Privacy policy

Basic information

1. Who is the controller?

Minery Report, S.L., Tax ID (NIF) B88058615, with its registered office at Paseo de la Castellana 115, 10th floor left, 28046 Madrid, Spain. You can write to us at contacto@mineryreport.com or call us on +34 91 904 97 88.

Data Protection Officer. We have a Data Protection Officer, whose appointment has been notified to the Spanish Data Protection Agency and is listed in its public register. You can contact the Officer about any matter relating to the processing of your personal data or to the exercise of your rights, by writing to dpo@mineryreport.com.

2. What data do we process, why and on what legal basis?

2.1. Contact form and enquiries by email or phone

Data: name, company, email address, phone number, the content of your message and, if you tell us, how you heard about us and your company size (in bands of employee numbers).

Incident reports (/incidentes/): company, phone number, what you tell us and, if you give it, an email address so we can send you the acknowledgement. Without an email address we do not send one.

Purpose: to handle your enquiry or report, to send you an automatic acknowledgement, to prepare a proposal and to keep the thread of the commercial conversation, which includes noting its follow-up in our internal sales management tool (for example, whether we have had a first meeting).

Acknowledgement: an automatic email to the address you give us, only to confirm that we have received your enquiry or report and to explain what happens next. It does not repeat anything you wrote, it has no marketing content and it does not depend on you accepting marketing communications. The same address receives at most one acknowledgement of each type per day. If you did not submit the form, you can ignore it.

Legal basis: pre-contractual measures at the data subject's request (Art. 6(1)(b) GDPR). Where the enquiry is not aimed at contracting, the basis is our legitimate interest in replying to the person who writes to us (Art. 6(1)(f) GDPR).

Retention: for as long as the conversation lasts and for up to 12 months from the last contact if no contract is entered into. They are then erased, after first being blocked for the limitation periods of any claims that might arise.

2.2. Earlier self-assessment (evalua.mineryreport.com)

Data: your email address, your company, your role, the size and sector of the company, what brought you to the test (if you tell us), your phone number (if you give it), the language, the answers you give to the questionnaire and its result (score, level and assessment of people, processes and technology).

Purpose: to generate and email you the personalised report with your risk level for people, processes and technology; to record your request in our internal sales management tool so we can discuss the result with you if you ask; and, only if you tick the corresponding box, to send you a series of up to six emails during the four weeks after the test with next steps and useful content, signed by our CEO. For now that series exists only in Spanish: if you take the test in English, you do not receive it.

Legal basis: performing your request (Art. 6(1)(b) GDPR) for the report and for the contact you ask for. The email series is based on your consent (Art. 6(1)(a) GDPR and Art. 21(1) of Spain's LSSI), which you give with its own box, unticked and separate from the privacy box. If you do not tick it, we do not send you that series.

Withdrawal and unsubscribing from the series: you can unsubscribe from any email in the series (see section 2.3) and the series stops immediately. If you retake the test without ticking the box, we treat that as withdrawal of that consent and we also stop it. The unsubscription is final for that series: while we keep the record of the unsubscription (3 years from the recorded unsubscription date; if you ask again, that date is renewed; section 2.3), a later test does not restart it even if you tick the box again.

Retention: 12 months from when we receive your first test, unless you enter into a contract with us or ask us to erase it earlier. Proof of your consents (date, box text and version of this policy) is kept for as long as we keep your test data. If you unsubscribe or withdraw that consent, we also record it in our suppression list (section 2.3), which is kept even if we erase your test data earlier.

What we do not do with that data: we do not disclose it, we do not match it with third-party files and we do not use it to build marketing profiles that are sold or shared. The test result is produced by a fixed scoring algorithm and has no legal effects and does not significantly affect you: it is not an automated decision under Article 22 GDPR. It is a guidance assessment, and it is presented as such. If you receive the email series, we use your role, what brought you to the test and your sector only to choose which version of the series (one for management and one for IT or cybersecurity leads) and which examples we send you: it is simple segmentation, not an automated decision with legal effects. The links in those emails carry campaign parameters (utm_…) with no personal data, which our web analytics records only if you accept analytics cookies.

2.3. Marketing communications

Data: name, company and email address.

Purpose: to send you information about our services, regulatory news relevant to your sector and our own content and, if you asked for it in the Evalúa test, the email series described in section 2.2. The Regulatory Radar newsletter has its own section (2.4).

Legal basis: your express consent (Art. 6(1)(a) GDPR). If you are already a client, our legitimate interest in telling you about services similar to those you contracted, under Article 21(2) of Spain's LSSI.

