privacy-policy
This policy explains which personal data we process when you visit trialtrack.es or request a TrialTrack demo, what we use it for, how long we keep it and what you can ask of us at any time.
It is written against what the site actually does, field by field and cookie by cookie. If anything here does not match what you see, write to us.
1. Who the controller is
- Controller: TrialTrack
- Contact: [email protected]
- Website: https://trialtrack.es
For anything concerning your data — including exercising your rights — writing to [email protected] is enough.
2. What we process, and why
2.1. When you request a demo
The form on this site asks for:
- Required: your name, work email, organization, your role and the type of organization.
- Optional: the parts of the platform you are interested in, and a free-text message.
Alongside your submission we automatically record your IP address, your browser identifier (user agent), the language you filled the form in and where your visit came from (see 2.3).
Purpose: to get in touch, prepare the demo and answer what you asked. The IP address and user agent are also kept to limit automated submissions and abuse of the form.
Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) for handling the request, and our legitimate interest in protecting the site against abusive submissions (Article 6(1)(f)) for the technical data.
Please do not send us patient data. This is a commercial form: it is not built to receive clinical information, health data or trial subject identifiers. We ask for no special categories of data, and we ask you not to include any in the message field.
2.2. Your language preference
If you choose to read the site in Spanish or English, we remember it in a first-party cookie so you do not have to choose again on every page. It identifies no one and is never shared.
Legal basis: it is a feature you explicitly requested, exempt from prior consent under the ePrivacy rules.
2.3. Where you arrived from
When you arrive from an advert, a search engine or a link on another site, the address may carry parameters identifying the campaign (utm_source, utm_medium, utm_campaign, gclid, fbclid, msclkid, li_fat_id). We use them to know which campaigns work.
How we do it matters, so here it is precisely:
- If you have not accepted cookies, those parameters are read only from the page you are on and stay in the browser’s memory for that visit. Nothing is stored on your device.
- If you have accepted, we additionally remember them for 90 days in the
trialtrack_srccookie, so that if you come back later and request a demo, we know which campaign brought you the first time. If you decline, that cookie is deleted.
In either case, if you do submit the form, that origin is stored alongside your request.
Legal basis: your consent for the part stored on your device (Article 6(1)(a) GDPR).
2.4. Measurement and advertising
When enabled, we use third-party tools to understand how the site is used and to measure our campaigns: Google Analytics and Google Ads, Meta, LinkedIn and Microsoft Advertising.
The Meta, LinkedIn and Microsoft tags do not load at all until you accept. Google’s load in cookieless mode, without identifying you, and only switch to full mode once you accept (Consent Mode v2). You can change your mind whenever you like: see section 6.
Legal basis: your consent (Article 6(1)(a) GDPR).
2.5. Typeface and server logs
The site uses the Inter typeface, downloaded from Google Fonts servers. To serve it, your IP address reaches Google. This happens on every visit, because it is part of how the page is displayed.
Our hosting provider also records, as any web server does, the requests it receives (IP address, timestamp, page requested and browser), for the sole purpose of keeping the service running and secure.
Legal basis: our legitimate interest in providing and protecting the service (Article 6(1)(f) GDPR).
3. How long we keep it
| Data | Retention |
|---|---|
| A demo request that does not lead anywhere | 90 days, and it deletes itself: the system runs a daily sweep and automatically removes requests past that period. |
| A request that does lead to a commercial relationship | For as long as that relationship lasts, and afterwards for as long as the law requires us to answer for our obligations. |
| Language preference | 1 year, or until you clear your browser cookies. |
| Visit origin (only if you accepted) | 90 days. |
| Your cookie choice | Until you change it or clear your browser data. |
| Server logs | The period applied by our hosting provider. |
4. Who we share it with
We do not sell your data, and we do not pass it to third parties for their own purposes. Only those providing a service we need in order to reply to you have access:
- Our hosting provider, whose servers are in the European Union, where the site and the database of requests live.
- Our email provider, which delivers the internal notification of your request and, where applicable, the acknowledgement we send you.
- The measurement and advertising platforms in section 2.4, and only if you have accepted.
- Google, when serving the typeface, as described in section 2.5.
We may also have to disclose data to public authorities where a legal obligation requires it.
5. Transfers outside the European Union
The site and the database holding your requests are hosted in the European Union.
Google, Meta, LinkedIn and Microsoft are US companies. Where they are involved — the typeface always; measurement and advertising only if you accept — an international transfer may take place, relying on the EU-US Data Privacy Framework and on the standard contractual clauses approved by the European Commission.
6. Cookies and browser storage
These are ours. None of those marked “consent required” is activated before you give it.
| Name | What it does | Duration | Consent? |
|---|---|---|---|
trialtrack_lang | Remembers the language you chose | 1 year | No: strictly necessary |
trialtrack_consent(local storage) | Remembers your cookie choice so we do not ask again | Until you change it | No: strictly necessary |
trialtrack_src | Remembers which campaign you arrived from | 90 days | Yes |
_ga, _ga_* | Google Analytics: measuring site usage | Up to 2 years | Yes |
_gcl_* | Google Ads: attributing conversions | Up to 90 days | Yes |
_fbp | Meta: campaign measurement | Up to 90 days | Yes |
li_sugr, UserMatchHistory, bcookie | LinkedIn: campaign measurement | Up to 6 months | Yes |
_uetsid, _uetvid | Microsoft Advertising: campaign measurement | Up to 13 months | Yes |
wordpress_*, wp-settings-* | Only if you sign in to the site’s admin area | Session-dependent | No: strictly necessary |
Changing your mind: clear this site’s data in your browser and we will ask you again next time. You can also block or delete cookies from your browser settings; if you block the strictly necessary ones, the site will still work, though it will forget your language.
7. Your rights
At any time, and free of charge, you may exercise your rights of access, rectification, erasure, restriction of processing, objection and portability, and withdraw any consent you have given, without affecting what was done before you withdrew it.
Write to [email protected] stating which right you wish to exercise. We will reply within one month. We may ask you to prove your identity if we cannot otherwise confirm it.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or with the supervisory authority of your country of residence.
8. Security
The site is served over an encrypted connection (HTTPS). Access to the requests we receive is restricted to authorised staff through accounts with role-based permissions, and the form includes measures against automated submission and abuse.
9. Children
This site is aimed at professionals and organizations in clinical research. It is not intended for children under 14 and we do not knowingly collect their data.
10. Changes to this policy
If what we do with your data changes, we will update this text and the date below. Where the change affects processing based on your consent, we will ask for it again.
Last updated: 30 August 2026.
