Privacy policy

ONBOARDING, S.L., a single-member company, tax ID (NIF) B26924142, Calle Pau Claris 97, 4.º 1.ª, 08009 Barcelona (Spain). Contact: contacto@modelo-390.com.

When you send the contact form: your first and last name, your e-mail address, your phone number, your situation (for instance, holiday-let owner) and, if you write one, your message. With them go the language and the address of the page you write from (with any campaign parameters it carries, such as utm_source), the page you came from if your browser gives it, an identifier of the request, the date and time, and the version of the consent wording you agreed to.

To protect the form: Cloudflare Turnstile, loaded only once you start filling the form in, checks that you are not a robot from technical data about your connection and browser (IP address, browser, TLS fingerprint). We also limit the number of submissions per IP address.

When you visit the site: Cloudflare, our host, processes the technical data of each request (such as the IP address) to serve and protect the pages. We use no analytics or advertising tools and keep no visit logs.

• Passing your request to CasitaTax, so that it contacts you about it: your consent (GDPR art. 6.1.a), given by ticking the form's box. Without it the form is not sent. You can withdraw it at any time by writing to us, without affecting what was done before (GDPR art. 7.3).
• Protecting the form and the site from robots and abuse: our legitimate interest in the security of the service (GDPR art. 6.1.f).
• Answering if you write to us at contacto@modelo-390.com: our legitimate interest in answering your message (GDPR art. 6.1.f). Those e-mails reach, forwarded by Cloudflare (Email Routing), the mailbox of CasitaTax (ZAHARD LTD, United Kingdom), which answers them on our behalf.

We make no automated decisions and build no profiles.

Your request goes to CasitaTax, a service of ZAHARD LTD (company number 14503377, England and Wales; 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom), which receives it as a controller: from then on its own privacy policy applies. CasitaTax keeps requests for 12 months after the last exchange, unless you become a customer.

The United Kingdom has an adequacy decision of the European Commission (GDPR art. 45): Commission Implementing Decision (EU) 2021/1772, renewed by Implementing Decision (EU) 2025/2574 of 19 December 2025 and valid until 27 December 2031.

They process data on our behalf and on our instructions:

• Cloudflare, Inc. (United States): hosting, the server that receives the form, and the Turnstile check.
• n8n, the automation tool that passes your request on to CasitaTax; it keeps no copy of successful runs.
• ZAHARD LTD (CasitaTax, United Kingdom): handles the e-mails you write to contacto@modelo-390.com, which Cloudflare forwards to it.
• Discord Inc. (United States): a notification to the team of each new request, with your details masked: your situation, the language, the e-mail address partly hidden, only the phone's country code, whether there is a message and its length (never its text), the page without its parameters, the domain of the page you came from, the campaign (utm_source, utm_medium, utm_campaign, utm_content) and the names, never the values, of click identifiers. Never your name, your full e-mail address or phone number, or your message.

Cloudflare also processes some Turnstile data as a controller, to improve its bot detection, as its Turnstile privacy addendum explains.

Cloudflare and Discord are in the United States. Transfers rely on the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), under which both are certified (official list checked on 12 November 2026), or failing that on the European Commission's standard contractual clauses. Passing your request to CasitaTax, in the United Kingdom, relies on the adequacy decision above.

• ONBOARDING, S.L. does not keep your request: it passes it on to CasitaTax, which keeps it for 12 months after the last exchange, unless you become a customer.
• The masked Discord notifications: 12 months at most.
• E-mails you send us: as long as needed to answer you, and 12 months after the last exchange at most.

You can ask for access to your data, its correction or erasure, the restriction of its processing and its portability, object to its processing and withdraw your consent, by writing to contacto@modelo-390.com. We answer within one month. For the data CasitaTax already holds, you can also contact it as its policy explains.

If you think we have not respected your rights, you can complain to the Spanish data protection authority, the AEPD (aepd.es), or to the authority of the EU country where you live.

Every page uses an encrypted connection (HTTPS). The form travels encrypted to our server, which checks it and passes it on without storing it.

We may update this policy; the "last updated" date shows the version in force. The form's consent wording has been in force since 2026-11-12.