Retention: until you withdraw consent or unsubscribe. You can do so with the unsubscribe link in each email (one click, no login), with the “Unsubscribe” option of your email program when it offers it, by replying “baja” to the email or by writing to contacto@mineryreport.com. Unsubscribing is free and takes effect immediately. If our system fails when you use the unsubscribe link, we show you an error and the unsubscription is not treated as done: you can try again or write to us. If you ask us by another channel (email or phone) not to receive some or any of our marketing communications, a person on our team records it in our internal tool and, from that moment, we do not send you the communications your request covers. If you were subscribed to the newsletter and the request includes it, at that same moment we also complete your unsubscription as a subscriber (unless there is a failure, in which case the team repeats it), and the retention period for your newsletter data runs from the date it is completed (section 2.4).

Suppression list: so that we do not write to you again after an unsubscription, we record it in a list shared by all our marketing communications (the Regulatory Radar newsletter, the Evalúa email series, the Evalúa 2.0 six-month reminder, news from the checks and any other). In this list we do not store your email address: only a hash calculated from it with a secret key, from which your address cannot be derived, the type of communication you unsubscribed from (one of them or all), the date and the channel of the unsubscription. Before each automatic marketing send (each issue of the newsletter, each email in the Evalúa series, each six-month reminder and the newsletter invitation) we check that list, even if we have already erased the rest of your data; if we cannot check it, we do not send. Legal basis: to comply with our duty to respect your unsubscription or objection (Art. 6(1)(c) GDPR, in relation to Arts. 21 and 22 of Spain's LSSI) and our legitimate interest in being able to demonstrate it (Art. 6(1)(f) GDPR). Retention: 3 years from the recorded unsubscription date for each type of communication (if you ask to unsubscribe again, that date is renewed), the limitation period for the most serious data-protection infringements; each day we automatically erase the entries that exceed that period. If you later want to receive the newsletter again, you only need to subscribe again and confirm it from your email: that confirmation, later than the unsubscription, prevails. The Evalúa series, by contrast, does not restart even if you tick its box again while we keep the unsubscription (section 2.2).

2.4. Regulatory Radar newsletter

Data: your email address, the language you chose and, as proof of your consent, the date and time of the request and of your confirmation, the version of this policy in force at that time, the exact text you accepted, the place on the website from which you subscribed and, if you subscribed on the website, a hash of your IP address calculated with a secret key (we do not store the IP address). If we invite you because you ticked it on the contact form, we also store the reference of that enquiry.

Purpose: to send you, at most once a month, the Regulatory Radar: cybersecurity regulatory news with its official source, a piece of our own content and an invitation to contact us. It is a marketing communication.

Legal basis: your express consent (Art. 6(1)(a) GDPR and Art. 21(1) of Spain's LSSI). You give it by ticking a box that is unticked by default and you confirm it from the link we email you (double confirmation); the confirmation page shows the exact text you accept. Without that confirmation we do not send you any issue. If you ticked the box “I would like to receive news and content from Minery Report” on the contact form, we do not subscribe you: at most we send you once that same confirmation email, and you are only subscribed if you confirm it.

How to unsubscribe: with one click on the link in each email (no login needed), with the “Unsubscribe” option of your email program or by writing to contacto@mineryreport.com. Unsubscribing is free and takes effect immediately for any send we have not yet handed to our email provider; if there is a failure at that moment, you will see an error and the unsubscription is not treated as done: you can try again. If you unsubscribe in the seconds when your issue is going out, you may receive that last email, but none after it.

Retention: while you remain subscribed. If you do not confirm a subscription requested on the website, we erase the request after 30 days. If you do not confirm the invitation sent after the contact form, we keep that request for 12 months (the same period as your enquiry) only so that we do not offer it to you again. So that we never invite you more than once and so that we can limit confirmation emails (at most 6 per address in 30 days), we store a hash of your address calculated with a secret key, not the email address: the invitation hash, permanently; the hash of each confirmation email, for 30 days. When you unsubscribe (including if you ask us by another channel) we stop sending you the Regulatory Radar and we keep, blocked, your email address, the proof of consent and the unsubscription date for 3 years from the unsubscription, the limitation period for the most serious data-protection infringements, only to show that we acted with your consent and so that we do not write to you again; after that period, a daily automatic process erases them. The unsubscription is also recorded in the suppression list (section 2.3).

What we do not do: we do not disclose your email address, we do not match it with other sources and we do not use it for advertising profiles.

