Pilcore
Software accessES

Privacy policy

Last updated: 16 October 2026

1. Controller and scope of this policy

Markulia Group, S.L., Spanish tax identification number B75733832, is the controller of personal data collected through the Pilcore commercial website. Its registered office is C/ Deu i Mata 154, 4.º 3.ª, 08029 Barcelona, Spain. Its offices and correspondence address are C/ Deu i Mata 117–121, 4.º 1.ª, Oficina A, 08029 Barcelona, Spain.

For privacy matters and rights requests, contact hola@markulia.com. Pilcore sales enquiries and demo requests are handled at hola@pilcore.com. This policy covers the commercial website and related communications. Sections 9 to 14 also explain receipt and processing of delivery notes through Pilcore Delivery Notes, WhatsApp and the purchasing module, alongside the specific documentation for the contracted service.

Processing is subject to Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on personal data protection and digital rights and, for electronic communications and cookies, the LSSI.

2. Data you provide and data collected

We process the details you provide when contacting us: your name, email address, business if you choose to provide it, enquiry and subsequent correspondence. Please provide only the details needed for your request, keep them current and avoid sending sensitive information or unnecessary personal data about others.

Your name, email address and message are required in the demo request form; the business field is optional. Required fields allow us to identify and answer the request. Without them the form cannot prepare an email. You can request a demo without completing the optional field.

The form currently opens your email application with a message prepared for hola@pilcore.com. You must send it from that application for us to receive it. Entering details or opening the prepared message does not itself send the enquiry to Markulia; your email provider processes the sending of the message under its own terms.

When you access the website, its infrastructure may process technical connection data such as your IP address, browser and access time. If you accept advertising, Meta Pixel sends page visits (PageView), clicks to open the demo booking calendar (DemoBookingClick), browser identifiers and technical connection data to Meta for advertising measurement and audience creation. Clicking the calendar does not confirm a booked meeting and is not sent as a Schedule event. This integration does not send form fields. The planned use of Google Analytics 4, Meta Pixel, language preferences and cookie choices are explained in the Cookie policy.

The website loads Google Tag Manager to manage tags. This technical resource is downloaded before your cookie choice and sends Google the IP address and browser information needed to handle the connection. The currently installed container contains no measurement or Google Ads tags; loading it does not itself activate Google Analytics or grant advertising consent.

3. Purposes and legal bases

Requesting information, a demo or a quotation does not subscribe you to marketing. We do not make handling your enquiry conditional on accepting promotional messages. This website does not make decisions based solely on automated processing that have legal or similarly significant effects on you.

  • Demo requests, quotations and enquiries about contracting: handling your request, arranging a demonstration and preparing a proposal. The legal basis is taking steps at your request before entering into a contract (GDPR Article 6(1)(b)). If you represent a business, processing your professional contact details is based on our legitimate interest in handling the relationship with that business (Article 6(1)(f)).
  • Other enquiries you initiate: responding and following up on the matter raised. The basis is our legitimate interest in answering communications we receive and maintaining the professional relationship you request, taking account of your expectations and rights (GDPR Article 6(1)(f)).
  • Service delivery, if you contract: managing the agreement and communications needed to provide the service (GDPR Article 6(1)(b)), and meeting applicable legal obligations, including tax and accounting duties (Article 6(1)(c)). Specific information will be provided when you contract.
  • Marketing messages and newsletters, when offered: sending them if you have given specific consent for that purpose and channel (GDPR Article 6(1)(a)). In an existing contractual relationship, electronic messages about our own similar services may be sent using lawfully obtained contact details, based on legitimate interest and subject to LSSI Article 21(2). In either case, you can unsubscribe easily and free of charge.
  • Partner or supplier promotions, if offered: Markulia will send them only with specific permission explaining their nature. That permission does not itself authorise sharing your details with those partners. Disclosure for their own purposes requires its own information and appropriate legal basis.
  • Website statistics: Google Analytics 4 is planned to help understand visits and improve content. It will operate only after you accept analytics (GDPR Article 6(1)(a)), under the Cookie policy.
  • Advertising on Meta: measuring visits related to campaigns and creating visitor audiences to show them Pilcore ads on Facebook and Instagram, including ads with posts or videos. Meta Pixel is activated only with your advertising consent (GDPR Article 6(1)(a)). This permission is separate from analytics and can be withdrawn through “Cookie preferences”.
  • Operation and security: delivering pages, remembering choices you request and preventing or investigating faults and misuse. The basis is our legitimate interest in maintaining a secure, operational website, subject to the rules for strictly necessary technologies. We also handle rights requests and data protection obligations to comply with the law (GDPR Article 6(1)(c)).

4. Retention

When a purpose ends, data will be deleted or, where retention duties or potential liabilities require it, blocked where appropriate, with access restricted to that purpose. Data will be erased once applicable periods end. Pseudonymisation alone is not treated as deletion.

