Data controller
- Controller
- CIVIA.CLOUD, SOCIEDAD LIMITADA
- Contact
- info@civia.cloud
If a data protection officer is appointed in future, their contact details will appear on this page.
Two different roles
CIVIA.CLOUD, SOCIEDAD LIMITADA is the controller of the data processed on this public site and in email communications. However, for the data that a town council, provincial council or other organisation processes within the platform (case files, population register, registry, users), that organisation is the controller, and CIVIA.CLOUD, SOCIEDAD LIMITADA acts as processor under Article 28 of Regulation (EU) 2016/679 (GDPR), in accordance with the data processing agreement signed with each organisation. To exercise your rights over that data, contact the relevant organisation.
What data we process and why
| Processing activity | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Contact form and email enquiries | Name, job title, the organisation you belong to, email address, telephone number if you provide it and the content of the message. | To deal with your enquiry or demonstration request. Basis: your consent when you write to us and, if you represent an organisation, our legitimate interest in responding to a professional communication. | For as long as the conversation lasts and, afterwards, up to one year in case it needs to be resumed. |
| Access to the platform | User ID, email address, name, organisation, date and time of access and IP address. | To authenticate you and maintain your session. Basis: performance of the contract with the organisation that registered you. | While your account is active. Access logs, two years. |
| Security and technical logs | IP address, user agent, actions performed on the system. | To detect and respond to incidents and to comply with the National Security Framework (Esquema Nacional de Seguridad). Basis: legal obligation and legitimate interest in protecting the service. | Two years, unless an incident requires them to be kept for longer. |
We do not create profiles, we do not take automated decisions with legal effects on you and we do not use your data for advertising.
Recipients
We do not disclose your data to third parties unless required by law. To provide the service we use hosting and email providers that act as processors, under contracts in accordance with Article 28 of the GDPR. The platform is hosted on servers in the European Union.
This website and its contact form are served through the Cloudflare network, which may process technical connection data, such as the IP address, on servers located outside the European Economic Area. These transfers are covered by the safeguards required by the GDPR, such as the European Commission’s standard contractual clauses.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@civia.cloud with the subject “Data protection”. We will reply within one month. If you believe we have not dealt with your request, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.
Security
We apply technical and organisational measures aligned with the National Security Framework (Esquema Nacional de Seguridad): encrypted communications, permission-based access control, isolation of each organisation’s data, logging of actions and backups. No measure is infallible; if we detect a breach affecting your data, we will notify it as required by law.
Changes to this policy
We will update this policy whenever the way we process data changes. The effective date shown in the index indicates the latest published version.