Privacy policy

What we do with your data when you visit numen.company. Last updated: 26 October 2026.

It is written in plain language. If anything is unclear, write to hola@numen.company and we will explain.

Who is responsible for your data

The controller is Carlos Tisaire Ventura (Carles Tisaire), with an address at Carrer del Taquígraf Serra, 7, 1a planta, 08029 Barcelona, and the email hola@numen.company. Numen is the brand he works under.

Full identification details are in the legal notice.

What we collect and why

The contact form
What we collect
Name, email, company (optional), your message and, if you like, how you heard about us
What for
To read it and reply, and if there is a fit, to continue the conversation
Legal basis
Steps prior to a contract, taken at your request when you write to us (Art. 6(1)(b)). If you write about something other than working with us, our legitimate interest in answering whoever writes to us (Art. 6(1)(f))
How long we keep it
One year from your last message. If the conversation continues, you become a business contact and the period is two years from the last contact
A direct email to hola@numen.company
What we collect
What you write, and whatever your email contains
What for
To read it and reply
Legal basis
Same as the form
How long we keep it
Same as the form
A WhatsApp message to +34 666 57 02 76
What we collect
Your number, your WhatsApp name and what you write
What for
To read it and reply
Legal basis
Same as the form
How long we keep it
Same as the form
Booking the coffee
What we collect
Name, email and the time you choose. If you like: company, what you do, how many of you there are, how you heard about us and anything you tell us
What for
To hold the appointment, send you the invitation and a reminder the day before, and come to the coffee knowing a little about you
Legal basis
Steps prior to a contract, taken at your request when you book (Art. 6(1)(b))
How long we keep it
One year from the appointment
"Send it to me" (your roadmap)
What we collect
Your email, the link to your roadmap and whether you let us write to you once more
What for
To send you the roadmap and, if you let us, write to you once to see if it helped
Legal basis
Sending it, because you ask for it (Art. 6(1)(b)). The second email, your consent when you tick the box (Art. 6(1)(a))
How long we keep it
One year from sending it
Where you come from, with your booking, message or roadmap
What we collect
The campaign in the link you came in through (if it has one), the website that brought you and the first page you saw
What for
To know what brings us contacts
Legal basis
Our legitimate interest in knowing what works (Art. 6(1)(f)). Until you accept analytics, it is not stored in your browser: it is only sent if you book or write
How long we keep it
Same as the booking, message or roadmap
Website analytics
What we collect
Pages you view, where you come from, device type and your IP address
What for
To know which pages get read and which do not
Legal basis
Your consent in the cookie banner
How long we keep it
Up to 14 months in Google Analytics
Cookieless measurement
What we collect
Pages you view, where you come from, country and browser type, with no cookies and without storing your IP address
What for
To count how many people visit the website, whether or not they accept cookies
Legal basis
Our legitimate interest in knowing how many people visit us (Art. 6(1)(f))
How long we keep it
Cloudflare keeps it as aggregate figures, for the period Cloudflare sets
The Meta pixel
What we collect
Your activity on this website, linked to your Meta account if you have one
What for
To measure campaigns and show ads to people who have already been here
Legal basis
Your consent in the cookie banner
How long we keep it
The period is set by Meta
Server logs
What we collect
IP address, date and time, page requested and browser
What for
To keep the website working and protected from abuse
Legal basis
Our legitimate interest in keeping it up and secure
How long we keep it
As long as Lovable needs to keep the website working and secure

Where it comes from	What we collect	What for	Legal basis	How long we keep it
The contact form	Name, email, company (optional), your message and, if you like, how you heard about us	To read it and reply, and if there is a fit, to continue the conversation	Steps prior to a contract, taken at your request when you write to us (Art. 6(1)(b)). If you write about something other than working with us, our legitimate interest in answering whoever writes to us (Art. 6(1)(f))	One year from your last message. If the conversation continues, you become a business contact and the period is two years from the last contact
A direct email to hola@numen.company	What you write, and whatever your email contains	To read it and reply	Same as the form	Same as the form
A WhatsApp message to +34 666 57 02 76	Your number, your WhatsApp name and what you write	To read it and reply	Same as the form	Same as the form
Booking the coffee	Name, email and the time you choose. If you like: company, what you do, how many of you there are, how you heard about us and anything you tell us	To hold the appointment, send you the invitation and a reminder the day before, and come to the coffee knowing a little about you	Steps prior to a contract, taken at your request when you book (Art. 6(1)(b))	One year from the appointment
"Send it to me" (your roadmap)	Your email, the link to your roadmap and whether you let us write to you once more	To send you the roadmap and, if you let us, write to you once to see if it helped	Sending it, because you ask for it (Art. 6(1)(b)). The second email, your consent when you tick the box (Art. 6(1)(a))	One year from sending it
Where you come from, with your booking, message or roadmap	The campaign in the link you came in through (if it has one), the website that brought you and the first page you saw	To know what brings us contacts	Our legitimate interest in knowing what works (Art. 6(1)(f)). Until you accept analytics, it is not stored in your browser: it is only sent if you book or write	Same as the booking, message or roadmap
Website analytics	Pages you view, where you come from, device type and your IP address	To know which pages get read and which do not	Your consent in the cookie banner	Up to 14 months in Google Analytics
Cookieless measurement	Pages you view, where you come from, country and browser type, with no cookies and without storing your IP address	To count how many people visit the website, whether or not they accept cookies	Our legitimate interest in knowing how many people visit us (Art. 6(1)(f))	Cloudflare keeps it as aggregate figures, for the period Cloudflare sets
The Meta pixel	Your activity on this website, linked to your Meta account if you have one	To measure campaigns and show ads to people who have already been here	Your consent in the cookie banner	The period is set by Meta
Server logs	IP address, date and time, page requested and browser	To keep the website working and protected from abuse	Our legitimate interest in keeping it up and secure	As long as Lovable needs to keep the website working and secure

