Privacy and Cookies Policy
1. Data controller
QUALITAS EVENTUM SL, with Spanish tax identification number (NIF) B24380255 and registered address at Avenida Portugal 92, 24400 Ponferrada, León, Spain, is the controller of personal data collected through https://skysurf.es/ and communications addressed to Sky Surf Dron Operations, the brand under which it provides audiovisual and drone pilot services.
Sky Surf contact details: info@skysurf.es and +34 689 405 153. You can also send data protection enquiries to info@qualitaseventum.es or to the address above.
This policy covers the website and the enquiries, quote requests and relationships arising from those contacts. Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights apply.
2. What data we process and how we obtain it
We receive the information you provide when you complete the contact or guided quote form, email us or contact us by phone. This may include your name, email address, phone number and project details, such as the service, location, dates and filming requirements.
Your name and email address are required in the forms so we can identify and respond to your request. Your phone number, comments and guided quote options are voluntary. Without the required fields you cannot submit the form, but you can use the email address or phone number provided. The request also identifies the form used and its source page.
If you contact us on behalf of a business, we may process your professional contact details and the organisation you represent. If you book a service, we will request the information needed for the contract and invoicing.
The hosting and security infrastructure may process technical connection data, such as IP address, browser, device, requests made and access logs.
Only provide information needed to deal with your enquiry. We do not request health data, identity documents or other special categories of data through these forms. Avoid including third-party personal data that is not needed for the project.
3. Why we use your data and the legal basis
Service enquiries and quote requests: to respond to your request, clarify requirements, assess project feasibility and prepare a proposal. When you act on your own behalf to book a service, the legal basis is taking steps at your request before entering into a contract, under Article 6(1)(b) GDPR.
General enquiries and professional contacts: to respond to the communication you initiated and manage the relationship with the company you represent. The legal basis is our legitimate interest in responding to these communications and maintaining the requested professional relationship, under Article 6(1)(f) GDPR. You may object as provided by law.
Booked services: to manage and carry out the assignment, maintain necessary communications and issue invoices. The legal basis is the contract and, for tax, accounting and other legal obligations, Article 6(1)(c) GDPR.
Website operation and security: to serve pages, detect errors and prevent abusive or fraudulent access. The legal basis is our legitimate interest in maintaining an available and secure website, under Article 6(1)(f) GDPR, without prejudice to the requirements applicable to the technologies used.
Sending an enquiry does not subscribe you to advertising or authorise uses other than those described. The current forms do not collect marketing subscriptions. We do not create advertising profiles or make automated decisions with legal or similarly significant effects based on your answers.
4. How long we keep information
Enquiries that do not lead to a booking: up to 12 months from the last communication relating to the request. We will delete the information sooner if it is no longer needed, unless it must be retained to meet a legal obligation or address potential liabilities.
Booked services: for the duration of the contractual relationship and afterwards for the applicable statutory retention periods for documentation and potential liabilities. Where required, data will be blocked and will not be used for new purposes.
The 12-month period applies to enquiries and emails managed by QUALITAS EVENTUM SL; it does not describe every provider's retention periods. FormSubmit states that it retains an archive of submissions for 30 days, separately from the message received in our inbox.
Before submission, guided quote answers remain in browser memory while you navigate the website; they are not saved as a client record in this application's database. Reloading the page clears that state. Once you submit the form, processing by FormSubmit and in email is independent of this temporary state.
5. Providers involved
FormSubmit (formsubmit.co) receives the data submitted through the forms and forwards it to info@skysurf.es. Its service and retention documentation is available at https://formsubmit.co/documentation and its privacy policy at https://formsubmit.co/privacy.pdf.
IONOS provides the email service through which we receive, send and retain communications. For Mail Basic, the contractual documentation reviewed identifies IONOS Cloud S.L.U. and subprocessors 1&1 Mail & Media GmbH and Open-Xchange GmbH, both in Germany.
ChatGPT Sites provides website hosting. Its data processing addendum identifies OpenAI Ireland Ltd. for users in the European Economic Area and provides for processing on behalf of the website owner to host, maintain and support the site, with the applicable subprocessors. The infrastructure uses Cloudflare to distribute and protect the service.
When you email info@skysurf.es directly or call us, you do not use the FormSubmit form delivery service. We do not sell enquiry data or share it with third parties for advertising. We may disclose it to public administrations, courts or authorities where legally required.
6. International transfers
The ChatGPT Sites addendum provides for transfers to affiliates or providers outside the EEA covered by standard contractual clauses or European Commission adequacy decisions. It is available at https://openai.com/policies/chatgpt-sites-data-processing-addendum/.
The services described in this policy have their own processing and retention terms. For information about the processing of your data, its recipients and international transfers, you can write to info@skysurf.es.
7. Your rights
You can request access to, rectification or erasure of your data and, where the legal requirements are met, restriction of processing, objection and data portability. Where processing is based on consent, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal.
Write to info@skysurf.es, info@qualitaseventum.es or the address of QUALITAS EVENTUM SL, stating the right you wish to exercise and the information needed to locate your request. We will only ask for additional identity verification information if there are reasonable doubts; do not attach a copy of your identity document by default.
We will respond within the GDPR time limits: generally within one month of receiving your request. If an extension is necessary because of the complexity or number of requests, we will explain the reasons and additional time needed within that first month.
You can also lodge a complaint with the Spanish Data Protection Agency at https://www.aepd.es/ if you believe processing does not respect your rights. You are not required to complain to us first.
8. Cookies and similar technologies
Cookies are small files saved by your browser when you visit a website. Some help maintain the service's operation and security; others may be used to measure visits or display advertising.
The reviewed Sky Surf configuration does not include advertising or visitor analytics tools. Fonts, images and video files are served from this website, without embedded YouTube or Vimeo players. Guided quote answers are held temporarily in memory; the application does not use cookies or persistent browser storage to save that questionnaire.
Identified security cookie: __cf_bm.
Provider: Cloudflare, within the website hosting infrastructure.
Domain: skysurf.es. Scope: the pages of this website.
Purpose: to help distinguish legitimate visits from automated traffic and protect the service against bots and abuse.
Duration: 30 minutes of inactivity, according to the provider's documentation. Further activity may renew its duration.
Type: technical security cookie. It is transmitted over a secure connection and cannot be accessed by the page's JavaScript code.
Cookies that are strictly necessary to provide the requested service do not require prior consent. This exemption is limited to their technical purpose; it does not permit use for advertising or other non-exempt purposes. The website currently has no optional cookie consent panel.
You can delete cookies or block them through your browser's privacy settings. Blocking technical cookies may prevent security checks or some website functions from working properly. Deleting them does not delete requests you have already submitted or emails received by the company; to exercise your rights, use the contacts in section 7.
Form submissions use FormSubmit, as explained in section 5. Its policy describes possible cookie use in its service; that general information should not be confused with a specific cookie installed while browsing Sky Surf. Access to the private editor also uses the hosting provider's authentication system and is restricted to authorised users.
More information about Cloudflare cookies: https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/.
9. Updates to this policy
We will review this information when the purposes, providers or technologies used change. If we introduce cookies or other technologies that require consent, we will provide information and request your choice before activating them.
Last reviewed: 29 September 2026.