Privacy Policy

Version date: 2026-07-31

1. Introduction

This privacy policy explains how E21 Design Technologies, S.L. ("e21", "we", "us", "our") collects, uses, and protects personal data when you visit e21technologies.com or contact us through any of the forms on this website. We are the data controller for the personal data processed in connection with this site.

This policy is provided to satisfy the transparency requirements of Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and Spain's Ley Orgánica 3/2018 of 5 December on the protection of personal data and the guarantee of digital rights (LOPDGDD).

The Nexus platform. Where you use our Nexus platform as an authorised user of one of our customers, that customer is the controller of your personal data and we act as processor on their behalf. Their privacy notice applies to that data, and requests to exercise your rights in respect of it should be directed to them. This policy covers only the personal data we process as controller through this website.

2. Who we are

The data controller is:

E21 Design Technologies, S.L.
C/ Collita, s/n, nave 7
P. I. La Bastida
08191 Rubí, Barcelona, Spain

For any privacy matter, including to exercise the rights described in section 8, please contact us at privacy@e21technologies.com.

3. Personal data we collect

We collect personal data in two ways: directly from you when you submit one of our contact forms, and automatically when you interact with the site.

3.1 Data you provide via our contact forms

The site offers four contact forms: a general inquiry form, a request-a-quote form, a form to book a visit to our Experience Centre, and a partner / OEM / distributor / reseller inquiry form.

When you submit any of these forms, we collect:

  • Mandatory information: your full name, your email address, and the name of your company.
  • Optional information you may choose to provide: your role, a free-text message, and form-specific details such as machine family preference, throughput band, preferred visit dates, party size, partner type, country (ISO code), company website, or annual revenue band.
  • Marketing preference: whether you have actively opted in to receive marketing communications. The opt-in checkbox is unticked by default; you must tick it to opt in.
  • Consent record: at the moment of submission we record the version of this privacy policy that was in force, so we can later demonstrate exactly what you were informed of and agreed to.

3.2 Data we collect automatically when you submit a form

To process your inquiry and to protect the form against abuse, we also record:

  • the date and time of your submission;
  • your locale preference (English, Spanish, or German), used solely to reply to you in the same language;
  • the HTTP referer, the landing URL, and any UTM campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) present in the URL — this lets us understand which marketing activity prompted the inquiry;
  • your browser's user-agent string;
  • your IP address — used only to perform an anti-spam check at the moment of submission, and not retained by us afterwards. Our hosting provider processes IP addresses transiently in its short-lived infrastructure request logs, which we do not use to identify you.

3.3 What we do not collect

We do not collect, on this website:

  • phone numbers;
  • postal addresses;
  • any browser fingerprint beyond the standard user-agent string;
  • any persistent cookie other than the strictly necessary locale cookie and, where you have explicitly consented, our analytics cookies (see our Cookie Policy at /legal/cookies for full detail).

4. Why we process your data, and the lawful basis

We process your personal data for the following purposes, on the following lawful bases under Article 6 GDPR:

  • To respond to your inquiry, quote request, partnership request, or visit booking. Lawful basis: our legitimate interests (Art. 6(1)(f)) in answering an unsolicited inquiry about our products and services. We have assessed this basis as appropriate because you actively reached out to us in a business context, and the processing is limited to what is needed to reply.
  • To send you marketing communications about our products, events, and services, where you have actively opted in. Lawful basis: your consent (Art. 6(1)(a)). You can withdraw it at any time without affecting any other processing.
  • To protect our forms against spam and automated abuse. Lawful basis: our legitimate interests (Art. 6(1)(f)) in keeping the site secure and usable.
  • To continue to manage personal data of leads who become customers, as part of the business relationship. Lawful basis: performance of, or steps prior to, a contract (Art. 6(1)(b)).
  • To comply with our legal, accounting, and tax obligations. Lawful basis: legal obligation (Art. 6(1)(c)).

You can object to any processing based on our legitimate interests at any time (see section 8).

5. Who we share your data with

Your inquiry is processed inside e21 and is shared with carefully selected service providers acting as processors under written agreements that meet the requirements of Article 28 GDPR. We do not sell your data, and we do not share it with advertisers or data brokers.

