PRIVACY POLICY
Last updated: 21 September 2026
At Rooklyn, we are committed to processing personal data lawfully, fairly, transparently and only for the purposes for which it is necessary. This Policy explains how we process the personal data of people who interact with our websites, forms, demonstration pages and own channels.
1. Data controller
| Owner | Geetanjali Dubey |
|---|---|
| Trading name | Rooklyn |
| NIF/NIE | Z0680759X |
| Business address | Calle Transversal Sexta 24, 28021 Madrid, Spain |
| geet29.dubey@gmail.com | |
| Website | https://rooklyn.co |
Rooklyn acts as data controller for data collected for its own commercial, contact, contracting and service management purposes. When Rooklyn processes data on behalf of a customer and following their instructions, it may act as a data processor; that relationship must be governed by a contract where appropriate.
2. Scope
This Policy applies, among others, to:
- https://rooklyn.co
- https://clima.rooklyn.co
- https://aureaclima.rooklyn.co
- forms, booking pages, demonstrations and other own channels associated with those sites.
Áurea Clima is a Rooklyn demonstration environment and does not necessarily constitute an independent HVAC company.
3. Data we may process
3.1 Identification and contact data
- First and last name.
- Company and job title or professional role.
- Email address.
- Telephone number.
3.2 Data relating to requests and business relationships
- Type of business and services of interest.
- Information voluntarily supplied in forms or communications.
- Dates and times of meetings, demonstrations or bookings.
- Messages and communication history relating to the request.
- Data needed for proposals, quotations, contracting, invoicing and support where a contractual relationship exists.
3.3 Technical and browsing data
- IP address and connection data.
- Browser type, device and operating system.
- Date and time of access.
- Usage and browsing information where appropriate.
Where these data are obtained through non-essential cookies or technologies, consent will be requested when required.
4. Purposes and legal bases
| Purpose | Data / activity | Main legal basis |
|---|---|---|
| Handling enquiries and requests | Responding to forms, emails and requests for information | Pre-contractual steps requested by the data subject and, depending on the circumstances, a legitimate interest in handling professional communications. |
| Managing demonstrations and meetings | Arranging requested calls, demos and appointments | Pre-contractual steps requested by the data subject. |
| Sales management and CRM | Recording contacts, opportunities and follow-up history | Pre-contractual steps; a legitimate interest in managing professional relationships where applicable. |
| Providing services | Contract management, support, invoicing and administration | Performance of a contract and compliance with legal obligations. |
| Commercial communications | Information about services, solutions and news | Consent where necessary, or the legal basis applicable to existing relationships under the relevant rules. |
| Security and operation | Fraud prevention, security, maintenance and technical diagnostics | A legitimate interest in maintaining system security and operation; legal compliance where appropriate. |
Where processing is based on consent, the data subject may withdraw it at any time without affecting the lawfulness of processing before its withdrawal.
5. Forms and mandatory data
Fields marked as mandatory are necessary to handle the relevant request. If they are not provided, it may not be possible to respond to the request or provide the requested functionality.
The data protection information displayed alongside forms supplements this Policy. Where consent is requested for an optional purpose, such as certain commercial communications, it will be presented separately and will not be pre-selected.
6. Data retention
Data will be kept for as long as necessary to fulfil the purpose for which they were collected and, subsequently, for the periods during which legal liabilities may arise.
- Enquiries and business opportunities: while there is interaction or a reasonable prospect of a business relationship, and afterwards for the period necessary to address possible liabilities or requests.
- Customers: during the contractual relationship and afterwards for the applicable statutory periods.
- Consent-based commercial communications: until consent is withdrawn or the right to object is exercised, without prejudice to retaining the evidence necessary to demonstrate the preference or consent.
7. Recipients and technology providers
Rooklyn may use providers that process data to deliver technology services necessary for its business. Depending on the actual configuration of each site or service, these may include:
- Web hosting, DNS, security and content delivery providers, including Cloudflare when active.
- GoHighLevel / HighLevel for CRM, forms, automations, opportunities and communications.
- Email and calendar providers.
- Messaging providers, including WhatsApp/Meta when that channel is used.
- Infrastructure, automation or artificial intelligence providers that are necessary to provide specific functions and are properly configured.
Rooklyn does not sell personal data. Where a provider acts as a data processor, the relationship will be governed in accordance with applicable requirements. Data may also be disclosed where there is a legal obligation.
8. International transfers
Some technology providers may be established or process data outside the European Economic Area. Where an international transfer is subject to the GDPR, a valid mechanism will be used, such as an adequacy decision, standard contractual clauses or another safeguard recognised by applicable rules. You can request further information about the applicable safeguards using the email address specified in this Policy.
9. GoHighLevel and forms
Certain Rooklyn forms and processes may be integrated with GoHighLevel / HighLevel. Information supplied may be added to the CRM to handle requests, contact the data subject, schedule demonstrations or meetings, manage follow-ups and retain the communication history relating to the request.
10. Áurea Clima and demonstration environments
Áurea Clima is a sales demonstration environment used to show examples of automation and management applicable to the air-conditioning and HVAC sector. Data entered into active demonstration forms will be processed under this Policy when Rooklyn receives them for its own purposes.
Users must not enter particularly sensitive data, health data, confidential third-party information or real customer data that are unnecessary for the demonstration.
11. Automated decisions and profiling
Rooklyn may use automations to classify requests, create tasks, assign statuses or facilitate internal follow-ups. Unless expressly stated otherwise, these automations are not used to make decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them.
12. Data subjects’ rights
Where applicable, you may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent where processing is based on it.
To exercise your rights, you can write to geet29.dubey@gmail.com with “Data protection” in the subject line and provide the information necessary to identify the request. We may request additional information where reasonably necessary to verify the requester’s identity.
13. Complaint to the supervisory authority
If you believe the processing of your personal data infringes the rules, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), whose information and procedures are available at https://www.aepd.es.
14. Security
Rooklyn will implement appropriate technical and organisational measures, taking into account the nature, scope, context and purposes of processing and the level of risk. No system connected to the Internet can guarantee absolute security.
15. Third-party data
Anyone supplying third-party data must have a lawful basis for doing so and provide only the information necessary for the relevant purpose.
16. Minors
Rooklyn services are primarily intended for businesses and professionals. We do not intend to knowingly collect minors’ data through commercial forms or demonstrations.
17. External links
The websites may contain links to third-party pages or services. Their privacy practices are governed by their own policies and terms.
18. Cookies
Information about cookies and similar technologies is contained in the Cookie Policy available at https://rooklyn.co/politica-cookies.
19. Changes to this Policy
Rooklyn may update this Policy when processing activities, providers, services or regulatory requirements change. The date of the latest update will appear at the beginning of the document.