Privacy policy · BluSea

1Who processes your data

Blumind Technologies, S.L. (“BluSea”, “we”) is the controller of the personal data described in this policy. BluSea is a product of Blumind Technologies, S.L.

Controller: Blumind Technologies, S.L.
Tax ID (NIF): B26982181
Address: Calle Ponzano, 52, 2.º B, 28003 Madrid (Spain)
Privacy contact: info@blusea.io

2Who it applies to

This policy applies when:

you visit blusea.io;
you ask us for a demonstration or write to us;
you work at a company that is a customer, supplier or partner of BluSea and we deal with you on its behalf;
you use the BluSea platform with the account your company has given you.

What it does not cover: the documents that your company uploads to the platform. For that data, the controller is your company, and we process it on its behalf. We explain this in section 4.

3What data we process, why and on what legal basis

We only process the data needed for each purpose. The table summarises each processing activity; retention periods are in section 7.

When	Data	Purpose	Legal basis
You visit the website	IP address, browser and device, pages requested, date and time (technical server logs).	Serving the website, keeping it secure and detecting abusive use.	Legitimate interest in the security of the site (Art. 6(1)(f) GDPR).
You request a demonstration or write to us	First name and surname, company email, company, job title, telephone number if you give it to us, company type and country; if you write to us, whatever you tell us in your message.	Replying to you, organising the presentation and following up on your request.	Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) and legitimate interest in dealing with the company on whose behalf you are writing (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD, the Spanish Data Protection and Digital Rights Act).
Your company is a customer, supplier or partner	Name, job title and professional contact details; if you sign on behalf of the company, the data that evidences your authority to represent it.	Preparing, signing and managing the contract, invoicing and handling the relationship.	Performance of the contract with your company and legitimate interest in maintaining the relationship (Art. 6(1)(b) and (f) GDPR, Art. 19 LOPDGDD); tax and accounting obligations (Art. 6(1)(c) GDPR).
You use the platform	Name, corporate email, account identifier, company, role and permissions.	Giving you access with your company account, authenticating you and applying your permissions.	Performance of the contract with your company and legitimate interest in providing it with the service (Art. 6(1)(b) and (f) GDPR).
You use the platform	Activity on documents (uploading, moving, deleting, restoring), changes to users and permissions, and authorisation logs.	Security and traceability; investigating incidents; enabling your company's administrators to see what has happened.	Legitimate interest in the security of the service and the duty to apply security measures (Art. 6(1)(f) and (c), Art. 32 GDPR).
You use the platform	Use of the service per user: operations performed and their volume.	Invoicing your company, monitoring usage and sizing the service.	Performance of the contract with your company (Art. 6(1)(b) GDPR).
You ask us for help	Your query and the information you share to resolve it.	Providing you with support.	Performance of the contract with your company (Art. 6(1)(b) GDPR).
We tell you about BluSea news	Name and professional email.	Informing you of news related to what your company already uses or has asked to learn about.	If your company is a customer, legitimate interest (Art. 6(1)(f) GDPR and Art. 21.2 LSSI-CE, the Spanish Information Society Services Act); in all other cases, your consent. You can object from each message.
We comply with the law or defend our rights	The data needed in each case.	Responding to requests from authorities and establishing, exercising or defending claims.	Legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR).

When: You visit the website
Data: IP address, browser and device, pages requested, date and time (technical server logs).
Purpose: Serving the website, keeping it secure and detecting abusive use.
Legal basis: Legitimate interest in the security of the site (Art. 6(1)(f) GDPR).

When: You request a demonstration or write to us
Data: First name and surname, company email, company, job title, telephone number if you give it to us, company type and country; if you write to us, whatever you tell us in your message.
Purpose: Replying to you, organising the presentation and following up on your request.
Legal basis: Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) and legitimate interest in dealing with the company on whose behalf you are writing (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD, the Spanish Data Protection and Digital Rights Act).

When: Your company is a customer, supplier or partner
Data: Name, job title and professional contact details; if you sign on behalf of the company, the data that evidences your authority to represent it.
Purpose: Preparing, signing and managing the contract, invoicing and handling the relationship.
Legal basis: Performance of the contract with your company and legitimate interest in maintaining the relationship (Art. 6(1)(b) and (f) GDPR, Art. 19 LOPDGDD); tax and accounting obligations (Art. 6(1)(c) GDPR).

