Data protection
Privacy Policy
Last updated: 21 September 2026
This is an English translation provided for convenience. In the event of any discrepancy, the Spanish version prevails.
This policy explains how we process the personal data you provide through www.surcacapital.com, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
| Controller | ORTODRÓMICA, S.L. (trading as Surca Capital) |
|---|---|
| Tax ID (NIF) | B16843658 |
| Contact | contacto@surcacapital.com |
2. What we process and why
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form | Full name, company, email address and the content of your message | To handle your enquiry and any follow-up correspondence | Your consent (art. 6(1)(a) GDPR) |
| Direct email | Whatever you choose to include in your message | To handle your enquiry | Legitimate interest in replying to those who write to us (art. 6(1)(f) GDPR) |
We do not carry out profiling or automated decision-making producing legal effects concerning you.
3. Retention
We keep your data for as long as the relationship or mutual interest lasts and, once it ends, for the limitation periods required by law to address any potential liability. You may request erasure at any time.
4. Recipients and processors
We do not share your data with third parties except where legally required. We use the following service providers, which act as processors and only on our instructions:
| Provider | Service | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting and content delivery | Global network with EU presence |
| Web3Forms | Receives contact form messages and delivers them by email. Does not retain messages permanently | Outside the EEA, under the safeguards in Chapter V of the GDPR |
| Google Ireland Ltd. (Google Workspace) | Corporate email | European Union, with safeguarded international transfers |
Where a provider processes data outside the European Economic Area, the transfer relies on the safeguards set out in Chapter V of the GDPR, such as the European Commission's standard contractual clauses or a valid adequacy framework.
5. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent without affecting the lawfulness of processing carried out beforehand. To do so, write to contacto@surcacapital.com stating which right you wish to exercise. If you need a postal address in order to do so, we will provide one by the same channel.
If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency.
6. Cookies
This website uses no first-party or third-party cookies for analytics, advertising or profiling, and therefore requires no consent banner. Only the technical connections needed to load the typefaces and serve the pages are made.
Should analytics or tracking tools be added in future, this policy will be updated and your prior consent will be requested.
7. Security
We apply appropriate technical and organisational measures to protect your data, including HTTPS encryption of all traffic and restricted access to corporate mailboxes.
8. Changes to this policy
We may update this policy to reflect legal or operational changes. The version in force is always the one published on this page, with its last-updated date.