Last updated: 31 August 2026.
This policy explains how FINE PROGRAMS SL processes personal data of anyone who visits https://wallion.com (the “Site”). The Site is the corporate website of the custom-software studio that operates under the Wallion brand. It is not a client area, it does not collect third-party employee data, and it does not operate payroll or mobility products.
1. Controller
| Legal name | FINE PROGRAMS SL |
| Trade name | Wallion |
| Tax ID (NIF) | B13790043 |
| Registered office | Calle Aribau, 168, 1st floor, door 1, 08036 Barcelona, Spain |
| Commercial Registry | Barcelona, volume 48806, folio 128, sheet B-596954, entry 1 |
| hello@wallion.com |
We have not appointed a data protection officer. For any privacy question, write to hello@wallion.com.
2. What data we process and where it comes from
We only process what is needed for each purpose:
- Browsing and security. IP address, technical device and browser identifiers, date and time, requested URL and response codes. These are generated by accessing the Site and by hosting logs.
- Contact. If you write to hello@wallion.com or use the contact form: name, email, company or organisation, company size, type of problem or need, budget band, expected timeline, message, and any other data you provide voluntarily. The form shows a first-layer notice that Fine Programs SL will process these data to handle your enquiry and points to this policy. Required fields are marked on the form.
- Call booking. The Site may show an outbound link to HubSpot Meetings at https://meetings-eu1.hubspot.com/oleon. Using it takes you off the Site. HubSpot, Inc. collects the booking data (identity, email, date and whatever you enter in its flow) under its policy. We do not embed the calendar or load the HubSpot script (portal 148716913) on wallion.com.
- Cookies and measurement. Today the Site does not set analytics or marketing cookies and does not load HubSpot. It does use Vercel Web Analytics (
@vercel/analytics), which Vercel states does not use cookies. Details: /legal/cookies.
We do not collect special-category data under Article 9 GDPR (health, ideology, etc.) or offence data through this Site. We do not create profiles with legal effects or take automated decisions of that kind.
If you send us data about other people, you must be allowed to do so and those people must know this policy.
3. Purposes and legal bases
| Purpose | Data | Basis (Art. 6 GDPR) |
|---|---|---|
| Provide the Site, keep it available and protect it against abuse, fraud or security incidents | Browsing and technical logs | Legitimate interest (6.1.f): operate and secure a corporate website |
| Measure aggregated Site use (page views, referrer, country, device) | Technical request data processed by Vercel Web Analytics | Legitimate interest (6.1.f): understand what is accessed on a corporate website, without persistent identifier or advertising |
| Handle enquiries and requests for information or for a services proposal | Contact (form or email) | Pre-contractual steps (6.1.b) if you ask for an offer or to open a services relationship; otherwise legitimate interest (6.1.f) in answering whoever writes to us |
| Arrange a call if you use the booking link | Data you provide on HubSpot Meetings | Pre-contractual steps (6.1.b) when you complete the booking; HubSpot processes that flow on its own site |
Legitimate interest is balanced against your rights: the Site is informational, the data volume is the technical minimum, and it is not used for advertising without consent.
If in the future the Site loads HubSpot or a similar tool, measuring Site use and linking visits to commercial contacts through cookies and third-party identifiers will be based on consent (6.1.a), which you may withdraw at any time without affecting processing already carried out.
4. How long we keep it
- Technical logs: as long as needed to operate and secure the Site. As a general rule, no more than 12 months, unless they must be kept for an incident or a legal duty.
- Commercial correspondence: for the life of the conversation or relationship and, afterwards, the limitation periods for claims (in particular Art. 1964 of the Spanish Civil Code) and, if a contract follows, the applicable commercial and tax periods.
When the period ends, we delete or anonymise the data.
5. Who we share it with
We do not sell data. We only disclose it to:
- Vercel, Inc., which hosts and serves the Site (infrastructure, CDN and technical access logs).
- Vercel Web Analytics (same provider): aggregated visit measurement, without cookies according to its documentation.
- A server-side lead intake channel, if a form submission is delivered by webhook or integration to an external management system (independent of cookie consent).
- Email notification of the form submission, if enabled, to the relevant mailbox.
- HubSpot, Inc., if you use the booking link to HubSpot Meetings: HubSpot processes the meeting data on its site (meetings-eu1.hubspot.com) and we receive it as the host. That does not load HubSpot's tracker on the Site.
- The email provider for hello@wallion.com, to receive and store messages.
- Public authorities and courts, when a legal rule requires it.
- Professional advisers (for example lawyers or auditors) bound by secrecy, if needed to defend or meet obligations.
HubSpot, Inc. is a recipient of meeting data only if you use the booking link. The tracking script (portal 148716913, the organisation account) is not loaded today; if it is loaded, cookie consent for that category will be required.
Any other processor will be engaged with the guarantees of Art. 28 GDPR.
6. Transfers outside the EEA
Vercel is established in the United States. When your data leave the European Economic Area, the transfer to Vercel is based on the European Commission’s standard contractual clauses (Vercel Data Processing Addendum, March 2026 version), with supplementary measures if needed. Vercel states that it is certified under the EU-US Data Privacy Framework (DPF); that is a vendor claim we have not independently verified.
If you use the HubSpot Meetings link, HubSpot, Inc. receives the booking data. The destination is meetings-eu1.hubspot.com (EU region). HubSpot states that it is certified under the EU-US DPF; that is a vendor claim we have not independently verified.
If in the future we load the HubSpot script (portal 148716913) with your cookie consent, that transfer of identifiers will rely on DPF certification if it is in force at the time of loading.
You can ask for more detail at hello@wallion.com.
7. Your rights
You may exercise access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent where processing is based on it. You also have the right not to be subject to automated decisions with legal effects, which this Site does not take.
Write to hello@wallion.com from an account that lets us identify you, or to the postal address in section 1. We may ask for further information to verify identity.
If you consider we have not handled your request, you may complain to the Spanish Data Protection Agency (www.aepd.es, electronic office sedeaepd.gob.es).
8. Children
The Site is aimed at professionals and businesses. It is not intended for children under 14 (Art. 7 of Organic Law 3/2018 on Personal Data Protection). If we detect data of a child below that age, we will delete it.
9. Changes
We may update this policy. The date of the latest version appears at the top. If the change is material, we will indicate it on the Site or through the appropriate channel.