Skip to content

LEGAL DOCUMENT

Privacy policy.

Version: July 2026.

This Privacy Policy describes how UNKNOWN GRAVITY S.L. (hereinafter, the «CONTROLLER») processes the personal data of those who visit this website, use its interactive tools or get in touch with us, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD). It supplements this site's Legal Notice and Cookie Policy.

1. Data controller

  • Identity: UNKNOWN GRAVITY S.L.
  • Registered address: Calle Marqués de Larios 4, 1st Floor, 29005 Málaga (Spain).
  • Email: [email protected]
  • Telephone: +34 951 23 15 26
  • Website: www.unknowngravity.com

The CONTROLLER is a technology consultancy specialising in blockchain development, regulated asset tokenisation, Web3 marketing and consultancy, serving professional and business clients (B2B) across Europe. The CONTROLLER has not appointed a Data Protection Officer; any data protection query may be addressed to the email address above.

2. What data we process and where it comes from

All the data we process comes directly from you, either because you provide it in a form or because it is generated while you browse the site. We do not purchase data, we do not obtain it from third parties, and we do not process special categories of data (Article 9 GDPR).

2.1. Contact and meeting request forms

When you submit the contact form or request a meeting, we collect: name, email address, company, telephone number, service of interest, budget range, urgency and message. Submission requires ticking a box by which you confirm that you have read this Privacy Policy. If you book a meeting through our own calendar, hosted on the CONTROLLER's infrastructure, we process your name, your email address and the chosen date and time slot.

2.2. Interactive tools

The site offers analysis tools (tax calculator, STO estimator, CASP test and MiCA/MiFID classifier). In order to send you the result, we collect your name, your email address and the details of the scenario you enter into the tool (the context of the calculation).

2.3. Browsing data (first-party measurement)

Using our own technologies (first-party cookies and local storage, with no involvement of third-party advertising platforms) we may record: the origin of your visit (UTM parameters, advertising campaign click identifiers —such as the gclid parameter— and referring page), pages viewed and browsing path, number of visits, browsing time and date of first visit. These technologies are used only if you accept measurement cookies via this site's banner. The information collected in this way is not linked to your identity while you browse: it is associated with an identifier stored in your browser and is only connected with your identifying details if you submit a form, at which point it is attached to your record as context for your enquiry. You can find full details of the cookies and technologies used, their lifetimes and how to manage your consent in the Cookie Policy.

3. Purposes and legal bases

We process your data for the following purposes, relying on the legal bases under Article 6(1) GDPR indicated below:

  • Handling your contact or meeting request and managing any business relationship that may arise from it: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). This basis covers all the data you provide in the form, including details you volunteer to give context to your enquiry (budget range, urgency). The tick box on the form does not constitute consent: it is confirmation that you have been able to read this policy before submitting your data.
  • Sending you the analysis requested through the interactive tools and following up on that same request: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). We do not use this data to send you commercial communications unrelated to your request.
  • Measuring use of the site with our own technology: your consent, given via the cookie banner (Art. 6(1)(a) GDPR), which you may refuse or withdraw at any time without this affecting your browsing; if you withdraw it, individual measurement stops. Only the subsequent processing of aggregated statistics, from which you cannot be identified, relies on our legitimate interest in understanding and improving how the site performs (Art. 6(1)(f) GDPR).
  • Attaching your browsing path to your record when you submit a form, to give context to your enquiry (which services you viewed, where you arrived from): this association only takes place if you accepted measurement cookies and relies on that same consent (Art. 6(1)(a) GDPR), the purposes of which are also set out in the Cookie Policy. If you declined cookies, your record includes no browsing history.
  • Internal prioritisation of enquiries (lead scoring): our legitimate interest in organising our sales workload (Art. 6(1)(f) GDPR) with respect to the data you provide in the form; browsing data is only included in this calculation if you consented to measurement cookies. See section 4.
  • Web analytics through Google Analytics 4: exclusively your consent given via the cookie banner (Art. 6(1)(a) GDPR), which you may refuse or withdraw at any time without this affecting your browsing.
  • Compliance with legal obligations that may apply (for example, handling data subject rights or requests from public authorities): Art. 6(1)(c) GDPR.

The fields marked as mandatory in the forms are necessary to handle your request; if they are not provided, we will be unable to process it.

4. Profiling: enquiry scoring

Using the data you provide in the form and —only if you consented to measurement cookies— your browsing path on our site, we calculate an internal score that helps us prioritise and order the handling of business enquiries (for example, to respond sooner to urgent or better-defined requests). This is basic profiling of limited scope:

  • It produces no legal effects concerning you and does not similarly significantly affect you: no service, price or condition is denied to you on the basis of the score.
  • There are no decisions based solely on automated processing within the meaning of Article 22 GDPR: the business relationship is always managed by a member of our team, who assesses each enquiry.
  • You may object to this processing at any time as set out in section 9.

