Privacy policy

Last updated: September 7, 2026.

Who is responsible

The controller for the data described in the next section is GMAO España, based in Spain, which operates onCMMS and GMAO.es. For anything related to your data, including exercising your rights, write to soporte@gmao.es. Registered company details (legal form, company number and registered address): to be completed.

When a company uses the application with its own data (its staff, its requesters, its contractors), that company is the controller and we act as its processor, handling the data only on its instructions. The section on customer data explains what that means.

Data we process as controller

The sign-up form

When you create an account we process: company name, your name, email address, phone number (optional), sector (optional), the message you write (optional), the page you came from on this website, and the IP address the form was sent from. We use it to create the company and its administrator user, to send the access email, and to notify our own operator that a company has signed up. The IP address and the referring page help us tell real sign-ups from automated ones.

User accounts

For each user of the application: name, email address, phone number (optional), role, company, and the date of the last login. Passwords are stored only as a hash.

Website analytics, without cookies

To know how many people visit this website we use Umami, an analytics tool we host ourselves. It sets no cookies and stores no personal data: it counts page views and a handful of button clicks (sign-up sent, log-in link, demo entry) in aggregate, with country and device type. It cannot tell who you are, it is not combined with any other data, and it is not shared with anyone. Details on the cookie notice.

Support email

If you write to us, we keep the exchange for as long as it is needed to answer you and to keep a record of the conversation with your company.

Data we process as processor for our customers

Everything a company enters in the application is that company's data: assets, requests, work orders, time entries, meter readings, photos, signatures, users and contractors, plus the audit log of relevant actions (who changed what and when). We process it only to provide the service and on the company's instructions. We do not look at it except for support, at the company's request, and access by our operator is recorded. We do not use customer data for advertising, profiling or training anything.

Purposes and legal bases

We do not send marketing email. The only messages you receive are about your account, your plan and the service.

Where the data is and who helps us

The application and its database run on a server in the European Union. Files (photos, attachments, signatures) live in private object storage reachable only through short-lived signed links. Email is sent from an EU region. As configured, there are no transfers of personal data outside the European Economic Area. The providers involved:

Analytics (Umami) runs on our own server and involves no third party. If we ever add or replace a provider that processes personal data, we update this table and inform customers in advance.

How long we keep it

• Sign-up form data of accounts that are never used: up to 12 months, then deleted.
• Data of a customer company: while the account exists, and up to 30 days after it is closed, unless a legal obligation (for example, invoicing records) requires keeping specific data longer.
• Audit logs: 24 months.
• Backups: daily copies, rotated; a deleted account disappears from them as the rotation completes.

A complete export and the deletion of a company's data are standard procedures of the service: ask, and you get the export first and the deletion afterwards.

Your rights

You can ask for access to your data, its rectification, its erasure, the restriction of its processing, its portability, and you can object to processing based on legitimate interest. Write to soporte@gmao.es from the email address linked to your account, or explain who you are if you write from another one. We answer within one month.

If your data was entered by a company that uses the application (you are one of its users, requesters or contractors), that company is the controller: address your request to it, and we will help it respond. You can also lodge a complaint with a supervisory authority: for the operator that is the Spanish Agencia Española de Protección de Datos (aepd.es); you may also contact the authority of the country where you live or work.

Security

All traffic is encrypted with TLS. Passwords are stored with strong hashing. Each company is isolated from the others at the database level. Files are only reachable through signed links that expire. Access is by role, and relevant actions are audited. Backups are daily and restores are tested. The security and data page has the full description.

Children

The service is for businesses and is not aimed at minors. We do not knowingly process data of anyone under 16 outside the context of their employment.

Changes to this policy

When this policy changes, the date at the top changes with it. Material changes are announced by email to the contact of each customer company before they apply.