive the end of the project.
- Sub-processors only with prior authorisation from the client, bound by the same obligations and with us remaining liable for their failures.
- Security measures aligned with the Annex A controls of ISO/IEC 27001: identity and access management, encryption, vulnerability and patch management, logging and monitoring, secure development and incident management.
- Incident notification to the client without undue delay once we become aware, with the information required by Art. 33(3) GDPR so they can meet their own deadlines.
- Assistance to the controller in handling data subject requests, impact assessments, and audits or inspections, including those by the supervisory authority.
- Return or deletion on exit. When the service ends we return or delete the data and its copies as the client instructs, and certify it in writing.
10Your rights
You can exercise these rights over your personal data, free of charge and at any time:
- Access — find out what data of yours we process and get a copy.
- Rectification — correct anything inaccurate or incomplete.
- Erasure — ask us to delete data that is no longer necessary.
- Restriction — ask us to keep the data but stop using it while a challenge is resolved.
- Objection — object to processing we base on legitimate interest.
- Portability — receive the data you gave us in a structured format, where processing is based on consent or contract.
- Withdrawing consent — for analytics, with the control in section 04; for any other consent-based processing, by writing to us. Withdrawal does not affect the lawfulness of processing before it.
Write to privacidad@incu.tech stating which right you want to exercise. We may ask you to prove your identity if there is reasonable doubt about who you are. We reply within one month, extendable by two more in complex cases, telling you why (Art. 12(3) GDPR).
If you believe we handled your request poorly, you can complain to the Spanish Data Protection Agency — C/ Jorge Juan 6, 28001 Madrid — aepd.es, or to the supervisory authority in your country of residence. Complaining does not require writing to us first, but we appreciate the chance to put it right.
11Minors and automated decisions
Minors. incu.tech is a corporate site aimed at companies and professionals. It is not directed at children under 14 and we do not knowingly collect their data (Art. 7 LOPDGDD). If we find we have received a minor's data without the consent of whoever holds parental responsibility, we delete it.
Automated decisions and profiling. We make no automated decisions with legal effects on you, and we do not profile you. Site analytics is read in aggregate and is not used to segment identifiable people or to assess applications, proposals or pricing.
Artificial intelligence. We use AI tools in our engineering work. We do not feed the personal data covered by this policy into model training, our own or anyone else's. In client projects, any use of AI on their data is agreed in writing with the controller, with the providers and safeguards identified in the processing agreement.
12Changes to this policy
If we change this policy, we publish the new version at this same address with its version number and effective date. Where a change materially affects processing based on your consent, we will ask for it again; where it affects clients, we announce it through the usual channel for the relationship. You can request any earlier version at privacidad@incu.tech.