Privacy notice

Sorpmetrics is a technology-transfer project originating from research at the University of the Basque Country (UPV/EHU), and it is working towards incorporation. Hugo Macedo is the data controller for the personal data described here in the meantime, and we will update this notice when that changes. You can reach us about any privacy matter at privacy@sorpmetrics.com. Where we operate, and how to reach us on other matters, is set out in the legal notice.

We collect only what we need to answer you and to run the measurement service you ask for. We do not sell personal data, and we do not build advertising profiles.

Contact details

Name, work email, organisation, and anything you write to us. Used to reply and to manage your enquiry.

Account & portal data

Sign-in email and the magic-link session. Used to authenticate you and show your own projects.

Project records

Sample identifiers you supply, study scope, quotes, invoices and reports. Used to deliver and account for the work.

Technical data

Essential cookies and basic security logs. Used to keep the site and your session safe.

Sample materials and the measurement results we return are commercial data. They are not personal data, and we treat them as confidential under a mutual NDA.

We rely on the following grounds under Article 6 of the GDPR:

Contract

To take your booking, run the study, raise quotes and invoices, and return your report (Art. 6(1)(b)).

Legitimate interests

To answer enquiries, secure the site, and keep records of our dealings, balanced against your rights (Art. 6(1)(f)).

Consent

For optional analytics cookies only. You can give or withdraw this at any time (Art. 6(1)(a)).

Legal obligation

To keep accounting and tax records as the law requires (Art. 6(1)(c)).

We keep contact records for as long as our relationship is active and for a reasonable period afterwards. Project, quote and report records are retained for the duration of the engagement and for up to ten years to meet accounting and warranty obligations, then deleted or anonymised. Security logs are kept for a short rolling window. If you ask us to delete data and no legal duty requires us to keep it, we will.

We use a small set of vetted providers, each under a data-processing agreement. Where a provider is outside the EEA, transfers are covered by the European Commission’s standard contractual clauses.

Supabase

Our EU-region database, authentication and file storage. Holds account, project and document data.

Resend

Transactional email delivery: booking confirmations, quotes, invoices and reports.

Vercel

Hosting and content delivery for this website and the client portal.

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, and to receive it in a portable form. Where we rely on consent, you can withdraw it without affecting earlier processing. To exercise any of these, email privacy@sorpmetrics.com and we will respond within one month. If you are not satisfied, you may complain to your local data-protection authority; in Spain that is the Agencia Española de Protección de Datos (AEPD).

We set essential cookies to run the site and your session, and optional analytics cookies only with your consent. The detail, and how to change your choice, is in our cookie policy.

If we change how we handle personal data, we will update this page and the date above. Material changes that affect you will be flagged where we reasonably can.