Privacy Policy

Last updated: February 2026

1. Data Controller

2. Data We Collect

We collect the following categories of personal data:

• Account data: Name, email address, password (encrypted), phone number (optional).
• Payment data: Processed by Stripe. We do not store credit card numbers. Stripe acts as an independent data controller for payment processing.
• Technical data: IP address, browser type, operating system, access logs, for security and service delivery.
• Contact form data: Name, email, message content, submitted voluntarily.
• Service usage data: Hosting resource usage, bandwidth, storage, for billing and capacity planning.

3. Legal Basis for Processing

• Contract performance (Art. 6.1.b GDPR): Processing necessary for providing hosting services you have contracted.
• Consent (Art. 6.1.a GDPR): For contact form submissions, newsletters, and non-essential cookies.
• Legitimate interest (Art. 6.1.f GDPR): Security monitoring, fraud prevention, service improvement.
• Legal obligation (Art. 6.1.c GDPR): Tax and accounting records as required by Spanish law.

4. Data Retention

• Account data: For the duration of the service contract + 5 years (Spanish commercial law).
• Invoicing data: 5 years (Spanish tax law, Ley General Tributaria).
• Contact form data: 12 months from submission, unless a commercial relationship is established.
• Access logs: 12 months (LSSI-CE Art. 12).
• Cookies: As specified in our Cookie Policy.

5. Data Recipients

Your data may be shared with the following third parties, solely for the purposes described:

• Stripe, Inc. — Payment processing (US, EU-US Data Privacy Framework certified).
• Google LLC — Google Fonts for web typography (no personal data transferred beyond IP address in HTTP requests).
• Let's Encrypt (ISRG) — SSL certificate issuance (domain names only).

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

6. Your Rights (GDPR Articles 15-22)

You have the following rights regarding your personal data:

• Right of access: Obtain confirmation of whether we process your data and receive a copy.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your data when no longer necessary.
• Right to restriction: Request limitation of processing under certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise your rights, send an email to privacidad@enginerit.com with a copy of your ID document. We will respond within 30 days.

7. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):

8. Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including: encrypted data transmission (TLS/SSL), encrypted password storage, access controls, regular security audits, and intrusion detection systems.

9. Changes to This Policy

We may update this privacy policy periodically. Any significant changes will be communicated via email or through a notice on our website. The date of the last update is indicated at the top of this page.