Privacy Policy

1. Data controller

Orbital Leap Technologies, S.L.
Tax ID: B22472674
Calle Antonio López 138, 28026, Madrid, Spain
Email: privacy@orbitaleap.com

2. Scope

This policy covers the websites of Orbital Leap Technologies, S.L., includingorbitaleap.com and studio.orbitaleap.com. Where a section applies to only one of them, that is stated explicitly.

3. Data we collect

We only process the data you give us yourself, through our forms:

• Name
• Email address
• Company or organisation
• Phone or WhatsApp number, on the forms that ask for it
• The message, or whatever you choose to tell us about your project

We do not build profiles, we make no automated decisions affecting you, and we use no external analytics, tracking pixels or behavioural advertising.

4. Purpose and legal basis

• Answering your enquiry or preparing a quote — performance of a contract or pre-contractual steps (art. 6.1.b GDPR).
• Sending you information about our services where you asked for it — consent (art. 6.1.a GDPR), withdrawable at any time.
• Protecting the forms from automated submissions — legitimate interest in the security of the service (art. 6.1.f GDPR). See section 6.

5. Processors

We do not sell or share your data. The only parties with access are the providers that let us run the service, under the processing agreements required by art. 28 GDPR:

• Cloudflare, Inc. — hosting, content delivery and abuse protection.
• Resend (Plus Five Five, Inc.) — delivery of the email the contact form produces.

6. Anti-abuse verification (Cloudflare Turnstile)

Our forms are protected by Cloudflare Turnstile, which checks that the person submitting is not an automated system. To do so it may collect information about your browser and your interaction with the page, and may set cookies strictly necessary for that check.

Processing carried out by Cloudflare through Turnstile is governed, in addition to this policy, by theCloudflare Turnstile Privacy Addendum, which forms part of the information provided here.

7. Retention

We keep your data for as long as it takes to deal with your request and, if a contract follows, for the periods required by tax and commercial law (up to 5 years). If nothing comes of it, we delete it 12 months after the last contact.

8. International transfers

Some of the providers in section 5 are established outside the European Economic Area, or may process data outside it. Those transfers rely on the safeguards provided for in the GDPR, principally the standard contractual clauses approved by the European Commission.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing toprivacy@orbitaleap.com. You can also withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

If you believe we have not handled your request properly, you can complain to theSpanish Data Protection Agency(www.aepd.es).

10. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, alteration or destruction. The site runs entirely over HTTPS and form data is transmitted encrypted.

11. Changes to this policy

We may update this policy to reflect legal or service changes. The current version will always be available at this address.