Privacy Policy
Last updated: June 2026
1. Data controller
In accordance with the Reglamento (UE) 2016/679 General de Protección de Datos (RGPD) and Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD), we inform you that the controller of your personal data is:
- Company name:
- Duvalis Consulting SL
- CIF:
- B02740959
- Registered office:
- Calle Pere IV, 120, 08005 Barcelona
- Contact email:
- contact@duvalisconsulting.com
2. Personal data we process
Through the Qualimatch platform we process the following categories of data:
- Identification data: first name and surname.
- Contact data: email address and telephone number (the latter optional).
- Professional data (consultant): food certification standards they are proficient in, years of experience, working arrangement, languages, location and professional summary.
- Platform activity data: projects posted (consultancies), applications made and application messages (consultant).
- Technical session data: information needed to keep the session authenticated, managed through Supabase technical cookies.
We do not process special categories of data (health data, political opinions, racial origin, etc.).
3. Purpose and legal basis for processing
We process your data for the following purposes and on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Managing registration and access to the platform | Performance of the contractual relationship (art. 6.1.b RGPD) |
| Connecting consultants with consultancies through projects and applications | Performance of the contractual relationship (art. 6.1.b RGPD) |
| Sending service-related communications (confirmations, notifications) | Legitimate interest of the controller (art. 6.1.f RGPD) |
| Complying with legal and tax obligations | Compliance with a legal obligation (art. 6.1.c RGPD) |
4. Disclosure of data to third parties
Your personal data will not be disclosed to third parties except where legally required or in the following cases inherent to the operation of the service:
- Consultants who apply for a project: the consultant's profile and contact data (name, email, phone if provided, standards, experience, languages and application message) will be visible to the consultancy that posted the project they are applying for. This disclosure is necessary for the operation of the service and the user accepts it when applying.
- Technology providers: we use Supabase (Supabase Inc.) as our database and authentication provider, acting as a data processor under contract with appropriate safeguards.
We do not carry out international data transfers outside the European Economic Area without appropriate safeguards.
5. Retention period
We will keep your data for as long as your account remains active. If you request the deletion of your account, we will delete your data within a maximum of 30 calendar days, unless there is a legal obligation to keep it for a longer period (for example, 5 years for tax and commercial obligations under Spanish law).
6. Your rights
Under the RGPD, you have the right to:
- Access: find out what personal data we process about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure ("right to be forgotten"): request the deletion of your data when, among other cases, it is no longer necessary for the purposes for which it was collected.
- Objection: object to the processing of your data in certain circumstances.
- Restriction of processing: ask us to restrict the use of your data in certain cases.
- Portability: receive your data in a structured, commonly used format in order to transmit it to another controller.
To exercise any of these rights, send an email to contact@duvalisconsulting.com stating the right you wish to exercise and attaching a copy of your identity document. We will respond within a maximum of one month.
If you consider that the processing of your data does not comply with the RGPD, you have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD), the competent supervisory authority in Spain.
7. Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction, including encryption of communications (HTTPS), secure authentication and role-based access control.
8. Changes to this policy
We may update this Privacy Policy to reflect regulatory or service changes. We will notify you of any relevant changes by email or through a visible notice on the platform.