Privacy Policy

1. Controller

The controller of the data described in this policy is:

• Controller: [RAZÓN SOCIAL]
• Tax ID (NIF): [CIF]
• Address: [DOMICILIO SOCIAL]
• Contact email: [EMAIL DE CONTACTO]
• Email for data protection matters: [EMAIL DE PRIVACIDAD]
• Data protection officer: [DELEGADO DE PROTECCIÓN DE DATOS — si procede]

2. Who this policy applies to

This policy applies to the data that Vecta 360 processes as controller, namely that of:

• workspace owners and the members who access them;
• customer representatives and contact persons, for the purposes of the contractual relationship and billing;
• people who contact Vecta 360 through the contact form, by email or by other means;
• people who visit the Vecta 360 website and public pages hosted on the platform, such as virtual tours.

3. Data processed on behalf of customers

Vecta 360's customers enter into the platform data about their own clients, contacts, stakeholders, employees and patients, and may invite their clients to a client portal. For that data, the Vecta 360 customer is the controller and Vecta 360 acts solely as processor, following its instructions and in accordance with the processing agreement included in the Terms of Service.

People whose data is held in Vecta 360 in this way, including those who access the client portal of a business or professional, should contact that business or professional to obtain information about the processing or to exercise their rights. If Vecta 360 receives such a request, it will forward it to the relevant customer.

4. Data processed

Depending on each person's relationship with Vecta 360, the following categories of data are processed:

• Account data: name, email address, access credentials, profile picture if added, and preferred language. Passwords are stored in protected form and never in readable text.
• Workspace data: organisation name, members, roles, permissions and settings.
• Subscription billing data: name or company name, tax ID, billing address, plan subscribed to and payment history. Card details are handled by Stripe; Vecta 360 does not store them.
• Technical and usage data: IP address, browser and device type, date and time of access, technical activity logs, and error and performance reports.
• Communications data: the content of enquiries sent through the contact form or by email and of support communications.
• Integration data, only if the user enables them: the authorisations and calendar data needed to sync Google Calendar, and the browser subscription identifiers needed to send push notifications.
• Data obtained through cookies: as described in the Cookie Policy, including a random visitor identifier used to count unique views of virtual tours.

5. Purposes and legal bases

Vecta 360 processes this data for the following purposes, each with its legal basis under Article 6(1) GDPR:

• Creating and managing accounts and workspaces, providing the service and sending the communications needed for it, such as security notices, invitations, reminders and changes to the service. Legal basis: performance of the contract (Article 6(1)(b)). For members invited by a customer, the basis is performance of the Terms they accept on joining (Article 6(1)(b)) and the legitimate interest of Vecta 360 and the customer in enabling the organisation to use the service it has subscribed to (Article 6(1)(f)).
• Managing the subscription, payments and billing, and complying with tax and accounting obligations. Legal basis: performance of the contract (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c)).
• Responding to enquiries received through the contact form or by email. Legal basis: taking pre-contractual steps at the request of the data subject (Article 6(1)(b)) or the legitimate interest in replying to those who contact Vecta 360 (Article 6(1)(f)).
• Ensuring the security of the service, preventing fraud and unauthorised access, and detecting and fixing errors through technical monitoring. Legal basis: the legitimate interest of Vecta 360 and its customers in a secure and working service (Article 6(1)(f)).
• Syncing Google Calendar and sending push notifications when the user enables these features. Legal basis: performance of the contract, as these are features requested by the user (Article 6(1)(b)). The authorisation can be revoked at any time.
• Counting unique views of virtual tours and their multimedia content. This purpose and the cookie it uses are described in the Cookie Policy.
• Establishing, exercising or defending legal claims. Legal basis: the legitimate interest of Vecta 360 (Article 6(1)(f)).

6. Whether data is mandatory, and automated decisions

Name and email address are required to create an account, and billing details are required to take out a subscription and meet tax obligations. If they are not provided, the service cannot be provided. Other data is optional or is generated through use of the service.

Vecta 360 does not take decisions based solely on automated processing that produce legal effects concerning people or similarly significantly affect them.

7. Retention period

Data is kept while the account is active and, after the account is closed or the contract ends, for [PLAZO DE CONSERVACIÓN], to allow the data to be exported and any issues to be dealt with. Once that period has passed, it is deleted.

