Privacy Policy
How we process and protect the personal data you provide to us.
1. Scope of this policy
This policy explains how personal data obtained through the website, the contact form and subsequent professional communications with Bilbao Trade are processed.
2. Data we may process
- Identity and professional data: name, surname, company, role and other professional information provided.
- Contact data: email address, optional telephone number and country.
- Enquiry content: reason for contact, message, documents and data voluntarily included in subsequent communications.
- Technical and security data: IP address, date and time, browser information and technical records generated by the server or security systems.
The form uses Cloudflare Turnstile to prevent automated submissions and abuse. Your enquiry is sent through Microsoft 365 to [email protected]. The form does not automatically create a HubSpot record or subscribe you to marketing lists.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering enquiries, analysing requirements and preparing proposals or quotations. | Taking steps at the data subject’s request prior to entering into a contract — Article 6(1)(b) GDPR. |
| Managing professional or commercial communications and relationships. | Performance of a contract, where applicable, or legitimate interests in handling and maintaining professional relationships — Articles 6(1)(b) and 6(1)(f) GDPR. |
| Protecting the website, preventing abuse and resolving incidents. | Legitimate interests in securing the website and its communications — Article 6(1)(f) GDPR. |
| Meeting legal obligations and responding to public authorities. | Compliance with legal obligations — Article 6(1)(c) GDPR. |
The form checkbox confirms that this policy has been made available to the user; it does not authorise advertising or addition to a marketing list. Bilbao Trade does not currently send newsletters or conduct automated marketing campaigns through this website.
4. Required data
Fields marked as required are needed to understand and deal with the enquiry. The telephone number is optional. If the essential data are not provided, the message cannot be processed.
5. Recipients and processors
Personal data are not sold or disclosed for advertising purposes. They may be processed by providers supplying necessary web hosting, email, productivity, customer relationship management (CRM), maintenance or security services under the applicable contractual safeguards. Cloudflare Pages is used for web hosting and form processing, Cloudflare Turnstile for abuse protection, Microsoft 365 for email and communication management, and HubSpot to organise professional contacts, companies, opportunities and commercial communications. The HubSpot account is configured for primary data hosting in the European Union (Germany). HubSpot may nevertheless use subprocessors or ancillary services subject to the contractual and transfer safeguards described in the next section.
Data may also be disclosed to public authorities, courts or law-enforcement bodies where legally required.
6. International transfers
Certain technology providers may provide support or process information from countries outside the European Economic Area. Where applicable, transfers will rely on a European Commission adequacy decision or appropriate safeguards such as the Standard Contractual Clauses, in accordance with Chapter V GDPR.
7. Retention
Data are kept for as long as necessary to answer and manage the enquiry or professional relationship. They may then be retained with restricted access for the statutory limitation and record-keeping periods required to address potential liabilities or legal obligations. Technical logs are retained only for the period reasonably needed for security, diagnostics and the hosting provider’s applicable policies.
8. Individual rights
You may request access, rectification, erasure, restriction, objection and, where applicable, portability by emailing [email protected] or writing to the address shown above. The request must allow identity to be verified; additional documentation will only be requested where necessary.
You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).
9. Automated decisions and profiling
No decisions producing legal effects are made solely by automated means and no profiles are created from information submitted through the website.
10. Children and sensitive data
The website is intended for professional and industrial relationships and is not directed at children. Special-category data or unnecessary personal data relating to third parties should not be submitted.
11. Security and updates
Bilbao Trade applies reasonable technical and organisational measures to protect information. No Internet-connected system can guarantee absolute security, so safeguards are reviewed and adapted to risk.
This policy may be updated to reflect legal, technical or processing changes.
Last updated: 5 October 2026.
Form protection with Cloudflare Turnstile
Cloudflare Turnstile performs technical checks of the browser and connection to distinguish legitimate submissions from automated traffic. It operates in invisible mode and is not used for advertising. Please see the Cloudflare Turnstile Privacy Addendum.
Visit analytics with your acceptance
On the definitive domain, we use Google Analytics 4 only after you accept analytics cookies, to understand visits and improve the website. The legal basis is your consent. You can withdraw it through Cookie settings in the footer. Google may process the data in other countries under its terms and applicable safeguards. The website code does not send your form content, name or email to Analytics. See our Cookie Policy and Google's privacy policy. The temporary test address does not perform this measurement.
Address: Leioandi 24, Leioa, Biscay, Spain
Contact: [email protected] · +34 610 769 852