Privacy policy
29 September 2026
Data controller
- Controller
- APPFINITY NEXUS, S.L. (OnePlan)
- Tax ID (NIF)
- B56723349
- Registered address
- Campus de Espinardo 7, 30100 Espinardo (Murcia), Spain
- Privacy contact
- info@oneplan.tech
This policy covers the website. Data that customers load into the OnePlan application (app.oneplan.tech) is processed under their contract and the data processing agreement that comes with it.
What data we process
- Contact form: your name, work email, company (optional), the reason for your enquiry and your message. With the submission we also store the page you write from, the language and, if you arrived from a campaign or another website, the campaign parameters in the address (utm) or the referring website, so we know how you found us.
- Demo booking: the details you enter in TidyCal (name, email and, if you add them, company and notes) and the date and time of the meeting.
- Email: if you write to us directly, your address and the content of your message.
- Browsing: only if you accept analytics cookies, Google Analytics collects usage data such as pages viewed, button clicks, device and browser type, approximate location and cookie identifiers. If you do not accept, it is not loaded.
- Technical data: our hosting provider may log data such as your IP address and the pages requested in order to serve the website and protect it against abuse.
We do not ask for special categories of data. Please do not send us your company's financial data or other people's personal data through the form.
What we use it for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your enquiry or demo request and following up on that request. | Steps taken at your request before a contract (Art. 6(1)(b) GDPR) and, when you write on behalf of a company, our legitimate interest in answering those who contact us (Art. 6(1)(f) GDPR). |
| Organising and holding the demo you book. | Steps taken at your request before a contract (Art. 6(1)(b) GDPR). |
| Measuring use of the website in aggregate to improve it (Google Analytics). | Your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE), which you can withdraw at any time. |
| Keeping the website secure and running. | Our legitimate interest in protecting the website (Art. 6(1)(f) GDPR). |
| Handling your rights and meeting legal obligations. | Legal obligation (Art. 6(1)(c) GDPR). |
Answering your enquiry or demo request and following up on that request.
- Legal basis
- Steps taken at your request before a contract (Art. 6(1)(b) GDPR) and, when you write on behalf of a company, our legitimate interest in answering those who contact us (Art. 6(1)(f) GDPR).
Organising and holding the demo you book.
- Legal basis
- Steps taken at your request before a contract (Art. 6(1)(b) GDPR).
Measuring use of the website in aggregate to improve it (Google Analytics).
- Legal basis
- Your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE), which you can withdraw at any time.
Keeping the website secure and running.
- Legal basis
- Our legitimate interest in protecting the website (Art. 6(1)(f) GDPR).
Handling your rights and meeting legal obligations.
- Legal basis
- Legal obligation (Art. 6(1)(c) GDPR).
We will only send you commercial emails if you consent or are already a customer, as allowed by Article 21 LSSI-CE, and you can always unsubscribe. We do not make automated decisions or build profiles that produce legal effects on you.
Who we share data with
We do not sell your data. Only to the extent needed, it is shared with these providers, who act as data processors:
- Vercel: website hosting and delivery.
- Google (Google Analytics 4): web analytics, only if you accept it.
- The automation tool that receives form submissions and passes them on to our team.
- TidyCal: demo scheduling and booking.
- Our email provider: receiving and answering your messages.
If you play the video on the demo page, YouTube (Google) receives data about that playback and processes it under its own privacy policy. We may also disclose data to authorities where the law requires it.
International transfers
Some providers, such as Vercel, Google or TidyCal, are US companies or use servers outside the European Economic Area. In those cases, the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, or on the standard contractual clauses approved by the European Commission, with any additional safeguards required.
How long we keep it
- Enquiries and demo requests: while we handle your request and, if you do not become a customer, up to two years from our last contact, unless you ask us to erase them sooner.
- Analytics: cookies last as stated in the Cookie policy; event-level data is kept in Google Analytics for a maximum of 14 months.
- Afterwards, data is erased or blocked for as long as legal claims may arise.
Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability.
Write to info@oneplan.tech stating which right you want to exercise. If we have reasonable doubts about your identity, we may ask for additional information. We will reply within one month, which may be extended in the cases provided for in the GDPR.
You can withdraw your consent to analytics cookies at any time from “Cookie settings” at the bottom of every page, without affecting earlier processing.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency, AEPD (www.aepd.es).
Security
We apply technical and organisational measures appropriate to the risk to protect your data. The website is always served over an encrypted connection (HTTPS).
Changes to this policy
We will update this policy when the way we process data changes, and show the date of the last update. Which cookies we use is detailed in the Cookie policy.