Privacy policy
1. Who is the controller
| Controller | Josep Gargallo |
|---|---|
| Location | Barcelona, España |
| Privacy contact | privacidad@cordilio.com |
This website is a personal project in a pre-commercial phase: it charges nothing, provides no services and the waiting list is free. The owner does not publish their tax ID or home address while there is no economic activity; they will complete them before starting one or when the law requires it.
CORDILIO is the trading name of the project.
2. What data we process
- Email address (required).
- Optional answers: number of brokers in ranges (1, 2–3, 4 or more) and main difficulty.
- Type of request: waiting list for future trials (fixed value of the form).
- Version, language and commercial authorisation: the version of the texts that were displayed, the language of the page and, if you tick it, your authorisation to receive commercial communications. Alongside them we keep a random identifier for your request and a fingerprint (digest) of the consent text that was displayed.
- Technical data of the submission recorded by the form provider: IP address, browser (user agent), date and time. They are used for security, to filter spam and to evidence consent.
We do not ask for and do not want balances, net worth, statements, positions, account numbers, tax documents, passwords or broker login credentials. The form has no free-text fields and no fields for them.
3. Purposes and legal basis
| A. Early access request | To handle your request and, if a supervised beta exists, to contact you to offer it. Legal basis: your consent (Art. 6.1.a GDPR), which you give when you send the form after reading this information. |
|---|---|
| B. Commercial communications | To send you news about CORDILIO by email. Legal basis: your consent (Art. 6.1.a GDPR and Art. 21 of the Spanish LSSI, the law on information society services). The checkbox is optional, independent and not pre-ticked, and you can withdraw your consent at any time. |
Ticking the commercial communications box is not necessary to join the waiting list. If you do not tick it, we will not send you commercial communications: we will only write to you to handle your request.
Your consent is recorded with your submission: date and time, IP address and browser stored by the provider, the version of the text that was displayed and the language. We do not take automated decisions or build profiles with effects on you.
4. How long we keep it
- Request: while the waiting list lasts and, at most, 12 months from your request. It is then deleted.
- Commercial communications: until you withdraw your consent. Afterwards only the minimum proof of that consent will be kept (email, date, IP address, version and fingerprint of the text, request identifier and language), blocked and set aside to deal with possible claims, for 24 months.
- At the form provider, according to its documentation (consulted on 24/10/2026): submissions stay in the inbox for the last month or the last year depending on the plan, and are deleted automatically and permanently after one year; spam and the trash are emptied after one month; the owner can permanently delete submissions at any time; and the IP address and browser are deleted together with their submission.
5. Who else may access it
We do not pass your data on to third parties for their own purposes. These providers take part as processors:
| Form | Form.taxi (wrkt*biz, Austria). It receives and stores your submission and notifies the controller by email. |
|---|---|
| Data location | According to the provider's documentation (consulted on 24/10/2026), processing within Form.taxi takes place in the European Union: hosting in Germany and email notifications sent through a provider in Germany. This does not cover the mailbox that receives the notifications or the hosting of this website, which are listed below. |
| Email notifications | Each request also reaches a Gmail (Google) mailbox of the controller by email. Google handles those copies as the mailbox provider, under its own terms, and may do so outside the European Economic Area (see the section on international transfers). |
| Website hosting | Cloudflare, Inc. (Cloudflare Pages) hosts this website. According to its documentation, it acts as a processor for traffic logs, which may include the visit's IP address, and may process data outside the European Economic Area with safeguards such as the EU-U.S. Data Privacy Framework or standard contractual clauses. |
| International transfers | Form.taxi states that it does not transfer form data outside the EU. Cloudflare may process data outside the European Economic Area with the safeguards of its data processing agreement (standard contractual clauses and the EU-U.S. Data Privacy Framework). Google, the mailbox provider, states in its policy that it complies with the EU-U.S. Data Privacy Framework and uses standard contractual clauses where needed (providers' documentation consulted between 24 and 25/10/2026). You can ask us for more information about these safeguards at privacidad@cordilio.com. |
If we later use a service to send news by email, we will add it here before using it.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to privacidad@cordilio.com. We will reply within one month.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the data protection authority of your country of residence.
7. Cookies and storage in your browser
The website uses no cookies, analytics or trackers of its own or from third parties. If you choose a language with the selector, we save that choice in your browser's local storage (key “cordilio.lang”) to remember it next time: it is a preference you decide, it is not sent to any server, it does not identify you and you can delete it from your browser settings. The host (Cloudflare) adds network error reporting headers (NEL and Report-To) to its responses: with them your browser may notify Cloudflare of connection failures, and according to Cloudflare these reports contain no personally identifiable data. When checked on 24/10/2026 the website set no cookies.
8. Taking part in the supervised beta
This form is only for signing up. If you later take part in the beta, before you share any financial document we will give you specific information about that processing and ask for your separate consent.
9. Minimum age
Early access is aimed at people aged 18 years or over.
10. Security
The form submission is encrypted in transit (HTTPS) and the form does not accept free text, so that nobody writes financial data by mistake. Even so, do not write balances, account numbers or credentials in the form.
11. Languages and changes
This policy is offered in Spanish, Italian and English. In case of discrepancy between versions, the Spanish one prevails. If we change this policy, we will publish the new version with its date. The version that was displayed when you sent the form is recorded with your request.