Privacy
Privacy Policy
Under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December (LOPDGDD).
This page is a translation offered for convenience. The Spanish version is the binding one.
1. Data controller
In fulfilment of the duty to inform laid down in Article 13 of the GDPR, the User is informed that the controller of the personal data collected through the website grasshopperairmobility.com (hereinafter, the “Website”) is:
GRASSHOPPER AIR MOBILITY, S.L.
Rambla de la Marina, 456, Planta 2
08907 L’Hospitalet de Llobregat, Barcelona, España
For anything to do with personal data, write to dataprotection@grasshopperairmobility.com. For anything else, info@grasshopperairmobility.com or +34 644 661 687.
None of the circumstances requiring the appointment of a Data Protection Officer applies, and none has been appointed. The address given above reaches those responsible.
2. Browsing the Website
The Website is served by Cloudflare, which hosts the pages and protects the site against attack. Like every web server, Cloudflare records each request in its logs: the User’s IP address, the date and time, the page requested, the referring page and the browser type. An IP address constitutes personal data, which is why the User is informed of it.
| Purpose | Delivering the website, keeping it available, and defending it against attack and abuse |
| Legal basis | Our legitimate interest in operating and securing our own website (Art. 6(1)(f) GDPR) |
| Retention | Held by Cloudflare for a short period under their own retention policy. We do not download, store or analyse these logs |
The aggregate traffic figures Cloudflare displays in its dashboard are used, such as visit counts, countries and most-visited pages. These are statistical data rather than records concerning the User, and there is no means of linking them to an identified or identifiable person.
We use Cloudflare Web Analytics to see which pages are read. A small script from Cloudflare records the page you viewed, the page that referred you, your country, your browser and device class, and how quickly the page loaded and responded on your device. It sets no cookie. It stores nothing on your device and reads nothing from it, and it gives you no identifier, so it cannot recognise you on a later visit and we cannot connect any of it to an individual. We rely on our legitimate interest in understanding how our own website is used (Art. 6(1)(f) GDPR). There is no consent banner for it because consent is required for storing information on your device or reading it, and this does neither.
Beyond that single script the Website carries no Google Analytics, no tag manager, no advertising pixel and no session recording. Typefaces and images are served from the Website’s own domain, and not from Google Fonts or any other third party. The detail is set out in the Cookie Policy.
When the home page is accessed, the server reads the language preference sent by the User’s browser and the country Cloudflare infers from the connection, may direct the User to that language version of the page, and stores nothing on the User’s device.
3. Communications addressed to the controller
The Contact page provides email addresses rather than a form. Where the User sends a message, the data processed are those the User chooses to include in it, typically a name, an email address, a company and the reason for writing.
| Purpose | Reading your message and replying to it |
| Legal basis | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), or our legitimate interest in answering people who contact us (Art. 6(1)(f)) |
| Retention | For as long as the conversation is live, and afterwards for as long as we may need it as a record of our dealings. Correspondence with no continuing purpose is deleted |
Email is provided over Google Workspace. Business contacts may also be recorded in the customer relationship system, HubSpot, so that a conversation can be followed.
4. Newsletter
Where the User enters an email address in the subscription field, it is used to send occasional updates about the company. No other data are requested.
| Purpose | Sending you the updates you asked for |
| Legal basis | Your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE) |
| Retention | Until you unsubscribe. We keep a record that you subscribed, and when, for as long as we send to you and for a reasonable period afterwards, because the law requires us to be able to show that consent was given |
Subscription takes place in two steps. After the address is entered, a message is sent asking for confirmation. Nothing is added to the list until that link is followed, which prevents a third party from subscribing someone else. Every message carries an unsubscribe link, and consent may be withdrawn at any time, at no cost and without giving reasons. Withdrawal does not affect the lawfulness of messages sent beforehand.
The list is managed by HubSpot. The address is transmitted to HubSpot from the Website’s own server. HubSpot loads no script into the Website and places nothing on the User’s device.
5. Video embedded on the home page
The home page displays a still image with a play button. If the User presses it, the video is requested from YouTube (Google Ireland Limited), which at that moment receives the User’s IP address and may store information on the device. That processing is carried out by Google under its own privacy policy, and takes place only at the User’s instigation. The detail is set out in the Cookie Policy.
6. Recipients of the data
The following are the only third parties involved, and each acts on the controller’s instructions under a data processing agreement:
| Who | What for | Where |
|---|---|---|
| Cloudflare | Hosting the website and its server logs | EU and USA |
| Google (Workspace) | Our email | EU and USA |
| HubSpot | Newsletter and customer relationship records | EU and USA |
Beyond the above, personal data are disclosed only to professional advisers where necessary, or to a public authority where the law so requires. Personal data are not sold and are not shared for third-party marketing purposes.
7. International data transfers
The three providers named above are, or are owned by, companies in the United States, so the data may be processed there. Those transfers are covered by the Standard Contractual Clauses approved by the European Commission and, where the provider is certified, by the EU-US Data Privacy Framework. A copy of the applicable safeguards may be requested.
8. Rights of the data subject and how to exercise them
The User may at any time request that the controller:
- Access. Tell you what personal data of yours we hold.
- Rectify. Correct anything inaccurate.
- Erase. Delete it, where there is no longer a reason to keep it.
- Restrict. Stop using it while a dispute is resolved.
- Object. To processing we base on legitimate interest.
- Port. Receive it in a machine-readable form, or have it sent elsewhere.
- Withdraw consent. At any time, where consent is what we relied on.
Requests should be addressed to dataprotection@grasshopperairmobility.com with “Data protection” in the subject line. A request is answered within one month, and the exercise of these rights is free of charge.
If the answer is not satisfactory, a complaint may be lodged with the Agencia Española de Protección de Datos, the supervisory authority competent in Spain, at www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid. It may be addressed directly. Approaching the controller first is not a precondition.
9. Automated decisions and profiling
No profiling of the User is carried out and no decisions concerning the User are taken by automated means.
10. Minors
The Website is professional in nature and is not directed at children. No data are knowingly collected from persons under fourteen, the age of digital consent in Spain under Article 7 of the LOPDGDD.
11. Security measures
The Website is served exclusively over an encrypted connection. It has no database and no login, so no account of the User’s exists for a third party to break into. Personal data sent by the User reside in the controller’s email and CRM accounts, which are protected by access controls and multi-factor authentication.
12. Amendments to this policy
Where the processing of personal data changes, this page is amended at the same time, and the date of last update shown at the foot changes with it. Where the change is significant and an address is held, the User will be informed.
Last updated: 27 August 2026.