When: You use the platform
Data: Name, corporate email, account identifier, company, role and permissions.
Purpose: Giving you access with your company account, authenticating you and applying your permissions.
Legal basis: Performance of the contract with your company and legitimate interest in providing it with the service (Art. 6(1)(b) and (f) GDPR).

When: You use the platform
Data: Activity on documents (uploading, moving, deleting, restoring), changes to users and permissions, and authorisation logs.
Purpose: Security and traceability; investigating incidents; enabling your company's administrators to see what has happened.
Legal basis: Legitimate interest in the security of the service and the duty to apply security measures (Art. 6(1)(f) and (c), Art. 32 GDPR).

When: You use the platform
Data: Use of the service per user: operations performed and their volume.
Purpose: Invoicing your company, monitoring usage and sizing the service.
Legal basis: Performance of the contract with your company (Art. 6(1)(b) GDPR).

When: You ask us for help
Data: Your query and the information you share to resolve it.
Purpose: Providing you with support.
Legal basis: Performance of the contract with your company (Art. 6(1)(b) GDPR).

When: We tell you about BluSea news
Data: Name and professional email.
Purpose: Informing you of news related to what your company already uses or has asked to learn about.
Legal basis: If your company is a customer, legitimate interest (Art. 6(1)(f) GDPR and Art. 21.2 LSSI-CE, the Spanish Information Society Services Act); in all other cases, your consent. You can object from each message.

When: We comply with the law or defend our rights
Data: The data needed in each case.
Purpose: Responding to requests from authorities and establishing, exercising or defending claims.
Legal basis: Legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR).

In the demonstration form all the fields are mandatory except the telephone number: without them we cannot handle your request.

When you do not give us the data yourself, we receive it from your company: for example, when it creates your account on the platform or designates you as its contact. In that case we process identification data, professional contact details, role and permissions.

4The documents your company uploads to BluSea

The documents that a company uploads to the platform — tender documents, projects, contracts, drawings, bills of quantities — may contain personal data of third parties, such as signatories, technical staff or workers. For that data, the controller is the customer company, and Blumind Technologies, S.L. acts as processor (Art. 28 GDPR) under a data processing agreement that sets out these safeguards:

We process that data only on the customer's instructions and only to provide it with the service.
We do not use it to train artificial intelligence models or for any other customer.
It is processed in the European Union, with providers bound by data protection agreements.
When the contract ends, it is deleted entirely, including from backups, within 30 days at most.
If a security breach affecting it occurs, we notify the customer without undue delay, within the time limits agreed in the contract.

If your data appears in documents of a company that uses BluSea and you wish to exercise your rights, contact that company. If you write to us, we will pass your request on to it without delay and help it respond to you.

5Who we share data with

We do not sell or rent personal data, and we do not disclose it to third parties for their own purposes. To provide the service we rely on providers that process data on our behalf, under a data processing agreement and only on our instructions:

Provider	What it does	Where
Microsoft Ireland Operations Limited	The platform's cloud (Microsoft Azure): servers, database, document storage and backups.	European Union
Microsoft Ireland Operations Limited	Artificial intelligence models and document reading (Azure AI services).	EU Data Zone
Microsoft Ireland Operations Limited	Identity and sign-in (Microsoft Entra).	European Union
Microsoft Ireland Operations Limited	Email (Microsoft 365).	European Union
Microsoft Ireland Operations Limited	Hosting of the website blusea.io.	European Union

Provider: Microsoft Ireland Operations Limited
What it does: The platform's cloud (Microsoft Azure): servers, database, document storage and backups.
Where: European Union

Provider: Microsoft Ireland Operations Limited
What it does: Artificial intelligence models and document reading (Azure AI services).
Where: EU Data Zone

Provider: Microsoft Ireland Operations Limited
What it does: Identity and sign-in (Microsoft Entra).
Where: European Union

Provider: Microsoft Ireland Operations Limited
What it does: Email (Microsoft 365).
Where: European Union

Provider: Microsoft Ireland Operations Limited
What it does: Hosting of the website blusea.io.
Where: European Union

We may also disclose data to:

professional advisers — lawyers, auditors, tax and accounting advisers — bound by a duty of confidentiality;
authorities, judges and courts, where the law requires us to;
whoever acquires or succeeds to the business in a corporate transaction, who will be bound by this policy.

