Privacy policy
Last updated: 30 September 2026
1. Data controller
- Owner: ENTOMO LAB, S.L. (trade name: ECOTRAP)
- Tax ID (NIF): B13723242
- Address: C/ Sant Pere d'Alcàntara, 42, 07760 Ciutadella de Menorca (Illes Balears), Spain
- Registration details: Commercial Register of Menorca, volume 206, book 0, folio 207, sheet IM-7887, entry 1
- Data protection contact: Joan R. Sánchez Tuomala, at joan@ecotrap.es
ENTOMO LAB, S.L. is not required to appoint a Data Protection Officer (Art. 37 GDPR and Art. 34 of the Spanish Data Protection Act, LOPDGDD). For any question about your data, please use the contact address above.
2. Data we process
- Contact form and “Request a demo” form: first and last name, company or farm, position, email address, telephone number and the content of your message. We also keep a record of the consent boxes you ticked, with their date and time.
- Email: the data you give us when you write to us.
- Browsing: technical and usage data, which we only collect if you accept analytics cookies. See the Cookie policy.
We do not ask for special categories of data. Please do not include them in your messages.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention period |
|---|---|---|
| Answering your enquiry or demo request and, where applicable, preparing a proposal | Steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) | 12 months from the last contact if no business relationship is established |
| Managing the relationship with customers (contracts, invoicing, support) | Performance of a contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR) | For the duration of the relationship and then 6 years (Art. 30 of the Spanish Commercial Code) or any other applicable legal period |
| Sending you commercial information about ECOTRAP by electronic means | Consent (Art. 6(1)(a) GDPR and Art. 21 of the Spanish e-Commerce Act, LSSI). Customers receive information on products or services similar to those contracted under Art. 21(2) LSSI | Until you withdraw your consent or unsubscribe |
| Web analytics | Consent (Art. 22(2) LSSI and Art. 6(1)(a) GDPR) | 14 months in Google Analytics. The period is renewed if the user visits the website again |
| Proving the consents obtained and handling requests to exercise rights | Legal obligation and accountability (Arts. 6(1)(c) and 7(1) GDPR) | For as long as liabilities may arise (applicable limitation periods) |
Requesting a demo or sending an enquiry does not oblige you to accept commercial communications.
Every commercial communication includes a simple, free way to unsubscribe.
We do not make automated decisions or carry out profiling with legal effects on you.
4. Mandatory data
The fields marked as mandatory in the forms are needed to handle your request. If you do not provide them, we will not be able to process it.
5. Recipients and processors
We do not sell or disclose your data to third parties, except where required by law (for example, to the tax authorities, the courts or law enforcement agencies).
To provide the service we work with the following providers. Each of them acts as a processor under a contract that complies with Art. 28 GDPR:
| Provider | Service | Data location |
|---|---|---|
| Hetzner Online GmbH (Germany) | Website hosting | European Union |
| IONOS SE (Germany) | Email and sending of commercial communications | European Union |
| Supabase Pte. Ltd. (Singapore) | Database where form submissions are stored | European Union (Ireland) |
| Google Ireland Ltd. (Google Analytics 4) | Web analytics, only with your consent | EU, with possible access from the USA |
| Plus Five Five, Inc. – Resend (USA) | Sending internal email notifications of form submissions | European Union (Ireland) |
6. International transfers
Form data is hosted on servers in the European Union (Ireland). Our provider, Supabase Pte. Ltd., is based in Singapore and its group also operates from the USA, so occasional access from outside the EU cannot be ruled out. Such access is covered by the Standard Contractual Clauses approved by the European Commission, which form part of Supabase's data processing agreement (DPA).
The internal notifications generated by each form submission are sent through Resend (Plus Five Five, Inc.), from servers in the European Union (Ireland). As Resend's parent company is based in the USA, occasional access from that country cannot be ruled out either; such access is likewise covered by the Standard Contractual Clauses approved by the European Commission, included in Resend's data processing agreement (DPA).
Google Analytics: Google LLC is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (10/07/2023).
7. Your rights
You may exercise the following rights at any time, free of charge:
- access;
- rectification;
- erasure;
- objection;
- restriction of processing;
- portability;
- withdrawal of consent, without affecting the lawfulness of processing carried out before its withdrawal.
To exercise them, write to joan@ecotrap.es or send a letter to the address given in section 1, stating which right you are exercising. If we have reasonable doubts about your identity, we may ask you to prove it.
We will reply within one month. If you are not satisfied with our reply, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Security
We apply technical and organisational measures appropriate to the risk:
- encrypted communications (HTTPS);
- database access restricted to authorised staff;
- providers with contractual guarantees.
9. Changes to this policy
If we change this policy, we will publish the new version on this page with its update date. If the changes are significant, we will let you know through the usual channels.