Privacy Policy

Key information

This policy explains what personal data ArcaUnion, S.L. processes through arcaunion.com, why, and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). This is the summary; the details are in the sections below.

1. Data controller

The company's full identification details are set out in the legal notice.

2. What data we process

If you write to us through the contact form: your name and surname, company (optional), email address, the content of your message and a record that you ticked the consent box. When the form is sent, Web3Forms also logs the IP address and the date and time of submission.

If you only browse the site: Cloudflare, which hosts and protects the site, technically processes your IP address, browser and the page requested. We also obtain aggregate visitor statistics through Cloudflare Web Analytics, which uses no cookies and does not identify visitors.

Please do not include special categories of data (health, beliefs, etc.) in your message, or data about other people that is not needed for your enquiry.

3. Purposes and legal bases

We have assessed that both legitimate interests override your rights because they are limited to minimal technical data, cannot be used to identify you or build profiles, and are a use any visitor can expect from a website. You may object to them at any time (section 8).

We do not use your data to send you marketing communications or for any purpose other than those stated.

4. Retention period

• Enquiries: as long as needed to reply and, at most, 12 months from our last communication with you, unless the enquiry leads to a relationship that requires keeping them longer. If you withdraw consent or ask for erasure earlier, we delete them at that point.
• Copy held by Web3Forms: Web3Forms keeps a copy of each submission on its platform according to its own schedule, currently a maximum of three years. ArcaUnion sets the shortest period available in that service and deletes the copy when handling an erasure request.
• Technical logs and statistics: kept by Cloudflare for the limited time required for service security and for compiling the statistics, under its retention policy.

After these periods, data is deleted or, where the law requires, kept blocked solely to deal with possible legal liabilities during the applicable limitation period (Art. 32 LOPDGDD).

5. Recipients and processors

We do not share your data with third parties, except where required by law (for example, at the request of a court or public authority). To provide the service, we use the following providers, which process data on behalf of ArcaUnion as processors under a contract complying with Article 28 GDPR:

Web3Forms in turn uses sub-processors, including Amazon Web Services (hosting and email delivery), Cloudflare and Hetzner (infrastructure), and CleanTalk and Akismet (spam filtering), which receive the sender's IP address and email address.

6. International transfers

Cloudflare. Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) is certified under the EU-US Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). Its data processing agreement also incorporates the European Commission's Standard Contractual Clauses.

Web3Forms. Web3Creative operates from India, a country without an adequacy decision, and its sub-processors may process data in the United States. These transfers are covered by the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), incorporated into the Web3Forms data processing agreement that ArcaUnion accepts when signing up to the service (Art. 46(2)(c) GDPR).

Google (Gmail). Contact form messages are also received on Google's email service. Transfers to Google LLC (USA) are covered by the adequacy decision for the EU-US Data Privacy Framework and, in addition, by Google's Standard Contractual Clauses.

You can request a copy of these safeguards through the contact form.

7. Automated decisions and profiling

We do not take decisions based solely on automated processing that produce legal effects concerning you, and we do not build profiles. The Web3Forms spam filter only decides whether a submission reaches our mailbox; if you think your message has not reached us, try sending it again after a few minutes or write to us by post at our registered address.

8. Your rights and how to exercise them

You may exercise the following rights at any time:

• Access: find out whether we process your data and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Objection: object to processing based on legitimate interest.
• Restriction: ask us to keep your data without using it in the cases provided by law (for example, while we check its accuracy).
• Portability: receive the data you gave us in a structured, commonly used format.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

How: use the contact form, starting your message with "Data protection" and stating which right you wish to exercise, or send a letter to our registered address. You may act yourself or through a representative, with proof of representation.

Identification: it is usually enough to give us the details you provide when exercising your right. Only if we have reasonable doubts about your identity will we ask for the additional information strictly needed to confirm it; we do not routinely ask for a copy of an identity document.

Time limit and cost: exercising your rights is free of charge. We will reply within one month, extendable by two further months for complex requests, in which case we will let you know within the first month.

9. Complaints to the supervisory authority

If you believe we have not properly handled your rights or that your data is not being processed lawfully, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es. You may first write to us through the contact form if you prefer, so that we can try to resolve it.

10. Minors

The site and the contact form are not directed at children under 14. Under Article 7 LOPDGDD, children under that age may only give us their data with the consent of their parents or guardians. If we find that we have received data from a child under 14 without that consent, we will delete it.

11. Accuracy of data

By sending us an enquiry, you confirm that the data you provide is accurate and belongs to you or that you are authorised to provide it, and you undertake to tell us of any change. If you give us data about other people (for example, a colleague at your company), you must have informed them beforehand.

12. Security

We apply technical and organisational measures appropriate to the risk, including:

• Encrypted connection (HTTPS) across the whole site, with HSTS, which forces the browser to always use the secure connection.
• Security headers, including a content security policy (CSP) that only allows resources from the site itself and from the services listed in this policy to load.
• Data minimisation: the form only asks for the data needed to reply, and the site uses no cookies of its own, no advertising and no third-party resources such as externally hosted fonts.
• Access to enquiries limited to the people at ArcaUnion who need to see them in order to reply.

13. Cookies

The site does not set any cookies of its own. Information on the technical cookies Cloudflare may set and on cookieless audience measurement is in the cookie policy.

14. Links to other sites

This policy applies only to arcaunion.com. Third-party sites we link to have their own privacy policies.

15. Changes to this policy

We may update this policy to reflect legal changes or changes in the services we use. The date of the last update appears at the top of the page. If a change affects the processing of data you have already given us, we will tell you where the law requires it.

This is a translation for information purposes. In case of any discrepancy, the Spanish version prevails.