Privacy Policy

This Privacy Policy explains how ROKY ROCKS ("we", "us") collects and uses personal data when you visit this website or contact us, and what rights you have under the EU General Data Protection Regulation (GDPR) and applicable Spanish data protection law.

Last updated: 14 November 2026.

1. Who is responsible for your data

The data controller is ROKY ROCKS, P.º de Recoletos, 5, Centro, 28004 Madrid, Spain. For any question about this policy or your personal data, write to hello@roky.rocks.

2. What data we collect

Data you provide to us. When you fill in a form or contact us, we receive the information you give us, such as:

your name, business email address, telephone number and country;
the content of your message and any files you attach;
for job applications, your CV and the information it contains.

Data collected automatically. When you use the website, our servers and the services we rely on may record technical data, such as:

IP address, browser type and version, device type and language settings;
pages visited, date and time of access and the page you came from.

Some of this data is collected through cookies and similar technologies, as described in section 6.

3. Why we use your data and on what legal basis

To reply to your enquiries and discuss possible projects: our legitimate interest in running our business and, where you ask us for a proposal, steps taken at your request before entering a contract (Article 6(1)(f) and (b) GDPR).
To assess job applications: steps taken at your request before entering a contract, and your consent if you ask us to keep your application for future roles (Article 6(1)(b) and (a)).
To operate, secure and improve the website, and to prevent fraud and abuse: our legitimate interest (Article 6(1)(f)).
To suggest your country in our contact form: our legitimate interest in making the form easier to use. For this, your IP address is sent to Cloudflare, which returns the country code. We do not store it.
To use cookies that are not strictly necessary, for example to understand how the site is used: your consent (Article 6(1)(a)).
To send news or marketing messages: your consent, or another basis permitted by law. You can opt out at any time.
To comply with legal obligations, such as accounting and tax requirements (Article 6(1)(c)).

We do not sell personal data.

4. Who we share data with

We share personal data only where needed and only with:

service providers that help us run the website and our business, such as hosting, data storage, email and IT security providers, who act on our instructions under data processing agreements;
professional advisers, such as lawyers, accountants and auditors;
public authorities, courts or other parties where the law requires or permits it;
a buyer or other party in the event of a business sale, merger or reorganisation, subject to appropriate safeguards.

5. Transfers outside the European Economic Area

We have offices in Spain and Kazakhstan, and some of our providers operate outside the European Economic Area (EEA). Where personal data is transferred to a country without an adequacy decision from the European Commission, we use appropriate safeguards, such as the Standard Contractual Clauses. You can ask us for details at hello@roky.rocks.

6. Cookies

We use cookies and similar technologies as described in our Cookie Policy. Strictly necessary cookies do not require consent. Other cookies are used only if you agree through the cookie banner. You can change your choice at any time in your browser settings, including by deleting cookies.

7. How long we keep your data

We keep personal data only for as long as needed for the purpose it was collected for:

enquiries: for as long as needed to handle the enquiry and any follow-up, and for the duration of a resulting contract;
job applications: for the duration of the recruitment process and, if you agree, for later opportunities;
technical log data: for a limited period needed for security and troubleshooting;
accounting and contract records: for the periods required by law.

When data is no longer needed, we delete or anonymise it.

8. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and receive a copy;
have inaccurate data corrected;
have your data erased, where the law allows;
restrict the processing of your data in certain cases;
receive your data in a portable format, where the processing is based on consent or a contract;
object to processing based on our legitimate interests;
withdraw your consent at any time, without affecting processing that took place before.

To exercise these rights, write to hello@roky.rocks. We may need to verify your identity, and we will respond within one month.

You also have the right to lodge a complaint with a data protection authority. In Spain this is the Spanish Data Protection Agency (AEPD, www.aepd.es). You can also contact the authority in your country of residence or work.

9. Automated decision-making

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

10. Security

We use technical and organisational measures to protect personal data against loss, misuse and unauthorised access. No system is completely secure, so we cannot guarantee absolute security.

11. Third-party websites

The website may contain links to websites operated by others. We do not control them and are not responsible for their privacy practices. We recommend reading their privacy policies.

12. Children

The website is intended for business users and is not directed at children. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time. The current version is always available on this page, with the date of the last update at the top. If we make significant changes, we will inform you as required by law.

14. How to contact us

If you have questions about this policy or how we handle your data, write to hello@roky.rocks or to ROKY ROCKS, P.º de Recoletos, 5, Centro, 28004 Madrid, Spain.