5. Where your data is stored

Contact records (details of the individual and their company, business opportunity, notes containing your message and, where applicable, the browsing context) are kept in a self-hosted CRM of our own on the CONTROLLER's servers located in the European Union. Likewise, meeting bookings are managed in a self-hosted calendar of our own (calendar.unknowngravity.com). Both systems form part of our own infrastructure: they involve no disclosure of data to third parties. The website itself is likewise hosted on our own or contracted servers within the European Union.

6. Recipients and data processors

We do not sell or disclose your data to third parties, nor do we use it for programmatic advertising. No data is disclosed except where legally required (for example, to competent authorities). We do, however, rely on the following providers, which act as data processors (Art. 28 GDPR) under contract:

  • Amazon Web Services (Amazon SES), European Union region: sending the transactional emails generated by the site's forms (notifications of new enquiries and, where applicable, delivery of the analyses requested through the tools). The relationship is governed by the AWS data processing agreement, which incorporates the European Commission's standard contractual clauses.
  • Cloudflare: content delivery network and security and performance layer sitting in front of the site, which processes technical connection data (such as the IP address) as a processor. For the transfers associated with this service, see section 7.
  • Google Ireland Ltd. (Google Analytics 4): site usage analytics, only if you consent to it via the cookie banner (see the Cookie Policy).
  • Infrastructure hosting providers, with servers located in the European Union, which act as data processors in respect of the hosting of our systems.

7. International transfers

As a general rule, your data is processed and stored in the European Union, subject to the following clarifications:

  • Google Analytics 4: processing may involve a transfer of data to the United States, covered by the adequacy decision for the EU-U.S. Data Privacy Framework, to which Google LLC is certified.
  • Cloudflare: by the very nature of a global content delivery network, Cloudflare may process technical connection data on servers located outside the European Economic Area. These transfers are covered by the adequacy decision for the EU-U.S. Data Privacy Framework, to which Cloudflare is certified, and, additionally, by the standard contractual clauses incorporated into its data processing agreement.
  • Amazon Web Services: the service is provided from the European Union region; in the event of ancillary access from outside the European Economic Area, the standard contractual clauses approved by the European Commission and the supplementary measures provided for in its data processing agreement apply.

8. Retention periods

  • Contact and interactive tool enquiries that do not lead to a business relationship: kept for a maximum of 2 years from the last contact, after which they are erased or anonymised.
  • Contacts with an active business relationship: for as long as that relationship continues or until you request erasure, and thereafter, in blocked form, for the limitation periods of the applicable legal obligations (commercial, tax or otherwise).
  • Our own browsing data not associated with a person: the identifiers and data stored in your browser have the lifetimes set out in the Cookie Policy, and you can delete them at any time from your browser. On our systems, browsing data that is never associated with an enquiry is kept for a maximum of 13 months. If you submit a form, the browsing path attached to your record follows the periods above.
  • Analytics data (Google Analytics 4): kept for the retention period configured in the tool, which in no case exceeds 14 months (the maximum retention period configured in our Google Analytics 4 property). Further information on analytics cookies is available in the Cookie Policy.

9. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given, without this affecting the lawfulness of processing carried out before the withdrawal.

To exercise them, send your request to [email protected], stating the right you wish to exercise and enclosing information enabling us to verify your identity (in order to prevent third parties from accessing your data). We will respond within one month at most, extendable in accordance with Article 12(3) GDPR in cases of particular complexity.

If you consider that the processing of your data does not comply with the applicable rules, you have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos) (C/ Jorge Juan 6, 28001 Madrid, Spain; www.aepd.es), although we would appreciate it if you contacted us first so that we can try to resolve the matter.

10. Minors

This site is aimed at professionals and businesses and is not intended for children under 14 years of age. We do not knowingly collect data from minors. If you become aware that a minor has provided us with personal data, please let us know at [email protected] and we will erase it.

11. Security and confidentiality

The CONTROLLER applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk (Art. 32 GDPR), including encryption of communications (HTTPS), hosting of the contact management and calendar systems on our own infrastructure within the European Union, access controls limited to staff who need to process the data, and perimeter protection of the site. Everyone involved in the processing is bound by a duty of confidentiality.

12. Updates to this policy

We may update this Privacy Policy whenever the processing described or the applicable rules change. The current version will always be published on this page together with its date. If a change were to substantially affect processing based on your consent, we will inform you or, where appropriate, ask for your consent again.

Last updated: July 2026.