Last updated: 18 October 2026
This Privacy Policy explains how Persimmon, S.L.U., a company trading as HLO (“HLO”, “we”, “us”), processes personal data in connection with the website www.hloservices.com (the “Website”). It does not apply to data processed in the course of a client engagement, which is governed by the relevant engagement letter and by our professional obligations.
1. Who is responsible for your data
Persimmon, S.L.U. (HLO)
Calle José Delgado Brackenbury 9, Edificio EDDEA, 41011 Sevilla, Spain
NIF: B90352998
Registro Mercantil de Sevilla, Tomo 6510, Libro 0, Folio 7, Sección 8, Hoja SE 116842
E-mail: [email protected]
We have not appointed a Data Protection Officer, as our processing does not meet the thresholds of Article 37 GDPR. Data protection queries can be addressed to the e-mail above, marked “Data protection”.
2. What we collect, why, and on what legal basis
2.1 Information you send us through the contact form
When you use the form on our contact page we receive the data you enter: your name, e-mail address, optionally a Telegram or Discord handle, and the content of your message. We use it to answer your enquiry, to assess whether we can help, and to take steps at your request before entering into a contract.
Legal basis: Article 6(1)(b) GDPR (pre-contractual measures) and, for enquiries that do not lead to an engagement, Article 6(1)(f) GDPR (our legitimate interest in responding to business correspondence).
2.2 Technical data generated when you visit the Website
Our hosting provider and our content delivery network process technical data necessary to deliver the pages to you: IP address, date and time of the request, the page requested, the referring page, browser type and version, and operating system. This data is used to serve the Website, to keep it secure and to diagnose faults. It is not used to build a profile of you.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in operating a secure and functional website.
2.3 What we do not do
We do not use analytics or advertising cookies, we do not run remarketing or tracking pixels, we do not build user profiles and we do not carry out automated decision-making or profiling within the meaning of Article 22 GDPR. The Website has no user accounts, no newsletter and no online payment facility.
3. Cookies and similar technologies
The Website sets no advertising or analytics cookies. What may be stored on your device is limited to what is strictly necessary:
- Cloudflare bot management. The Website is served through Cloudflare, which may set a security cookie (
__cf_bm,cf_clearance) to distinguish human visitors from automated traffic. This is necessary for the security of the service and is exempt from consent under Article 22.2 LSSI-CE. - WordPress session cookies. WordPress sets a session cookie only when someone logs in to the administration area. Visitors who are not logged in do not receive it.
You can delete or block cookies in your browser settings; blocking the security cookies may prevent the contact form from working.
4. Who else sees your data
We do not sell or rent personal data, and we do not share it for marketing purposes. It is accessible to the following service providers, which act as processors under Article 28 GDPR and are bound to use it only on our instructions:
- Cloudflare, Inc. (San Francisco, USA) — content delivery, tunnel and bot protection.
- Our hosting provider, which operates the servers and database on which the Website runs, located in a data centre in the European Union.
- Our e-mail provider, located in the European Union, which receives and stores the messages sent through the contact form.
We may also disclose data where we are legally required to do so, or where necessary to establish, exercise or defend legal claims.
5. Transfers outside the European Economic Area
Our hosting and e-mail providers process data within the European Union. Cloudflare is established in the United States, so traffic passes through infrastructure outside the EEA; Cloudflare is certified under the EU–US Data Privacy Framework (adequacy decision of 10 July 2023), and where a transfer falls outside that framework it is covered by the European Commission’s Standard Contractual Clauses.
6. How long we keep it
- Contact-form enquiries that do not lead to an engagement: up to 12 months from our last exchange, after which they are deleted.
- Enquiries and correspondence relating to an engagement: for the duration of the engagement and then for the periods required by professional and tax rules and by the statute of limitations for legal claims.
- Technical logs: no longer than 30 days, except where they must be retained to investigate a security incident.
7. Your rights
You may at any time, free of charge:
- obtain confirmation as to whether we process your personal data and, if so, access it;
- have inaccurate or incomplete data rectified;
- have your data erased where it is no longer necessary for the purpose for which it was collected;
- obtain restriction of processing in the cases set out in Article 18 GDPR;
- receive the data you provided in a structured, commonly used, machine-readable format, or have it transmitted to another controller (portability);
- object to processing based on our legitimate interest (Article 21 GDPR);
- withdraw any consent you have given, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise them, write to [email protected] or to our postal address, stating the right you wish to exercise and enclosing a copy of a document proving your identity. We will answer within one month, extendable by two further months for complex requests, and we will tell you if we extend.
If you are not satisfied with our answer, you may lodge a complaint with the Spanish supervisory authority: Agencia Española de Protección de Datos, Calle de Jorge Juan 6, 28001 Madrid — www.aepd.es.
8. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss or disclosure, taking into account the state of the art and the risks involved. These include encrypted transmission (HTTPS), restricted administrative access with strong authentication, and keeping the software on which the Website runs up to date. No system is perfectly secure, but we will notify you and the supervisory authority of any breach that is likely to result in a high risk to your rights, as required by Articles 33 and 34 GDPR.
9. Children
The Website is addressed to businesses and professionals. It is not directed at children, and we do not knowingly collect data from anyone under 14.
10. Changes to this policy
We may update this policy to reflect changes in the Website or in the law. The version published on this page is the one in force, and the date of the last update appears at the top.
This Privacy Policy is governed by Regulation (EU) 2016/679 (GDPR) and by Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights.