Privacy policy

1. Who is the data controller

The data controller is Daniel Grimaldi Medina, owner of GrimePur · Water treatment, based at 43870 Amposta (Tarragona), Spain. Tax ID: [to be completed].

• Email: info@grimepur.com
• Phone / WhatsApp: +34 654 901 606

2. What data we process

We only process the data you give us or that is generated while providing the service:

• Identification and contact: name, phone, email, installation address and, if you request an invoice, tax ID.
• Service data: installed system, services, repairs, work reports, photos of the system you send us and your water tests.
• Billing and payment data: invoices, fees and payment status. Your full card or bank details are handled by the payment provider (Stripe); GrimePur never sees or stores them.
• Communications: WhatsApp messages, emails and calls about your system or enquiry.
• Browsing data: technical cookies and the language preference cookie of the website (see section 10).

3. What we use your data for and on what legal basis

Each purpose relies on a legal basis under the General Data Protection Regulation (GDPR):

• Answering your enquiries and quotes (forms, WhatsApp, email, phone). Basis: your request and our legitimate interest in serving you.
• Providing the contracted service: installation, servicing, repairs, Care plans, Direct Flow Programme and business services. Basis: performance of a contract.
• Managing appointments and advisory visits booked online. Basis: pre-contractual steps at your request.
• Invoicing and collecting payment, and meeting tax and accounting obligations. Basis: legal obligation.
• Handling manufacturer warranties (for example, Kinetico) while your system is under warranty. Basis: performance of a contract and legitimate interest.
• Reminding you of pending services, changes to your plan or payment issues. Basis: performance of a contract.
• Sending you information about our services by email or WhatsApp, only if you have authorised it. Basis: your consent, which you can withdraw at any time.

4. How long we keep your data

• Enquiries without a contract: up to 12 months from the last communication.
• Customers: for the duration of the relationship and, afterwards, the technical history of the system for 5 years so we can handle warranties and future repairs.
• Invoices and tax data: the period required by tax and commercial law (generally 6 years).
• Consent for marketing communications: until you withdraw it.

5. Who we share your data with

We don't sell or hand over your data. It is only shared with the providers we need in order to work, who act as data processors under contract:

• Odoo S.A. (management, invoicing, website and customer area), with servers in the European Union.
• Stripe Payments Europe (online payments for plans and subscriptions).
• Microsoft 365 (email and calendar).
• WhatsApp / Meta, when you choose to communicate through that channel.
• Our bank, for payments by transfer or SEPA direct debit.
• Our accounting and tax advisers, to meet legal obligations.
• Manufacturers and distributors (for example, Kinetico Spain) only with the data strictly needed to process a warranty or a direct delivery to your address.
• Public authorities and courts, where required by law.

6. International transfers

Some providers (Stripe, Microsoft, Meta) may process data outside the European Economic Area. In those cases the safeguards provided for in the GDPR apply: European Commission adequacy decisions or standard contractual clauses.

7. Your rights

You can exercise the following rights at any time by writing to info@grimepur.com, stating your name and the right you wish to exercise:

• Access: to know what data we hold about you.
• Rectification: to correct inaccurate data.
• Erasure: to ask us to delete your data when it's no longer needed.
• Objection and restriction: to object to certain processing or ask us to restrict it.
• Portability: to receive your data in a commonly used format.
• Withdrawal of consent, without affecting processing carried out before withdrawal.
• Lodging a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe we haven't handled your rights properly.

8. Security

We apply reasonable technical and organisational measures to protect your data: password and two-factor access to management tools, encrypted web communications (HTTPS), backups and access restricted to the person providing the service.

9. Minors

Our services are aimed at adults. We do not knowingly collect data from anyone under 18. If we find that a minor has given us data, we will delete it.

10. Cookies

This website only uses technical cookies needed for it to work and to remember your language. We don't use advertising or tracking cookies. Online sign-up and the customer area take place at grimepur.com, which has its own cookie policy.

11. Changes to this policy

If we change this policy, we'll publish the new version on this page with the update date. If the change affects how we use your data, we'll let you know directly.

12. Goti virtual assistant

Goti is this website's chat assistant. Without signing in it only uses predefined answers and sends nothing outside your browser. When you are signed in, your messages are sent to an artificial-intelligence service (Anthropic, provider of the Claude model) to generate the reply, together with your customer name and email so the assistant can log requests on your behalf.

Anthropic acts as a data processor and does not use your conversations to train its models. The conversation is stored only in your browser for the duration of your visit; GrimePur keeps only the requests (tickets) you choose to create from the chat. Do not type passwords, bank details or health data into the chat: the assistant gives guidance but does not replace the technician or a healthcare professional.