Privacy Policy

Last updated: April 2026

1. Who We Are

VAKE Consulting ("we", "us", "our") is an SAP consulting firm headquartered in Madrid, Spain, with offices in Dubai, Paris, and London. We are committed to protecting the privacy and security of your personal data in compliance with the General Data Protection Regulation (GDPR) and applicable EU/EEA data protection laws.

2. Data We Collect

We collect personal data only when you voluntarily provide it through our website:

• Contact Form: First name, last name, email address, company name, service interest, and your message.
• Success Story Registration: First name, last name, email address, and company name.
• Cookie Preferences: Your consent choice (stored locally on your device).

3. How We Use Your Data

• To respond to your contact form inquiries and provide requested information about our services.
• To verify your identity and grant access to our confidential success stories.
• To send you a confirmation email when you submit a contact form or register for success story access.
• To follow up with you regarding potential consulting engagements.

4. Legal Basis for Processing

We process your personal data based on:

• Consent: When you submit a form or accept cookies, you consent to the processing of your data for the stated purposes.
• Legitimate Interest: To respond to inquiries and manage our business relationships.
• Contractual Necessity: When processing is required to fulfill NDA agreements for success story access.

5. Cookies

Our website uses the following cookies:

We do not use any analytics, advertising, or third-party tracking cookies.

6. Data Storage & Security

• Form submissions are stored securely in Google Sheets, accessible only to authorized VAKE Consulting team members.
• Verification emails are sent via Resend, a GDPR-compliant email delivery service.
• Access tokens are cryptographically signed using industry-standard JWT (JSON Web Tokens).
• All data transmission is encrypted via HTTPS/TLS.

7. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, typically no longer than 24 months from the date of collection. You may request earlier deletion at any time.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Restrict Processing: Request limitation of how we process your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw your consent at any time without affecting the lawfulness of prior processing.

9. Third-Party Services

• Resend — Email delivery service used to send verification and notification emails. Resend Privacy Policy
• Google Sheets — Used to securely store form submission data. Google Privacy Policy
• GoDaddy — Website hosting platform. GoDaddy Privacy Policy

10. Contact Us

To exercise any of your rights or if you have questions about this Privacy Policy, contact us at:

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

12. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with the supervisory authority in your country of residence.