1. Data controller
Under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), the data controller is:
- Controller
- María Concepción García Navas
- Trading name
- Grafitto
- Tax identification number
- 77468166A
- Address
- Calle Alcalde José Herrera 18 ático, 29700 Vélez-Málaga, Málaga, Spain
- Phone
- 623102743
- Privacy email
- privacy@grafitto.es
2. Data collected
Depending on how you use this website and its services, Grafitto may process identification data, contact and professional data, billing data, customer account data, technical and operational data such as IP addresses and security logs, and information voluntarily included in enquiries or support communications.
As a general rule, special categories of personal data are not requested. If a customer enters such data into their own services, they do so under their own responsibility.
3. Purposes
- Responding to enquiries and communications.
- Managing prospective and contractual customer relationships.
- Providing, operating, monitoring, and maintaining hosting, cloud, SaaS, and technical services.
- Managing support, security, abuse prevention, and fraud prevention.
- Managing domains, billing, invoicing, and legal obligations.
- Sending essential service communications about maintenance, security, or material service changes.
4. Legal bases
Processing is based on consent, the performance of pre-contractual measures or a contract, compliance with legal obligations, and legitimate interests where applicable and legally safeguarded. Non-essential marketing communications will rely on consent or another lawful basis permitted by law.
5. Retention
Data will be kept for as long as necessary for the purpose for which it was collected and afterwards for the statutory limitation periods. Billing data will be retained for the periods required by tax and accounting law. Technical and security logs will be retained for the time necessary for security, traceability, and compliance.
6. Recipients and transfers
Data will not generally be disclosed except where legally required or necessary to provide the service. Depending on the service, infrastructure, connectivity, domain, email, backup, security, monitoring, support, billing, and payment providers may access relevant data as processors or sub-processors under appropriate agreements.
Where international transfers occur, appropriate safeguards required by applicable law will be adopted.
7. Grafitto’s role in hosting, cloud, and SaaS
Grafitto acts as controller for customer, billing, commercial, and support data. It acts as processor when it hosts or otherwise processes data uploaded by a customer according to that customer’s documented instructions. Where required, the parties will sign a data processing agreement under the GDPR.
8. Your rights
You may request access, rectification, erasure, objection, restriction, portability, or withdrawal of consent where processing is based on consent.
To exercise your rights, email privacy@grafitto.es or write to Calle Alcalde José Herrera 18 ático, 29700 Vélez-Málaga, Málaga, Spain. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.
9. Security
Appropriate technical and organisational measures are applied to protect personal data against loss, alteration, unauthorised access, and improper processing, including access controls, credential management, hardening, monitoring, backups, and incident response procedures proportionate to the risk.
10. Children
The services are not directed at children under 14. If data from a child is found to have been collected without valid authorisation, appropriate steps will be taken to delete it.
11. Changes
This Privacy Policy may be updated to reflect legal or operational changes. Users are encouraged to review it periodically.