OptimTaskPrivacy policy
Last updated: 13 October 2026
This policy explains how PON SOLUCIONES EMPRESARIALES, S.L. processes personal data in relation to the website and the OptimTask service, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). It distinguishes two situations, because our role is different in each.
1. Who is who
| Situation | Our role |
|---|---|
| Website visits, enquiries and trial requests, and data of the people and companies that sign up for OptimTask (administrators, billing) | Data controller |
| The data your company enters into OptimTask: its clients, contacts, contracts, hours, expenses, team, etc. | Data processor (your company is the controller) |
Controller / processor: PON SOLUCIONES EMPRESARIALES, S.L., tax ID B26784108, Calle del Convento Santa Clara, 1, 2.º, 3.ª, 46002 Valencia (España). Contact for any privacy matter: hola@ponsoluciones.com. We have not appointed a data protection officer as the conditions of Article 37 GDPR are not met.
2. When we are the controller
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling enquiries and sign-up requests sent through the website form, by email or by phone, and assessing whether they are approved | Name, email, phone, company, tax ID, address, language, expected number of people and the content of the message; as proof of acceptance of the privacy policy and the terms: date and time, version of the texts, IP address and browser | Pre-contractual measures at your request (Art. 6.1.b GDPR) and legitimate interest in proving acceptance (Art. 6.1.f) | If the request is approved it becomes part of the contractual relationship (see below). Rejected or unconfirmed requests are deleted after 12 months at the most |
| Sign-up, provision and billing of the contracted service | Identification and contact data of the company and its administrators, billing data, use of the service | Performance of the contract (Art. 6.1.b) and legal tax and accounting obligations (Art. 6.1.c) | During the contractual relationship and then the legal periods (generally 6 years for commercial and accounting records) |
| Service security, fraud prevention and technical logs (access, errors) | IP address, date and time, actions recorded in the audit log | Legitimate interest in system security (Art. 6.1.f) | Limited periods proportionate to the purpose |
| Service communications (invitations, password recovery, subscription notices) | Name and email | Performance of the contract (Art. 6.1.b) | While the account exists |
We do not use the data for automated decisions with legal effects nor build commercial profiles. We will not send commercial communications without your prior consent.
3. When we are the processor
Your company decides which data it enters into OptimTask and why; we process it solely on behalf of and following the instructions of your company, to provide the service. The terms of the processing (Article 28 GDPR) form part of the Terms of service and include, in summary:
- Processing only on documented instructions and for the provision of the service.
- Duty of confidentiality of the people with access to the data.
- Appropriate technical and organisational security measures (see section 6).
- Authorisation to use sub-processors (see section 4) and an obligation to impose the same safeguards on them.
- Assistance to your company in responding to data subjects' rights and with security and breach-notification obligations.
- At the end of the service, return of the data (full export) and subsequent deletion, unless there is a legal obligation to keep it.
- Making available the information needed to demonstrate compliance.
If you are a client or employee of a company that uses OptimTask and you want to exercise your rights over your data, you should contact that company, which is the controller. If you write to us, we will forward the request or tell you how to proceed.
4. Recipients and sub-processors
- Infrastructure and hosting: IONOS SE (data center in Spain).
- Transactional email (invitations, password recovery): email service provider contracted by PON SOLUCIONES EMPRESARIALES, S.L..
- Public authorities, where there is a legal obligation.
We do not sell data or pass it to third parties for their own purposes. If we add new providers (for example, payments or artificial intelligence), we will tell you and update this policy.
5. International transfers
No transfer of data outside the European Economic Area is planned. If a provider involved one in the future, it would be done with the safeguards of Chapter V GDPR (adequacy decision or standard contractual clauses) and you would be informed beforehand.
6. Security measures
- Logical separation of each company's data, verified with automated tests.
- Role- and permission-based access control, with optional two-factor authentication.
- Encrypted communications (HTTPS) and passwords stored with an irreversible hash function.
- Audit log of changes, regular backups and a full data export for the client company.
- Database access with a limited-permission user.
7. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent at any time, by writing to hola@ponsoluciones.com stating the right you are exercising and a means of identifying yourself (a copy of your ID card, residence card or passport, or an equivalent means). We will reply within one month.
If you believe we have not processed your data in accordance with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.
8. Minors
The service is aimed at companies and professionals. We do not knowingly process data of minors.
9. Changes to this policy
We may update this policy to reflect legal or service changes. The date of the last update appears at the top. Relevant changes will be communicated through the usual channels.