Privacy policy
This policy explains how we process the personal data you provide through this website, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
1. Data controller
- Controller: Vestadium Token SL
- Tax ID (NIF): B93790137
- Address: C/ Central, 13 piso 8B. 30100 Espinardo, Murcia
- Email: info@vestadium.com
- Data protection contact: info@vestadium.com
2. What data we process
This website has no user areas and does not require an account. We only process the data you voluntarily send us through the forms and, if you accept, browsing data for analytics purposes.
| Source | Data | Required |
|---|---|---|
| Contact form | Name, email, telephone, message | Name, email and acceptance of the policy. Telephone optional. |
| Newsletter subscription | Name, email | Email and acceptance of the policy. |
| Information pack request | Name, email, telephone, message | Name, email and acceptance of the policy. Telephone and message optional. |
| Fan registration | Name, email, telephone, message | Name, email and acceptance of the policy. Telephone and message optional. |
| Analytics (only if you accept) | Cookie identifiers, pages visited, device, browser, approximate location | No. Only collected if you accept analytics cookies. |
In addition, for technical and security reasons, our hosting provider processes data such as your IP address and request information when you visit the website.
Please do not include special categories of data (health, beliefs, etc.) or third-party data in your message.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Responding to your enquiries and contact requests. | Your consent (Art. 6(1)(a) GDPR) and, where the enquiry relates to a possible contractual relationship, steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). |
| Sending you the information pack you requested. | Steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and your consent (Art. 6(1)(a) GDPR). |
| Sending you the newsletter and updates about the project. | Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time. |
| Managing your fan registration and keeping you informed about the project. | Your consent (Art. 6(1)(a) GDPR). |
| Measuring website usage with Google Analytics 4. | Your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). |
| Ensuring the security and operation of the website and preventing abuse. | The controller's legitimate interest (Art. 6(1)(f) GDPR). |
We do not make automated decisions or create profiles that produce legal effects concerning you.
4. Retention period
- Enquiries and information pack requests: for as long as needed to handle them and, afterwards, for the limitation periods of any potential legal liability.
- Newsletter and fan registration: until you withdraw your consent or unsubscribe.
- Analytics data: according to the Google Analytics retention settings, for a maximum of 14 months.
- Technical security logs: for the limited period set by the hosting provider.
Once those periods have ended, the data is deleted or blocked in accordance with Article 32 LOPDGDD.
5. Recipients and processors
We do not sell or disclose your data to third parties unless required by law. To provide the service we rely on providers acting as data processors, with whom we have signed the agreements required by Article 28 GDPR:
- Form processing provider: receives the data you submit through the forms and delivers it to us.
- IONOS: website hosting.
- Google Ireland Ltd. / Google LLC: web analytics service, only if you accept analytics cookies.
The website also loads fonts from Google Fonts. To do so, your browser connects to Google servers, which may receive your IP address.
International transfers
Some of these providers may process data outside the European Economic Area, in particular in the United States. These transfers are based on the EU-US Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission.
6. Your rights
You can exercise the following rights at any time:
- Access: find out whether we process your data and obtain a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data.
- Objection: object to certain processing.
- Restriction: ask us to restrict processing in certain cases.
- Portability: receive your data in a structured, commonly used format.
- Withdrawal of consent: without affecting the lawfulness of prior processing.
To exercise them, write to info@vestadium.com stating which right you wish to exercise. We may ask for additional information to verify your identity. We will reply within one month, which may be extended in the cases provided for in the GDPR. To unsubscribe from the newsletter, you can also use the link included in each email.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
7. Security
We apply appropriate technical and organisational measures to protect your data against loss, misuse or unauthorised access, such as encrypted communications (HTTPS) and restricted access to information. You can find more details on the security page.
8. Minors
This website is not intended for people under 18. If you are a minor, please do not send us personal data. If we find that we have received data from a minor without the necessary authorisation, we will delete it.
9. Accuracy of data
You warrant that the data you provide is accurate and agree to inform us of any changes.
10. Changes to this policy
We may update this policy to reflect legal or service changes. The date of the last update is shown at the top of the document. More information on cookies is available in the cookie policy.
Note: this text is a working template. It must be reviewed and approved by Vestadium Token SL's legal advisers before final publication.