Privacy Policy

Where Globodain determines the purposes and means of processing, it acts as controller. In such cases, the controller is Globodain Technology Corporation S.L., CIF B06850747, Calle Gladiolo 13, 1A, 41008 Sevilla, Spain (“Globodain” or “we”).

Where, in delivering Orbit or other professional services, Globodain accesses the Client’s systems, repositories, environments or data on the Client’s instructions, it may act as processor under GDPR Article 28. In that case the processing agreement annexed to the proposal or SOW and the Client’s documented instructions apply and prevail over this Policy as regards that processing.

• Terms of Use
• Cookie Policy

This Policy applies to the Globodain corporate website — including pages relating to Orbit, pricing, solutions, clients (regulated companies and agencies / MCI), company, contact, legal notice and diagnostic booking — to communications arising from those channels, and to processing, as controller, of contact and contractual data associated with the commercial relationship.

Outside the scope of this Policy, or governed by specific documents, are: (i) SaaS platforms operated under a different domain, in particular MCI (mci.globodain.com), which have their own policies; (ii) processing the Client or agency performs in its own systems as controller, without prejudice to Globodain acting as processor when granted access; and (iii) product-specific annexes or DPAs that may be required in contracts for Etedata, Corebrain or Ask Intelligence. Commercial mentions of partners (e.g. Globant) or experience in financial-institution environments do not, by themselves, imply transfer of personal data to those third parties.

• MCI Privacy Policy
• Orbit program
• Legal notice

For clarity toward regulated clients, the following table summarises Globodain’s typical role by processing context. The definitive characterisation of each operation is set in the proposal, SOW and, where applicable, the signed DPA.

If this Policy conflicts with a signed DPA or contract regarding processing in which Globodain acts as processor, the signed document prevails for that specific processing.

Depending on interaction with the site or the contractual relationship, Globodain may process the following categories of personal data: identity and contact data (name, email, phone if provided, company and message content); commercial-interest data (Orbit program, service block — audit, compliance, technology or monitoring —, plan, solution, commercial intelligence / MCI, agency channel or product requested); and diagnostic-context data (technology stack, applicable regulatory framework, book of accounts, constraints and any notes voluntarily provided in the form).

When a diagnostic is booked, scheduling data is also processed — including the preferred time slot, the visitor’s timezone and calendar invitations (ICS and/or Google Calendar links) — as needed to confirm the meeting and send confirmation. UI preferences (language and theme) and cookie preference (accepted / essential) are stored on the user’s device, together with technical logs (IP address, user-agent, timestamps and diagnostics) required for security and proper operation of the site.

Under an Orbit contract or project, contractual data relating to scope, contacts, deliverables, billing and service communications may be processed. When Globodain acts as processor, it may access categories of data determined by the Client (for example employee data, customer data, logs or technical access credentials). Globodain does not publish or inventory the Client’s specific files in this Policy; their definition belongs to the Client in its instructions.

Globodain processes personal data solely for the legitimate purposes set out below. Legal bases are invoked under GDPR Article 6.

The relationship between Globodain’s programs and products and the data-protection regime is summarised below, without prejudice to particular contracts and each platform’s own policies.

Globodain may disclose personal data to providers that supply services necessary to operate the website and, where applicable, to deliver Orbit, always under contract and limiting access to what is strictly necessary. The indicative public inventory of recipients and subprocessors is as follows:

The subprocessor list applicable under the processing engagement may be updated. Material changes will be notified as provided in the contract or processing annex. Own SaaS platforms (such as MCI) and other third-party products have their own processors and policies.

Certain providers — in particular Google LLC and related services — may process data in the United States or other third countries. Where required by law, Globodain relies on Standard Contractual Clauses (SCCs) adopted by the European Commission, the EU–US Data Privacy Framework or other valid adequacy or safeguard mechanisms, complemented by reasonable additional measures according to risk.

When Globodain acts as processor, international transfers follow the Client’s instructions and the contractual processing annex.

The site uses cookies and similar technologies strictly necessary for operation (including Google reCAPTCHA v3 on forms, as a security measure against spam) and, only where the user grants consent, measurement tools based on Google Analytics 4 with Google Consent Mode v2. Inventory, purposes and management options are set out in the Cookie Policy.

• Cookie Policy

Data are retained only for as long as needed for the purposes described. In general: (i) leads and diagnostics without a contract are kept for up to twenty-four (24) months from the last relevant contact, unless earlier erasure is requested or a legitimate interest or legal duty justifies a longer period; (ii) data linked to an Orbit contract or project are kept for the life of the relationship and thereafter for commercial and tax periods applicable to billing and the Provider’s legal obligations.

Calendar invitations and operational emails are kept as needed to manage the meeting and commercial or contractual follow-up. Site security logs are kept for short periods, typically not exceeding twelve (12) months, unless longer retention is required to investigate an incident. Cookie and UI preferences remain on the user’s device until deleted. Data processed as processor are retained, returned or destroyed per the Client’s instructions and the contractual processing annex, without prejudice to legal retention duties.

Globodain applies technical and organisational measures appropriate to the risk under GDPR Article 32. These include HTTPS on the site, access control to mailboxes and internal tools, least privilege for access to Client environments, and security-incident response procedures. Measures applicable when Globodain acts as processor are detailed in the contractual processing annex.

Data subjects may exercise, where applicable under the GDPR, rights of access, rectification, erasure, objection, restriction and portability by writing to info@globodain.com with sufficient identification. They may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

When Globodain acts as processor, requests concerning data for which the Client is controller should be addressed to that Client. Globodain will provide the assistance set out in the contractual processing annex to facilitate exercise of rights.

The website and the Orbit program are directed at companies and professionals. Globodain does not knowingly collect personal data from minors. If processing of a minor’s data without an adequate legal basis is detected, it will be deleted or blocked as soon as reasonably practicable.

Globodain may update this Policy to reflect legal, product, vendor or processing-practice changes. The effective date identifies the applicable version and, where a change is material, notice may be given through the site or by email where appropriate. Continued use of the services after the updated version takes effect constitutes acknowledgement of its contents.