If the conversation continues and comes to nothing, we stop keeping it two years after the last contact. If you ask us to delete it sooner, we will.

If we end up working together, your data becomes part of the relationship between you and Numen. It is then kept for as long as the law requires: four years for tax and six for accounting.

Giving us this data is voluntary and none of it is mandatory. If you do not give it to us, we cannot reply, and that is the only consequence.

We do not make automated decisions about you, and we do not build profiles to decide anything.

What we do not do

We do not sell your data
We do not pass it to anyone outside the list in the next section
We do not sign you up to any newsletter because you wrote to us. If there is ever one, we will ask separately

Who else sees it

To make the website work, some companies process data on our behalf, under a contract that requires them to use it only for what we ask. In law they are called processors.

Lovable
What they do
Publishes the website and keeps its access logs
Where they are
Sweden. It may also process data in the United States
Cloudflare
What they do
Serves the website on Lovable's behalf, protects it from abuse and counts visits without cookies (Cloudflare Web Analytics). It also runs the old domain, numenconsulting.es
Where they are
United States
Hostinger
What they do
Is our domain registrar. It receives no data from website visitors
Where they are
European Union
Google Workspace
What they do
Numen's email, calendar and the spreadsheet where form messages and coffee bookings arrive
Where they are
United States, with data centres in the EU
Google
What they do
Analytics
Where they are
United States
Meta
What they do
The website's pixel, and WhatsApp if you message us there
Where they are
United States

Who	What they do	Where they are
Lovable	Publishes the website and keeps its access logs	Sweden. It may also process data in the United States
Cloudflare	Serves the website on Lovable's behalf, protects it from abuse and counts visits without cookies (Cloudflare Web Analytics). It also runs the old domain, numenconsulting.es	United States
Hostinger	Is our domain registrar. It receives no data from website visitors	European Union
Google Workspace	Numen's email, calendar and the spreadsheet where form messages and coffee bookings arrive	United States, with data centres in the EU
Google	Analytics	United States
Meta	The website's pixel, and WhatsApp if you message us there	United States

There is one detail about Meta worth knowing: Meta and Numen decide together about what its pixel collects, so we are joint controllers for that part. That is why you can exercise your rights over that data with us or directly with Meta.

Apart from these, your data may be passed to anyone the law requires us to share it with, for example the tax authority or a court that asks for it.

If data leaves the European Union

Google, Meta and Cloudflare are US companies, so some data leaves the European Union. Lovable is a Swedish company, but it may also process data in the United States.

The European Commission considers that the United States offers an adequate level of protection for companies certified under the Data Privacy Framework. Google, Meta and Cloudflare are certified. Lovable is not: for that data it uses the Commission's standard contractual clauses.

That framework has been challenged before the Court of Justice of the European Union. If it changes, this section will be reviewed.

What you can ask us for

Write to hola@numen.company saying what you want. We will reply within one month.

To find out what data we hold about you, and ask for a copy
To correct anything that is wrong
To delete it, when no law requires us to keep it
To object to us using it, or ask us to keep it stored but not use it
To get it in a file and take it elsewhere
To withdraw your consent whenever you like, including for cookies. Anything done before that remains valid

If you think we have not handled it properly, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es), and you can tell us first.

Your customers' data, when we work together

This policy is about the website. What is inside your system is a different matter.

When we build or maintain a tool for you, we access data that belongs to you and your customers. In that case Numen decides nothing about that data: it processes it on your behalf.

That is not covered by this policy. It is covered by the data processing agreement we sign with you before we start, which sets out what data is accessed, what for, with what measures and what happens at the end.

Children

This website is not aimed at children under fourteen and we do not ask them for data.

How we protect it

We use encrypted connections, access limited to those who need it, and providers with their own security measures.

No measure removes the risk completely. If there were ever a breach that affected you, we would tell you, and we would report it to the AEPD when the law requires it.

Changes

This policy changes when what the website does changes, when a provider changes or when the law changes. The version that applies is the one published, with the date shown at the top.