The categories of recipient are:

  • e21 personnel. Only the members of our sales and partner-management teams who need access to respond to you can see your submission.
  • Our lead-management platform. A hosted database service in the European Union (Frankfurt region, Germany) where the submission is stored as our internal record of the inquiry.
  • A transactional email provider. Used to send a confirmation email to you and an internal notification to our sales mailbox. The provider processes your email address and the message body only for the time required to deliver the messages and does not retain them afterwards.
  • An anti-spam challenge provider. Performs the human-verification check at the moment you submit a form. We do not retain any data linked to you from this check.
  • An internal team-communications platform. A summary of each new lead is routed to our internal sales channel inside our own corporate tenant; the data does not leave that tenant.

We can provide a current, named list of these sub-processors on request — please write to privacy@e21technologies.com.

We may also disclose personal data to public authorities, courts, or regulators where this is required by law (for example, in response to a valid court order or a regulatory request) and to professional advisers under a duty of confidentiality.

6. International transfers

Some of our processors are headquartered outside the European Economic Area (EEA). Where a transfer outside the EEA takes place, we rely on the safeguards permitted by Chapter V of the GDPR — primarily the European Commission's Standard Contractual Clauses (SCCs), supplemented where necessary by additional technical and organisational measures following the EDPB's recommendations on supplementary measures. Where our processors offer European data residency, we configure them to use it.

You can request a copy of the safeguards relied on for a specific transfer by writing to privacy@e21technologies.com.

7. How long we keep your data

We apply the storage-limitation principle in Article 5(1)(e) GDPR and keep personal data only for as long as we need it for the purpose for which it was collected.

  • Form submissions from leads that do not progress: 12 months from the most recent meaningful contact between you and us, after which the record is automatically and irreversibly deleted. We chose 12 months from last activity, rather than a flat 24-month period, because it is the shortest period that still allows us to handle a typical industrial sales cycle, and it is more defensible under the storage-limitation principle.
  • Submissions from leads that convert into a customer relationship: retained for the life of that relationship and afterwards for the period required by Spanish commercial and tax law (typically up to 6 years from the end of the relevant tax year), under the contract and legal-obligation lawful bases.
  • Marketing-consent records: kept for as long as your consent remains active, and for a reasonable additional period after withdrawal so we can evidence both the original consent and its withdrawal.
  • Anti-spam IP check: not retained by us beyond the moment of the check.
  • Technical records of form submissions (user-agent string, timestamps, and request status) held in our lead-management platform: up to 12 months for security and abuse-investigation purposes.

8. Your rights

Subject to the conditions and exceptions set out in the GDPR, you have the right to:

  • access the personal data we hold about you (Art. 15);
  • rectify inaccurate or incomplete data (Art. 16);
  • erase your data, also known as the "right to be forgotten" (Art. 17);
  • restrict our processing of your data in defined circumstances (Art. 18);
  • portability — receive the data you provided to us in a structured, commonly used, machine-readable format, and transmit it to another controller (Art. 20);
  • object to processing based on our legitimate interests (Art. 21);
  • withdraw consent at any time, where consent is the lawful basis (Art. 7(3)). Withdrawal does not affect the lawfulness of processing carried out before withdrawal;
  • not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Art. 22). We do not use solely automated decision-making.

To exercise any of these rights, please email privacy@e21technologies.com. We acknowledge requests within 5 business days and complete them within one month, with a possible extension of up to two further months for particularly complex or numerous requests, in accordance with Article 12(3) GDPR. We will tell you about any extension and explain why.

A self-service erasure flow on the website is on our roadmap; until it is in place, the email contact above is the route to use.

9. Right to complain to a supervisory authority

If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority — in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77).

The competent supervisory authority for e21 is:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid, Spain
www.aepd.es

10. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include encryption of data in transit and at rest — the database underlying our lead-management platform encrypts stored data with AES-256 — role-based access controls, the principle of least privilege for access to lead data, and regular review of who has access. Access to the lead-management platform is limited to authorised members of e21's sales and partner-management teams.

11. Cookies

This site uses a small number of cookies. The strictly necessary locale cookie is set on every visit; analytics cookies are loaded only after you actively accept them through the cookie banner. Full details are in our Cookie Policy at /legal/cookies.

12. Children

The site is intended for a business audience and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently received such data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The version date at the top of the page indicates when the current version took effect. Each form submission is recorded together with the policy version in force at that moment, so we can demonstrate which version you were shown when you submitted your data.

14. Contact

For any question about this policy or our data practices, please write to:

privacy@e21technologies.com

or by post to E21 Design Technologies, S.L., C/ Collita, s/n, nave 7, P. I. La Bastida, 08191 Rubí, Barcelona, Spain.