Privacy notice
Last updated 18 October 2026 (draft).
Who we are
Operable Systems is the trading name of a sole trader (autónomo) registered in Spain, whose legal name, tax number and business address are on the legal notice. We are the data controller for the personal data described in this notice, except where the section on client audits says otherwise.
Contact: [email protected].
What we collect, why, and on what basis
When you contact us
If you use the form on this site or email us, we collect your name, work email address, anything you write to us, and your website address if you give it. We use this to reply to you and, if you ask, to arrange a call. The legal basis is our legitimate interest in responding to enquiries, and your consent when you send the message. We keep enquiries for twelve months after our last exchange, then delete them unless you have become a client.
When we write to you first
We send a small number of individually written emails to people at companies we think we can help, at work addresses only. Before writing we look at the company's public website the way any visitor would, so that what we say is specific and true. The legal basis for holding your work address is our legitimate interest in offering our services to businesses. You can tell us to stop at any time and we will. Every message says who we are and how to stop further messages. Reply "no" and we will not write again; we keep your address only on a do-not-contact list so that we honour that.
When you book a call
Bookings use cal.com, which collects your name, email and the time you choose, under its own privacy notice. We receive the booking details and keep them as part of your enquiry.
When you visit this site
This site runs no analytics and sets no cookies. There is no cookie banner because there is nothing to consent to.
This site is hosted by Cloudflare. Cloudflare processes your IP address to serve the page and keeps standard server logs for a short period under its own terms.
When you are a client
During an audit we capture copies of pages, screenshots, accessibility trees and recordings from your product. These can contain personal data of your users if it appears on screen. For that data you are the controller and we are your processor, acting on your instructions under the data processing agreement in our engagement terms. We hold it on encrypted storage, use it only for the engagement, delete it 90 days after delivery unless you are on a retainer that needs it for comparison, and never use it in public material without your written consent.
Business contact details of the people we work with at a client (names, roles, work emails) we hold as controller, on the basis of performing the contract, for the duration of the relationship and six years afterwards, the period Spanish commercial law sets for keeping business records.
When you are on our benchmark
Twice a year we run automated accessibility checks across public websites in one market and publish aggregate results. We visit public pages only, submit no forms, create no accounts, and process no personal data in doing so. Companies that wish to be excluded from future runs can email us and we will comply.
Who we share data with
Service providers who process data on our behalf: Cloudflare (hosting and the function that handles form submissions), Resend (delivery of form submissions to our mailbox), Google Workspace (email), cal.com (booking), Zoho Books (invoicing), Notion (client and enquiry records). Each is bound by its own terms and, where required, standard contractual clauses for transfers outside the EU. We do not sell data and we do not share it with anyone else unless the law requires it.
Transfers outside the EU
Some providers above are based in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on standard contractual clauses otherwise.
Your rights
You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, object to our use of it, ask us to restrict it, or ask for it in a portable form. Email [email protected] and we will reply within one month. If you are unhappy with how we handle your data you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the authority in your own country.
Security
Data is held on encrypted devices and in the services listed above, with two-factor authentication on every account. Client audit data never leaves the engagement.
Changes
We will update this page when our practices change and note the date at the top.