Where a law requires certain data to be kept, such as billing data under tax and commercial legislation, it is kept blocked for the statutory period, available only to judges, courts and competent authorities, in accordance with Article 32 LOPDGDD.

Technical and error logs are kept for the limited time their security and diagnostic purposes require. Contact enquiries are kept for as long as needed to deal with them and, where applicable, for the duration of any business relationship that results from them.

8. Recipients of the data

Vecta 360 does not sell personal data or disclose it to third parties for advertising purposes. It does not use third-party analytics or advertising tools.

Data may be disclosed to public authorities, judges and courts where there is a legal obligation to do so.

To provide the service, Vecta 360 uses the following providers, which process data as processors or sub-processors under a contract. This same list is the list of sub-processors referred to in the Terms of Service:

• Supabase: database and authentication. Hosting region: [REGIÓN DE SUPABASE].
• Cloudflare: file storage (R2) and network, content delivery and security services.
• Stripe: collection of subscription fees and of payments made through the client portal. Stripe processes card data and, for certain purposes of its own, such as fraud prevention, acts as an independent controller under its privacy policy.
• Email delivery provider: [PROVEEDOR DE CORREO].
• Server hosting provider: [PROVEEDOR DE ALOJAMIENTO].
• SigNoz: error and performance monitoring, hosted at [PROVEEDOR/UBICACIÓN DE SIGNOZ].
• Google: only if the user connects Google Calendar, for access authorisation (OAuth) and calendar sync.
• Browser push notification services (Google, Apple and Mozilla): only if the user enables push notifications, to deliver them to their device.
• Spanish Tax Agency (AEAT): receives invoice records when a customer uses the invoice submission feature of the Verifactu system, as well as the information Vecta 360 must report under its own tax obligations. It is not a provider to Vecta 360, but a public authority that receives the data under a legal obligation.

9. International transfers

Some of the providers listed belong to groups headquartered outside the European Economic Area (EEA) or may process data outside it, in particular in the United States. This may be the case for Cloudflare, Stripe, Google, push notification services and, depending on the hosting region, Supabase, as well as for the providers yet to be specified in this policy.

Where an international transfer takes place, it is based on one of the safeguards provided for in Chapter V GDPR: an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for entities that have signed up to it, or standard contractual clauses approved by the Commission, together with any supplementary measures that are appropriate.

Further information about these safeguards can be requested at [EMAIL DE PRIVACIDAD].

10. Data subjects' rights

Anyone whose data Vecta 360 processes as controller may exercise the following rights:

• Access: to know whether their data is being processed and obtain a copy.
• Rectification: to correct inaccurate data or complete incomplete data.
• Erasure: to request deletion of the data where, among other reasons, it is no longer necessary for the purposes for which it was collected.
• Objection: to object to processing based on legitimate interest, on grounds relating to their particular situation.
• Restriction: to request that processing be restricted in the cases provided for by law.
• Portability: to receive the data they have provided in a structured, commonly used format, or to have it transmitted to another controller, where processing is based on consent or a contract and carried out by automated means.
• Withdrawal of consent: where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of prior processing.

11. How to exercise these rights and lodge a complaint

These rights can be exercised free of charge by writing to [EMAIL DE PRIVACIDAD] and stating the right being exercised. If there are reasonable doubts about the identity of the person making the request, Vecta 360 may ask for the additional information needed to confirm it.

Vecta 360 will respond within one month of receiving the request. That period may be extended by two further months where necessary, given the complexity or number of requests, and the extension will be communicated within the first month.

If the data subject considers that the processing of their data does not comply with the law, they may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), at www.aepd.es, or with the supervisory authority of the European Union Member State in which they reside.

12. Minors

Vecta 360 accounts are intended for adults acting in a business or professional context.

Data about minors that a customer enters into the platform, for example about its patients, is processed on behalf of that customer, which is responsible for obtaining the authorisation of their legal representatives where required.

13. Security

Vecta 360 applies technical and organisational measures appropriate to the risk to protect data against loss, alteration or unauthorised access, such as role- and permission-based access control, logical separation of each workspace's data, encryption of communications and technical monitoring of the service.

14. Changes to this policy

Vecta 360 may update this policy. The date of the last update appears at the top of the document. Where changes are significant, they will be communicated by email or in the application.