  • Enquiries and requests that do not lead to a contract: while handling the request and directly related follow-up. When it is closed or you tell us you do not wish to continue, the data will no longer be used for that follow-up, except where retention is needed for legal obligations or potential liability.
  • Contractual relationships: throughout service delivery and then for the retention and limitation periods required by the rules applicable to the documentation and liabilities arising from the relationship.
  • Marketing: while your permission remains valid or the basis permitting the messages continues to apply. Withdrawal, unsubscribing or an objection ends the messages. We may retain the minimum information needed to respect your opt-out and demonstrate that we handled your request.
  • Security logs, where they exist: only as long as needed to prevent, detect and resolve incidents or address resulting liabilities.
  • Preferences, analytics and advertising: browser storage periods are listed in the Cookie policy. Event data retention in Google Analytics is separate from cookie lifetimes; the applicable configuration must be determined and disclosed before the service is activated. Meta cookie lifetimes likewise do not determine retention of data received by Meta, whose processing is explained in its Privacy policy. Withdrawing consent stops subsequent sending by our integration; you can exercise your rights over data already processed.

5. Recipients and service providers

Access within Markulia is limited to people who need the data for the purposes described. We do not sell your data or give it to partners for their own advertising merely because you request a demo or contact us.

Providers needed for website hosting and maintenance, email and communications, technical support and administrative or customer management may access data to the extent they are involved in the relevant service. When acting on Markulia’s behalf, access is subject to a processing agreement, instructions and confidentiality and security obligations.

Google receives technical connection data when Google Tag Manager is downloaded and will provide analytics when Google Analytics 4 is activated and you have accepted its use. The Cookie policy links to its processing information. Data may also be disclosed to authorities, courts or public bodies where legally required, and to advisers where necessary to establish, exercise or defend claims, on the appropriate legal basis.

If you accept advertising, Meta receives visit and booking calendar click data sent through Meta Pixel. Meta may link it to information from its services to measure campaigns and personalise ads, under its terms and your Meta preferences. The Cookie policy links to Meta’s information and privacy controls.

6. International transfers

Some technology services may involve accessing or processing data outside the European Economic Area. In particular, the planned use of Google Analytics may involve processing by Google and its subprocessors in the United States or other countries. Meta may also process data received through its pixel internationally; its Privacy policy explains its transfers and published safeguards.

Any transfer must rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses, together with any necessary assessments and supplementary measures. Cookie consent does not replace these safeguards. Applicable transfer arrangements will be checked before new services are activated.

You can ask hola@markulia.com for information about transfers involving your data and a copy or reference to the applicable safeguards. The following links provide information published by Google and Meta.

7. Your rights and how to exercise them

Write to hola@markulia.com or Markulia Group, S.L., C/ Deu i Mata 117–121, 4.º 1.ª, Oficina A, 08029 Barcelona, Spain, describing your request and how we can respond. If there are reasonable doubts about your identity, we may request only the additional information needed to verify it. Exercising rights is free, subject to exceptional cases provided for by law.

You may complain to the Spanish Data Protection Agency (AEPD), particularly if you believe your rights have not been properly addressed. You do not have to complain to Markulia before contacting the supervisory authority.

  • Access your data and information about its use; correct inaccurate or incomplete details.
  • Request erasure or restriction of processing where the legal conditions are met.
  • Object to processing based on legitimate interest on grounds relating to your situation. You may object to direct marketing at any time.
  • Receive and transmit your data in a structured, commonly used format where the right to portability applies.
  • Withdraw consent at any time without affecting the lawfulness of earlier processing.
  • Exercise rights concerning automated individual decisions in the circumstances provided for by law.

8. Security, external resources and changes

Markulia applies technical and organisational measures designed to protect the confidentiality, integrity and availability of data, taking account of the nature and risks of processing. These measures are reviewed as the service requires; they are not an absolute guarantee against incidents.

External pages or resources you access may have their own policies. Some demos may request external resources, such as Google Fonts, allowing the provider to receive technical data needed to handle the connection. That connection does not itself mean analytics cookies are being installed.

We will update this policy when processing purposes, tools or arrangements change. If a new use requires consent, we will ask before starting it. Publishing a new version does not mean you accept additional purposes.

9. Pilcore Delivery Notes and delivery notes through WhatsApp

Pilcore Delivery Notes is Pilcore’s integration for receiving images and documents sent to WhatsApp numbers connected to a business’s purchasing module. The document is associated with the business configured for the receiving number and added to its delivery note import inbox for reading and review.

The receiving business that determines the purposes and use of its suppliers’, employees’ and contacts’ data is the controller of that processing. When Markulia provides technical processing on a client business’s behalf and instructions, it acts as processor under the applicable service and data processing agreement. Markulia remains the controller of its own contractual relationships, enquiries and communications described in this policy. Contact the receiving business or hola@markulia.com to identify who should handle your request.