6Where it is processed

We process personal data within the European Union and do not make international transfers as part of our processing. The artificial intelligence models used by the platform process data in Microsoft's EU Data Zone; we do not use models whose processing takes place outside it.

If a provider ever needed to access the data from outside the European Economic Area — for example, to provide technical support — it would only do so with the safeguards of Chapter V of the GDPR, such as an adequacy decision of the European Commission or its standard contractual clauses.

7How long we keep data

Data	Period
Technical website logs	Up to 30 days, unless they are needed to investigate an incident.
Demonstration requests and enquiries	Up to 12 months from the last contact if no relationship follows. If your company becomes a customer, they become part of the contractual relationship.
Relationship with customers, suppliers and partners	For as long as the relationship lasts and, afterwards, the statutory periods: six years for commercial and accounting records (Art. 30 of the Código de Comercio, the Spanish Commercial Code) and four years for tax purposes (Art. 66 of the Ley General Tributaria, the Spanish General Tax Act).
Platform user account	For as long as the account is active. It is closed when your company decides so or when its contract ends.
Activity and authorisation logs	24 months.
Use of the service	36 months.
Marketing communications	Until you object or withdraw your consent.

Data: Technical website logs
Period: Up to 30 days, unless they are needed to investigate an incident.

Data: Demonstration requests and enquiries
Period: Up to 12 months from the last contact if no relationship follows. If your company becomes a customer, they become part of the contractual relationship.

Data: Relationship with customers, suppliers and partners
Period: For as long as the relationship lasts and, afterwards, the statutory periods: six years for commercial and accounting records (Art. 30 of the Código de Comercio, the Spanish Commercial Code) and four years for tax purposes (Art. 66 of the Ley General Tributaria, the Spanish General Tax Act).

Data: Platform user account
Period: For as long as the account is active. It is closed when your company decides so or when its contract ends.

Data: Activity and authorisation logs
Period: 24 months.

Data: Use of the service
Period: 36 months.

Data: Marketing communications
Period: Until you object or withdraw your consent.

Once these periods have passed, we delete the data. If the law requires us to keep it to deal with possible liabilities, we keep it blocked — without using it for anything else — for the limitation period, as required by Article 32 of the LOPDGDD.

8How we protect data

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR). These include:

access to the platform with your company's corporate account and permissions managed by its administrators;
encryption of stored data, including backups;
logical isolation between companies, checked by automated tests with every change to the system;
logging of activity on documents and of changes to users and permissions;
backups in the European Union that expire automatically;
staff bound by a duty of confidentiality, with access limited to what is strictly necessary;
an information security management system in line with the ISO/IEC 27001 standard, with certification in progress.

No measure eliminates all risk. If a security breach affecting your data occurs, we will notify the Spanish Data Protection Agency (AEPD) and, where it is likely to result in a high risk to you, you as well, as provided in Articles 33 and 34 of the GDPR. More detail in Security.

9Your rights

Access: Knowing whether we process your data and obtaining a copy.
Rectification: Correcting inaccurate data or completing incomplete data.
Erasure: Asking us to delete it, for example when it is no longer necessary.
Objection: Objecting to processing based on legitimate interest and, always, to receiving marketing communications.
Restriction: Asking us to keep the data without using it, for example while we check its accuracy.
Portability: Receiving the data you gave us in a structured, commonly used format, or having us send it to another controller.
Withdrawing consent: At any time, without affecting the processing carried out before.

How to exercise them

Write to us at info@blusea.io stating which right you wish to exercise. If we have reasonable doubts about your identity, we will ask only for the information strictly necessary to confirm it. It is free of charge and we will reply within one month at most; if the request is complex or we receive many, the period may be extended by two further months, and we will tell you so within the first month.

If you are not satisfied

You can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid). If you write to us first, we will try to resolve it with you.

10Automated decisions and artificial intelligence

We do not make decisions about you based solely on automated processing of your data that produce legal effects or significantly affect you, nor do we create profiles for commercial purposes. BluSea's artificial intelligence works on project documentation to help the company's teams, and it is designed so that its results are reviewed and decided on by a professional.

11Minors

The website and the platform are aimed at professionals. We do not knowingly collect data from minors; if we find that we have done so, we delete it.

12Changes to this policy

We will update this policy when our processing activities or the regulations change, and we will publish each version with its date. If the change is relevant to platform users, we will also tell them by email or through their company.

Questions about this document? Write to us at info@blusea.io.