1. Controller and scope
MAGNANIMITAS, S.L., Spanish tax ID B88815683, with registered office at Calle Doctor Fleming, 44, 28036 Madrid (Madrid), Spain, is the controller for personal data it handles through this corporate website and communications received through its contact channels. ORVYON is its corporate and commercial identity.
Data protection contact: legal@orvyon.io. This policy covers www.orvyon.io and its English and Spanish versions. It does not replace the policies of separate products, platforms or services.
2. Legal framework and principles
Processing is governed by Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and applicable sectoral legislation. We observe lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.
Data protection by design and by default applies. Accepting marketing communications is not a condition for browsing or making an enquiry.
3. Data and sources
Browsing transmits the technical information needed to serve requests: IP address, date and time, requested resource, browser or device information and response codes. Infrastructure may generate access, security and error logs to provide and protect the service.
When you email us, we may process your name, email address, organisation, subject, message and information or documents you supply. Your organisation is optional. Do not provide special-category data, criminal conviction or offence data, or confidential information that is unnecessary for your enquiry.
4. How the contact form works
Fields are completed and validated locally in your browser. “Prepare email” composes a mailto: link containing the recipient and your text to open your email application. Field values are not submitted by HTTP to an ORVYON form server or entered into a website database.
You must review the message and send it through your email application. The website does not certify sending, delivery or receipt. “Copy message” copies text to your device clipboard at your request. Your email application and provider apply their own terms and policies. MAGNANIMITAS receives the message when it is delivered to the corporate channel.
5. Purposes and legal bases
Page delivery, service continuity, and detecting incidents or abuse rely on the controller’s legitimate interest in maintaining an available and secure corporate website, Article 6(1)(f) GDPR, using proportionate measures without advertising tracking.
Handling general, corporate, partnership, investment, media, institutional and opportunity enquiries relies on the legitimate interest in responding to a communication initiated by the individual, Article 6(1)(f) GDPR. Article 6(1)(b) GDPR may apply where the individual requests steps prior to entering into a contract. Professional contact data is limited to locating and maintaining relations with the relevant entity, within Article 19 LOPDGDD where applicable.
Compliance with legal obligations and handling rights requests rely on Article 6(1)(c) GDPR. Establishing, exercising or defending legal claims relies on Article 6(1)(f) GDPR and, where special-category data is strictly necessary, an applicable Article 9(2) exception. Sending an enquiry does not itself authorise advertising or incompatible uses.
6. Necessary information
A name, valid email address and sufficient message are required to prepare an identifiable enquiry and enable a response. Otherwise, local validation identifies fields to review. You can email us directly without using the form.
Identity documents are not requested as a general condition for answering enquiries. Additional information is collected only where necessary and proportionate for a specific lawful purpose.
7. Retention and restriction of access
Enquiries are retained while being handled and, after closure, only while a justified need exists for follow-up or evidence of the relationship. Technical logs are kept as necessary for continuity, security and incident resolution, according to their configuration and applicable duties; they are not used to create marketing profiles.
Where erasure applies but data must be retained to address liabilities, it will be blocked under Article 32 LOPDGDD, accessible only to legally entitled recipients for the prescribed purposes and limitation periods. Contractual, commercial or tax documents generated in a later relationship are subject to their own retention duties.
8. Recipients and processors
Information may be accessed by authorised people handling the enquiry and necessary hosting, security, maintenance and corporate email providers, subject to the relevant roles and safeguards. The website is hosted by Hostinger and the domain uses Microsoft 365 email infrastructure. Personal data is not sold or disclosed for third-party advertising.
Where a provider processes data on the controller’s behalf, the relationship must comply with Article 28 GDPR. Data may be disclosed to authorities, courts or other recipients where a legal duty or lawful authority applies. Entities involved in any separate subsequent relationship must identify themselves and provide their own information where required.
9. International transfers
A website being accessible internationally does not itself determine an international transfer by the controller. If hosting, support or email involves access or processing outside the European Economic Area, Chapter V GDPR requirements apply: a current adequacy decision, standard contractual clauses, or another applicable safeguard or statutory derogation, with supplementary measures where necessary.
You may request information about providers and safeguards applicable to your processing at legal@orvyon.io. We do not presume that all processing takes place exclusively within the European Union.
10. Individual rights
You may request access, rectification, erasure, restriction, objection and, where its requirements are met, portability. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Objection includes legitimate-interest processing, taking your particular situation into account.
Send your request to legal@orvyon.io or the controller’s registered address, identifying the right and information needed to handle it. Additional identity evidence will be requested only where reasonable doubts exist and proportionately. A response is due within one month, extendable by two further months in the circumstances of Article 12(3) GDPR, with reasons and notice within the first month.
You may complain to the Spanish Data Protection Agency at https://www.aepd.es, without prejudice to other administrative or judicial remedies. The “Data protection” page provides practical instructions for exercising your rights.
11. Automated decisions and profiling
This website does not make decisions based solely on automated processing that produce legal or similarly significant effects, and does not build advertising profiles of visitors. The corporate description of AI capabilities does not mean enquiries are subject to Article 22 GDPR automated decisions.
If such processing is introduced, its legal basis, logic, significance and safeguards will be explained in advance as required.
12. Security and confidentiality
Technical and organisational measures are proportionate to risk, including HTTPS encryption, access restrictions and incident management. Authorised staff and providers must observe applicable confidentiality duties.
No system can guarantee absolute security. In the event of a personal data breach, the documentation, notification and communication requirements of Articles 33 and 34 GDPR will be addressed where applicable.
13. Cookies, children and external links
This version has no analytics, advertising, cross-site tracking, or storage of form fields in cookies, localStorage or sessionStorage. Brand assets, fonts, images and videos are served by the website itself. The Cookie Policy explains this operation.
The website serves corporate relations and is not designed to collect children’s data. If you identify a communication from a child or third-party data provided without sufficient lawful authority, contact us so that erasure or regularisation can be assessed. Linked external websites have their own policies.
14. Updates and contact
The current version is published here with its update date. Changes to purposes, legal bases or processing requiring additional information or consent will be addressed before the new processing begins.
Controller: MAGNANIMITAS, S.L. · Spanish tax ID B88815683 · Calle Doctor Fleming, 44, 28036 Madrid (Madrid), Spain · legal@orvyon.io.