Helloforms

GDPR overview

GDPR implementation is stated explicitly and in concrete terms. Canal Tonight S.L. is named as controller, with a file declared to the Spanish data protection agency. Data subjects exercise ARCO rights, meaning access, rectification, cancellation and objection, either by post to the company's legal department in Las Palmas or by email to soporte@eseaforms.com, attaching proof of identity. The security page commits to notifying any breach within 24 hours and cites Article 33 GDPR by name. Customers with EU users are said to be hosted in the EU, and compliance with the Spanish LOPD is claimed alongside the GDPR. The policy states that no minors' data is processed, though no minimum age is published. Note that these documents are written for the publisher's sibling domain eseaforms.com and served here unchanged.

Who owns the data?

Under the privacy policy the customer who subscribes to the service, the persona Contratante, is the sole party responsible for the data they host on the platform, and Canal Tonight S.L. acts only as a processor, handling that information exclusively on the customer's behalf and within the terms of the main contract. The publisher undertakes not to apply, use or disclose the data for any purpose outside that contract, and not to grant any third party access to it, including for mere storage, unless the contract says otherwise. The security pages state that data is neither shared nor sold and that the customer keeps full ownership of it.

Reuse rights

Customers may reuse their own data freely and without asking permission. A complete export is available at any time in Excel, CSV or PDF, and the FAQ states plainly that the data always belongs to the customer. The GDPR page adds that, while an account is active, the customer decides which categories of data are kept and for how long, and that deletions made from the account are also removed permanently from backups. The publisher's own use is confined to running the contracted service and notifying incidents and product news; calls may be recorded for security reasons. Nothing on the site addresses whether customer data feeds AI model training.

Data retention & training

Hosting summary

The publisher states that all applications run on its own infrastructure and that it operates data centres in Spain, France, Germany, the Netherlands and the United States. Customers whose users are in the EU are said to have their data hosted in the EU, and the homepage describes European infrastructure under GDPR rules. Encryption is claimed in transit and at rest using SSL/TLS with AES-256, with TLS 1.3 named in the FAQ, alongside automatic daily backups to redundant servers, Google OAuth 2.0 sign-in and role-based access control. One distinction matters: the marketing site itself is served from a US-based anycast address, which says nothing about where the customer platform runs. Governing law is Spanish and jurisdiction lies with Spanish courts. A SOC 2 reference on the privacy page applies to the data centres, meaning the hosting provider, and not to the publisher; an ISO 27001 badge on the homepage carries no certificate number, body or validity date.