Only send documents needed for purchasing management that you are authorised to share. Avoid personal data unrelated to that purpose and redact complete payment card numbers, financial account numbers, personal identity document numbers or other sensitive identifiers that should not be sent through this channel.

10. Data received and results of automated reading

Data comes from the sender and the document they send, which may contain information about other people. The business using the channel must inform those people where required. Receipt relates to events for numbers connected to the service; the sender does not need to accept advertising or analytics cookies on pilcore.com.

  • Communication data: sender’s number or identifier, receiving number, message and file identifiers, date, file name and type, text accompanying the document and content and metadata of events received from WhatsApp, including messages that do not result in a delivery note import.
  • Document content: original image or file and the information it contains, such as supplier, contact or tax identification details, delivery note number and date, products, quantities, prices, taxes, amounts, notes and signatures where present.
  • Processing data: text extracted through OCR, structured results, review suggestions and corrections, association with the business and receipt logs, statuses and errors needed to operate the integration and investigate incidents.

11. Purpose of OCR, review and use of results

Files are received, stored and read to help record and review delivery notes, link them to suppliers and items and manage the receiving business’s purchasing and stock. OCR turns document content into suggested data; it can make mistakes and must be checked before confirming its use in business records.

When a user requests AI-assisted review and the feature is configured, the original document, OCR extraction, current review and identifying details of the receiving business are sent to OpenAI to generate a review proposal. This proposal does not replace the user’s check.

The system may retain associations between recognised text and suppliers or items confirmed by the business’s users to improve suggestions for later documents within that business. This document management feature is not intended to score people or decide on their rights.

The controller business must determine and communicate the legal basis for its document management according to the relationship involved: performance of a contract with the individual, compliance with applicable obligations or legitimate interests in managing professional relationships, where appropriate. Processing on that business’s behalf follows its instructions. Sending a delivery note or reading this policy is not consent to advertising and does not by itself authorise other purposes.

12. Providers, access and international processing

Providers may process data internationally depending on the service, account and configured region. The location of the business or of a file should not be interpreted as a guarantee that all processing stays within the European Economic Area. The transfer information and the option to request safeguards in section 6 apply.

Amazon Textract’s terms allow certain uses of content to improve services unless the corresponding AWS opt-out is configured. OpenAI publishes its own API data retention and usage controls. Configuring a request or deleting data in Pilcore does not by itself mean zero retention by providers. You can request information about the conditions and controls applicable to your business’s service at hola@markulia.com.

  • WhatsApp Business Platform (Meta’s Cloud API): message transport, event notifications and downloading files sent to the connected number. This is separate from the Meta advertising pixel described for the website.
  • Amazon Web Services (AWS): storing originals in Amazon S3 and automated document reading through Amazon Textract.
  • OpenAI: generating a proposal when the assisted review available in the module is requested. This is not a mandatory step for every document received through WhatsApp.
  • The receiving business, its users with access to the feature and technology providers involved in the service, within their functions. The application requires authentication to access the inbox and obtain temporary links to originals associated with the active business, and permissions for review and deletion operations. Anyone holding one of those links can view or download the original while it remains valid; avoid sharing it with unauthorised people.

13. Retention of delivery notes and related data

Originals, OCR results and reviews form part of the receiving business’s document management. Retention must serve that purpose and any applicable legal obligations or liabilities, following the criteria in section 4 and the controller business’s instructions. Completing OCR does not automatically delete the original.

Receipt and error logs, correction associations and any backups are separate categories from the delivery note. The applicable period or criterion for each must be determined in the operation of the service; this policy does not set a uniform period or claim that general automatic purging exists. You can ask the receiving business or hola@markulia.com about retention of your data.

Retention by WhatsApp, AWS or OpenAI also depends on the relevant service’s terms and controls. Deleting a message on your device, disconnecting a number or deleting an import in Pilcore does not simultaneously remove all copies and records from every system.

14. How to request deletion of Pilcore Delivery Notes data

To request access, correction or deletion of data from this integration, email hola@markulia.com with the subject “Privacy — Pilcore Delivery Notes”. State the right you wish to exercise, the receiving business, the number you sent the document from, the receiving number and the approximate sending date or delivery note reference, to the extent you have that information. Provide a means of reply and only the information needed to locate the communication; do not resend the complete document or identity documents unless necessary to handle your request.

You can also contact the receiving business. If Markulia processes those documents on a client business’s behalf, the request is handled with the relevant controller. The rights, proportionate identity checks and option to complain to the AEPD described in section 7 apply. Erasure may be limited by retention obligations or the need to establish, exercise or defend legal claims, where applicable.

Module users with deletion permission can delete an OCR import. This removes its linked stored original and versions, together with OCR records unambiguously attributable to it that are not linked to an already created delivery note. It does not by itself delete the WhatsApp message, receipt events, correction associations, external backups or an already created delivery note or its stock movements. If your request concerns those other data, include this in your message to the privacy contact.