Privacy policy
Last updated: 13 Oct 2026
1. Data controller
- Controller
- AUN WE PLAY, S.L. (trade name: firmia)
- NIF (Spanish tax ID)
- B88694328
- Address
- Paseo Porta Pintada, 1, 07002 Palma (Illes Balears), Spain
- Contact
- [email protected]
2. What data we process and why
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form and emails | First name, last name, email, company, message | To reply to your request and prepare a demo or a quote | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and your consent (Art. 6(1)(a)) |
| Customers | Contact and billing details of the contact person | To manage the contract, invoice and provide support | Performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) |
| Browsing | IP address and technical data in server logs | Site security and abuse prevention | Legitimate interests (Art. 6(1)(f)) |
We do not make automated decisions with legal effects on you, and we do not build profiles from your visit.
3. Data we process on behalf of our customers
When a customer uses firmia to process invoices, appointments, case files or other documents, the personal data in them belongs to that customer: the customer is the controller and firmia acts as processor (Art. 28 GDPR), under the data processing agreement we sign with each customer. Those documents are not used to train third-party AI models.
4. How long we keep data
Contact data: for as long as the conversation lasts and up to 12 months afterwards if we do not go on to work together. Customer data: for as long as the relationship lasts, and afterwards for the periods required by Spanish law (for example, 6 years for commercial records and 4 years for tax records). Server logs: a maximum of 90 days.
5. Recipients
We do not sell or share your data. It is processed on our behalf, under a data processing agreement, by the providers we need in order to operate: web hosting, email and, for customers, the cloud infrastructure where firmia runs, located in the European Union. We only disclose data to authorities when the law requires us to.
This site loads its fonts from Google Fonts, which means your browser sends your IP address to Google. The legal basis is our legitimate interest in presenting the site consistently (Art. 6(1)(f) GDPR). Google may process it outside the European Economic Area, with the safeguards of the EU-US Data Privacy Framework and standard contractual clauses.
6. Your rights
You can ask to access, correct, erase, object to, restrict or port your data, and withdraw your consent at any time, by writing to [email protected]. If you are in the United Kingdom, the same rights apply under the UK GDPR. If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es), to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in your country.
7. Security
We apply technical and organisational measures appropriate to the risk: encryption in transit and at rest, access control with minimum permissions and logging of operations.
8. Changes
If we change this policy, we will publish the new version here with its date.