Privacy information for the EquipSpan website and application.

1. Controller and contact details

The data controller is Jose Ciscar Garcia, Spanish VAT identification number ES52746465J, with address at Carrer Frare Lluis Amigo, 16 - 8, Torrent (Valencia), Spain. Privacy enquiries and requests to exercise data-protection rights may be sent to info@equipspan.com.

2. Categories of personal data

When a person submits the support form, EquipSpan processes the name, reply email address, optional account email and workspace name, selected topic, subject and message provided. For security, administration and evidential purposes, EquipSpan also records a request identifier, timestamp, IP address, browser user-agent and the version of this Privacy Notice accepted with the submission.

When a person uses a secure customer-request link, EquipSpan processes the summary and description of the issue, the reporter’s name and the email address or telephone number provided, together with the destination workspace, customer location, request reference, timestamps and limited security records. The secure link does not disclose the service company’s equipment register or internal notes.

The historical validation questionnaire is closed and no longer accepts submissions. Confirmed historical records remain subject to the privacy information accepted at the time of collection.

3. Purposes and lawful bases

Support data is processed to identify, investigate and respond to the request, protect the service and retain an appropriate support record. Where applicable, processing is necessary to take steps at the requester’s request or to perform the service agreement under Article 6(1)(b) GDPR. In other cases, processing is based on the controller’s legitimate interests in providing, securing and documenting product support under Article 6(1)(f) GDPR. Privacy and deletion requests may also be processed to comply with a legal obligation under Article 6(1)(c) GDPR.

Customer-request data is processed so that the named installation or maintenance business can receive, assess and follow up the reported issue. That business acts as controller for its customer-service purposes, while EquipSpan processes the application record on its behalf. Enquiries concerning the purpose or retention of a particular customer request should therefore be addressed first to the named service business.

Limited server logs are processed for the operation, security and diagnosis of the website and application on the basis of the controller’s legitimate interests under Article 6(1)(f) GDPR.

4. Historical research confirmation

The archived research programme relied on consent under Article 6(1)(a) GDPR. A submission was counted only after the work email address had been confirmed through a private link. Confirmation links expired after 48 hours, and unconfirmed records were deleted automatically.

5. Recipients and processors

Personal data is not sold. It may be disclosed to service providers acting on behalf of the controller and only to the extent necessary to provide and secure the relevant service. Those providers currently include Contabo GmbH for VPS hosting and Google Workspace for the equipspan.com mailbox and authenticated email delivery.

6. International transfers

Google Workspace may process service data using infrastructure located outside the European Economic Area. Where an international transfer requires appropriate safeguards, Google applies the mechanisms set out in its Google Workspace Cloud Data Processing Addendum, including the European Commission Standard Contractual Clauses where applicable. The location of the VPS hosting service and the safeguards applicable to it are governed by the controller’s agreement with Contabo.

7. Retention periods

Support requests are retained for as long as necessary to respond to and follow up the issue and are deleted from the active support store no later than two years after submission. A proportionate longer period may apply where preservation is required for a legal dispute, security incident or binding legal obligation. Historical unconfirmed research submissions expired after 48 hours; confirmed research records follow the retention period stated in the notice accepted at collection. Customer-request records are retained in accordance with the instructions and account lifecycle of the named service business. Encrypted or access-restricted operational backups expire within 14 days, so data removed from active records is eliminated from those routine backup copies as they expire. Routine security logs are retained for no longer than 14 days unless an identified incident requires proportionate longer preservation.

8. Data-subject rights

Subject to the conditions laid down by applicable law, data subjects may request access, rectification, erasure, restriction of processing or portability, and may object to processing. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Requests may be sent to info@equipspan.com. The controller may request information reasonably necessary to verify the applicant’s identity. Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

9. Required information and automated decisions

The reply email, topic, subject, message and acknowledgement of this Privacy Notice are required to receive and answer a support request. Name, account email and workspace name are optional, although omitting relevant account details may delay identification of the affected workspace. EquipSpan does not make decisions based solely on automated processing that produce legal or similarly significant effects on the data subject.

10. Cookies, analytics and secure links

The public website does not use advertising cookies. Google Analytics 4 is loaded only after consent to analytics cookies and is used to measure aggregate visits and interactions, not for advertising personalisation. A secure customer-request link uses temporary browser session storage to preserve the private link after it has been removed from the address bar. That session value is removed after a successful submission. The secure request page does not load third-party analytics.

11. Amendments to this notice

Material amendments will be published on this page with an updated version date. Personal data will not be processed for a new purpose that is incompatible with the purposes stated here on the basis of an existing consent.