Privacy Policy | Metlabs

1. Data controller

Controller: Metlabs Blockchain, S.L.
Tax ID (NIF): B-56787328
Registered office: Avda. García Sabell 1, Planta 12, Edificio Proa, 15009 A Coruña, Spain
Contact email: hello@metlabs.io
Privacy and rights: privacy@metlabs.io
Phone: +34 881 35 20 29

For any question about this Policy or about the processing of your data, the contact channel is privacy@metlabs.io.

2. Data we process

We process only the data needed for each purpose. Depending on the channel you use to interact with us, this may include:

Identification and professional contact data: first and last name, company, role, email address, telephone number with its international prefix, and country.
Request data: the content of the message you send us, the type of project or service you are interested in, and any information you choose to attach.
Job application data: name, email, experience and links to professional profiles. The form does not accept attachments. If the profile is a match, we may request a CV later by email.
Business relationship data: scheduled meetings, opportunity status, proposals and communications exchanged, and the billing details required once a contract is signed.
Campaign data: aggregated performance information about our ads (impressions, clicks, spend) and visit attribution parameters (UTM). They do not identify you.
Browsing data attached to your request: the page of the site from which you open the form, the page you entered through, the website that brought you here and the campaign parameters in the URL (UTM and advertising click identifiers). We attach them to your message to know how you found us; we do not store them on your device without your consent.
Technical data: IP address, user agent, requested URL and date, which our hosting provider logs for security and to operate the service. Site performance and usage metrics are collected only with your consent, as explained in the Cookie Policy.

3. Purposes and legal basis

We process your data for the following purposes, each one based on a specific legal ground under Article 6 GDPR:

Replying to information requests, quotes and meeting requests received via form, email, telephone or messaging. Legal basis: pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).
Managing the relationship with clients, suppliers and partners, including invoicing. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with accounting and tax obligations (Art. 6(1)(c) GDPR).
Managing job applications and recruitment processes. Legal basis: pre-contractual measures (Art. 6(1)(b) GDPR). Keeping an application once the process is closed is based on your consent (Art. 6(1)(a) GDPR).
Sending commercial communications about our services and content. Legal basis: your consent, given by ticking the corresponding box on the form (Art. 6(1)(a) GDPR) or, if you are already a client, our legitimate interest in informing you about services similar to those contracted (Art. 6(1)(f) GDPR and Art. 21(2) LSSI-CE). You can object at any time and at no cost.
Carrying out our business-to-business commercial activity and measuring the effectiveness of our advertising campaigns with aggregated data. Legal basis: legitimate interest in promoting our services (Art. 6(1)(f) GDPR), balanced against your rights and always with the possibility to object.
Measuring which Google Ads campaigns generate enquiries (conversions) with the Google tag, without personalised advertising or remarketing. Legal basis: your consent to the marketing category, given through the cookie banner (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE).
Measuring the technical performance of the website and analysing how it is used (pages viewed, journeys, interaction with the form and session recording with what you type masked). Legal basis: your consent, given through the cookie banner (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE).
Ensuring the security of the site and preventing abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Complying with the legal obligations applicable to us and responding to requests from the authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

4. Retention periods

We keep data only for as long as necessary for the purpose for which it was collected and, afterwards, blocked during the statutory limitation periods. For reference:

Commercial contacts and information requests: up to 24 months from the last meaningful interaction, unless the relationship is formalised in a contract.
Clients and suppliers: for the duration of the relationship and, once ended, during the accounting and tax retention periods (6 years under the Spanish Commercial Code and 4 years under tax law).
Job applications: up to 12 months after the recruitment process is closed, unless you expressly consent to a longer period.
Commercial communications: until you withdraw your consent or exercise your right to object.
Server technical logs: the limited period applied by our hosting provider for security reasons.
Aggregated campaign data: it does not identify individuals and is kept for statistical purposes.
Record of your cookie consent: 6 months, as explained in the Cookie Policy.

