Privacy policy
What we collect, why we are allowed to, how long we keep it and what you can make us do about it. Written to be read rather than to be survived
01Who is responsible for your data
The controller of the personal data described here is SALVEDA, established in Barcelona, Catalonia, Spain. Full registration details are supplied on request to anyone who needs them for a contract or a complaint
Questions about your data, requests to exercise your rights and complaints about how we handle either go to hello@salveda.eu. We answer within one month, and if a request is complex enough to need longer we tell you so inside that month rather than after it
We have not appointed a data protection officer, because our processing does not meet the thresholds that require one. The founders answer these questions themselves
02What we collect
We collect two clearly separated kinds of data, and it matters which one you are looking at. Everything on this page concerns the first kind unless a section says otherwise
| Category | What it contains | Where it comes from |
|---|---|---|
| Enquiry data | Name, work email, company, telephone if you choose to give one, and the text of your message | You type it into a form or send it to one of our addresses |
| Notification data | An email address, and nothing else | You leave it to be told when access to the workstation opens |
| Technical data | Aggregate visit counts per page, and the cookie choice you made in the banner | Generated as you browse, described in the cookie policy |
| Customer data | Account details of the people who use the platform, and the product data they enter | Your organisation, under a contract, see section 04 |
We do not ask for and do not want special categories of data: health, beliefs, trade union membership, biometric or genetic data have no place in an enquiry about a shelf life. If you send them to us anyway we delete them
03Why we use it, and on what legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Answering your enquiry and arranging a walkthrough | Enquiry data | Your consent, and steps taken at your request before a contract |
| Telling you when access to the workstation opens | Notification data | Your consent |
| Counting how many people read a page | Technical data, in aggregate | Your consent, given in the cookie banner |
| Keeping the site working and secure | Technical data, strictly necessary only | Our legitimate interest in a site that functions |
| Providing the platform to a customer organisation | Customer data | Performance of the contract with that organisation |
| Meeting accounting and regulatory obligations | Contract and billing records | Compliance with a legal obligation |
Where the basis is consent you may withdraw it at any time, and withdrawing it is as easy as giving it: one line to hello@salveda.eu is enough. Withdrawal does not affect the lawfulness of what we did before you withdrew
We do not use your data to build a profile of you, we do not sell it, and we do not pass it to advertising networks. There is no automated decision-making that produces legal effects for you
04Data inside the platform
When your organisation uses the SALVEDA platform, that organisation is the controller of the data it puts in and we act as its processor under a written agreement. We process it on documented instructions and for no purpose of our own
Recipes and process data
Recipes, physico-chemical measurements and control results are a trade secret and are treated as one. They are isolated per customer, encrypted in transit and at rest, and accessible only to the people that customer has authorised
When your data improves the models
Anonymised data may enter the training set that calibrates a category, and only where a contract with your organisation provides for it. Anonymised here means that neither the company, the product item nor the recipe can be reconstructed from what enters that set
Records that cannot be altered
A calculation record is immutable by design, because a dossier issued today must still be reproducible when an inspector returns to it in two years. That protects you as much as it protects us, and it means a deletion request over platform data is handled through your organisation rather than through this page
05How long we keep it
| Data | Kept for | Then |
|---|---|---|
| Enquiries that did not become a contract | 24 months from the last exchange between us | Deleted |
| Notification addresses | Until access opens, or until you unsubscribe | Deleted |
| Records of the consent you gave | As long as we may need to prove it | Deleted |
| Aggregate visit counts | 14 months | Deleted |
| Contract, billing and accounting records | The period Spanish law requires | Deleted |
| Customer data in the platform | The term of the contract, plus the agreed return period | Returned or deleted, as the contract says |
06Who else sees it
We keep the list of processors short on purpose. Each one acts on our instructions under a written agreement, and none of them may use your data for anything of their own
- A hosting provider, for the website and the platform
- An email provider, for the correspondence between us
- An accounting provider, for invoices and statutory records
We disclose data to a public authority only where the law obliges us to, and where we are permitted to tell you that it happened, we tell you
Where the data sits
Data is stored inside the European Economic Area. If a transfer outside it ever becomes necessary, it will rest on an adequacy decision or on standard contractual clauses with supplementary measures, and this page will say so before the transfer starts
07Your rights
Under the General Data Protection Regulation and the Spanish data protection law you may ask us to
- Confirm and show what data about you we hold and what we do with it
- Correct anything inaccurate or incomplete
- Delete your data where we no longer have a basis to keep it
- Restrict processing while a dispute about accuracy or basis is resolved
- Receive the data you gave us in a portable, machine-readable form
- Object to processing based on our legitimate interest
- Withdraw consent at any time, for anything based on consent
Write to hello@salveda.eu with what you want and the address you contacted us from. We do not charge for this, we do not demand a copy of an identity document unless we genuinely cannot identify you otherwise, and we answer within one month
If you think we have handled your data badly, we would rather hear it first and fix it. You are entitled either way to complain to the Spanish Data Protection Agency at aepd.es, or to the supervisory authority of the country where you live or work
08How we protect it
Security here is a design constraint rather than a paragraph. Encryption in transit and at rest, isolation of every customer circuit, access granted by role and reviewed, logging of access to customer data, backups that are actually tested, and providers chosen for where they store data rather than for their price
No system is beyond reach. If a breach occurs that is likely to put your rights at risk, we notify the supervisory authority within seventy-two hours and tell the people affected without undue delay, in plain language and with what we know at the time
09Children
This site and this product are addressed to businesses and to the professionals who work in them. They are not directed at children, and we do not knowingly collect data from anyone under fourteen. If you believe a child has sent us data, write to us and we will delete it
10Changes to this policy
When the way we handle data changes, this page changes with it and the date at the top moves. If a change materially affects you and we hold an address for you, we write to you rather than relying on you noticing
Earlier versions are kept and are available on request, so that you can see what applied at the time you dealt with us