Privacy policy

1. Data controller

The controller responsible for processing your data is:

• Owner: Diego Márquez Aguilar (self-employed)
• Email: info@runelab.es

2. Data we collect

When you fill in the contact form we collect:

• Name
• Email
• Company (optional)
• Message
• Connection IP address (for anti-spam protection and technical traceability)
• Submission date and time

We do not collect special-category data. We do not use tracking or marketing cookies — only the technical `NEXT_LOCALE` cookie to remember your language preference (no consent required per AEPD guidance).

3. Purpose of processing

Your data is used exclusively to:

• Reply to your enquiry and maintain subsequent commercial communication if it arises.
• Comply with legal obligations if the communication leads to a contractual relationship.

It is not used for newsletters, profiling, automated decision-making, nor shared with third parties for marketing purposes.

4. Legal basis

Processing is based on:

• Your consent when submitting the form (Art. 6.1.a GDPR).
• Pre-contractual measures requested by you (Art. 6.1.b GDPR) when your message is an enquiry about our services.

5. Retention period

We retain the form data for the duration of the commercial conversation and afterwards for a reasonable period to handle related follow-up enquiries (maximum 3 years from the last contact). If the enquiry leads to a contract, statutory retention periods apply (tax and commercial — up to 6 years in some cases).

6. Recipients

Your data is only accessible to runelab's internal owners (Diego and Mario). It is not shared with third parties except for the following processors, all located in the European Economic Area:

• IONOS SE (Germany) — mailbox provider where we receive your message.
• Hetzner Online GmbH (Germany) — hosting provider where the form data is stored on a server.

No international transfers outside the EEA take place.

7. Your rights

You may exercise the following rights at any time by emailing info@runelab.es with subject «GDPR» and proving your identity:

• Access to your data.
• Rectification if inaccurate.
• Erasure when no longer needed.
• Restriction of processing.
• Portability of your data.
• Objection to processing.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, https://www.aepd.es) if you consider that the processing does not comply with the law.

8. Security

We apply reasonable technical and organizational measures to protect your data: HTTPS connection with a Let's Encrypt certificate, storage on a server with restricted access, SMTP authentication over TLS, no sharing with third parties beyond the processors listed above.

9. Changes to this policy

This policy may be updated to reflect legal changes or changes in how the site operates. The version in force is always the one published on this page, with the last-updated date shown at the top of the document.