5. Recipients and processors

We do not disclose your data to third parties unless required by law or when necessary to provide the service you request. To operate the site and our business we rely on providers acting as processors under Article 28 GDPR, with whom we sign the corresponding data processing agreement. As of the date of this Policy they are:

Vercel Inc. (United States): website hosting, content delivery network and, with your consent, anonymous web performance metrics (vercel.com/legal/privacy-policy).
PostHog Inc. (data hosted in the European Union, Frankfurt): site usage analytics and session recording, only with your consent (posthog.com/privacy).
Attio: CRM where we record commercial contacts and track opportunities.
Brevo: sending commercial communications to those who have authorised them.
Resend (European Union region): sending the site's emails, such as the internal notice for each contact message or application and the acknowledgement to the sender.
Cloudflare Turnstile: when enabled, verifies form submissions to reduce bots and abuse.
Make: automation of internal workflows between the tools above.
Cal.com: meeting scheduling.
LinkedIn: advertising campaigns and measurement of their performance (www.linkedin.com/legal/privacy-policy).
Google: embedded map showing the location of our offices; with your analytics consent, browsing and enquiry measurement through Google Analytics 4; and, with your marketing consent, Google Ads conversion measurement (policies.google.com/privacy).
Legal, accounting and tax advisors bound by professional secrecy.

6. International data transfers

Some of these providers are established in or process data outside the European Economic Area, in particular in the United States. In those cases the transfer is covered by a European Commission adequacy decision (the EU-US Data Privacy Framework, where the provider is certified) or by the Standard Contractual Clauses approved by the Commission, supplemented with any additional measures required. You can request a copy of the safeguards in place by emailing privacy@metlabs.io.

7. Data obtained through the LinkedIn APIs

We use LinkedIn's application programming interfaces (APIs) to manage our own advertising campaigns and obtain their performance data. In relation to that data:

We only access data from our own accounts and campaigns; we do not access data from third-party accounts.
We use it exclusively for internal reporting and measurement purposes, in aggregated form.
We do not sell, rent or disclose LinkedIn data or data about its members to third parties.
We comply with LinkedIn's Terms of Use and Privacy Policy (www.linkedin.com/legal/privacy-policy) and apply the same security measures to that data as to the rest.

8. Automated decisions and profiling

We do not take automated decisions producing legal effects on you or similarly significantly affecting you within the meaning of Article 22 GDPR.

9. Your rights

As a data subject, you can exercise the following rights at any time and free of charge:

Access: confirm whether we process your data and, if so, access it and the information about the processing.
Rectification: request the correction of inaccurate or incomplete data.
Erasure: ask us to delete your data when it is no longer necessary or when you withdraw your consent.
Objection: object to the processing on grounds relating to your particular situation and, in any case, to the sending of commercial communications.
Restriction of processing: ask us to keep the data only while an issue is resolved.
Portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
Withdrawal of consent: without affecting the lawfulness of the processing carried out beforehand.

10. How to exercise your rights

Send your request to privacy@metlabs.io or by post to Avda. García Sabell 1, Planta 12, Edificio Proa, 15009 A Coruña, Spain, stating the right you are exercising and a detail that allows us to verify your identity (for example, the email address from which you contacted us). We will reply within one month from receipt, extendable by two further months in cases of particular complexity, of which we would inform you.

If you consider that the processing does not comply with the regulations, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain, www.aepd.es. We would appreciate it if you raised the matter with us first so we can try to resolve it.

11. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit (HTTPS), least-privilege access control with strong authentication, activity logging, incident management and team training. No system is infallible; should a security breach occur that poses a high risk to your rights, we would notify you in accordance with Article 34 GDPR.

13. Cookies

This site uses local storage to remember your cookie choice and, only with your consent, analytics and advertising conversion measurement tools. The details, their duration and how to configure them are in the Cookie Policy. You can at any time.

14. SMS Communications

If you expressly agree to receive one-to-one SMS from Metlabs, including through an affirmative reply in a LinkedIn conversation, we process your mobile number, the consent record, SMS messages, delivery information and opt-out status to send and manage those messages. We do not send SMS before receiving your consent. Consent is voluntary and is not a condition of purchasing our services.

We do not sell, rent or share mobile information or SMS opt-in data and consent with third parties or affiliates for marketing or promotional purposes. We disclose these data only to service providers, including JustCall, and mobile carriers as necessary to deliver SMS, provide support and manage opt-outs, under appropriate safeguards.

You can withdraw SMS consent at any time by replying STOP to one of our messages or by contacting hello@metlabs.io. For further details, see our SMS Terms and Conditions.

SMS section updated: October 6, 2026.

15. Changes to this Policy

This Policy may be updated to reflect regulatory, technical or organisational changes, for example when a provider changes. The version in force is always the one published on this page, with the date of its last review. When changes are material, we will inform you through the usual channels before they take effect.

If any clause of this document is declared null or unenforceable, the remaining clauses will stay in force. This document is published in Spanish and in English; in the event of any discrepancy between the two versions, the Spanish version prevails.