2.5. Job applications

Data: whatever you include in your CV and in the message you send us.

Purpose: to assess your application in open selection processes.

Legal basis: pre-contractual measures at your request (Art. 6(1)(b) GDPR).

Retention: 12 months from receipt, so that we can consider you for later processes. If you prefer us to erase it earlier, tell us and we will.

We do not ask for special-category data (health, trade-union membership, political opinions, ethnic origin) in selection processes. If it appears in your CV on your own initiative, we will not use it to assess the application.

2.6. Browsing the website

Data: IP address, device and browser identifiers, pages visited and similar data collected by cookies and similar technologies.

Purpose: so that the site works and is secure; and, only if you consent, to measure its use, to measure the effectiveness of our advertising campaigns and to show you Minery Report ads on other sites and platforms that are part of the Google network (remarketing) if you have already visited this website.

Legal basis: legitimate interest in the security and operation of the site for technical cookies (Art. 6(1)(f) GDPR); your consent for analytics and advertising cookies (Art. 6(1)(a) GDPR).

Microsoft Clarity: we use it to understand use of the public website through interaction metrics, heatmaps and session reconstructions (clicks, scrolling, pages and technical browser data). It is switched on only with prior consent and strict masking of the content; the technical identifiers are not necessarily anonymous. It is not planned to install it in NOVA or in our test environments.

Metricool (cookieless visit measurement): to know, in aggregate, how many visits the public website receives and which pages are viewed, we use Metricool's visit counter. Each time you open a page, your browser sends Metricool the page address, the referring page if your browser provides it, the browser window size and, as with any connection, your IP address and technical browser data. Those addresses may only carry campaign parameters (utm_…), the click identifier added by advertising platforms and, on the contact page, the service or sector from our list that you are asking about (for example, servicio=pentesting or sector=salud). That visit is not sent if either address carries any other parameter, a fragment (“#…”), a service that is not on our list, a sector that is not either, a value or a path containing “@” or a value of more than 200 characters. According to Metricool, the IP address is used only during the connection to infer the country and is not retained. This tool does not set cookies or store information on your device, does not assign you identifiers and only gives us aggregated statistics; that is why it works even if you reject cookies. It is not used in NOVA, on equipo.mineryreport.com or in our test environments.

Legal basis for Metricool: our legitimate interest in knowing, in aggregate, how our website is used so that we can improve it (Art. 6(1)(f) GDPR). You can object by writing to dpo@mineryreport.com or by blocking the domain tracker.metricool.com in your browser.

Our own server-side visit count. When serving a public page, the server adds a visit if the request passes the browsing and bot filters. It uses the path, the approximate country provided by Vercel and the referral category inferred from the request. It only keeps totals by day, page, country and category; it does not store IP address, browser or Referer in those totals. It does not set cookies or identifiers and does not require JavaScript for this count. Internal browsing that does not request a document from the server is not counted. The bot filter does not guarantee that every false visit is excluded. Vercel and Supabase take part as hosting and database providers. Before the beacon is switched on, a 13-month retention will apply to these totals, with daily deletion of the days before that period (up to one extra day because of the purge schedule). This period allows a full year to be compared and will be reviewed annually. Automatic retention is still to be implemented.

Future beacon, currently switched off. Only if it is switched on, it would replace the server count and would also measure internal browsing. It would read the location and, on entry, document.referrer and the utm_source and utm_medium parameters; it would send the path without the query, the type of navigation and the referring domain or those parameters (up to 100 characters each). It would not read or write cookies or persistent storage, and it would not generate identifiers. Campaign parameters must not contain identifying data. Switching it on remains pending resolution of retention, the safeguards for audience measurement or the corresponding consent, and the write budget. The absence of cookies on its own does not establish an exemption.

Full detail: Cookie policy (Spanish).

2.7. Free tools (mineryreport.com/herramientas/ and mineryreport.com/en/tools/)

Our website offers free cybersecurity and compliance tools: Evalúa 2.0 (cybersecurity assessment), the email and domain check, the website check, the “Does … apply?” checks (NIS2, DORA, Spain's ENS, the Cyber Resilience Act, the AI Act, the GDPR and Spain's Law 2/2023 on whistleblowing channels), the rules map, the incident cost calculator and the supplier security assessment, in Spanish and some of them in English. You do not need an account. You can always see the basic result without giving us your email address: we only ask for it if you want us to send you a report.

This section explains what we process in each case. Section 2.2 still applies to the earlier assessment at evalua.mineryreport.com.

2.7.1. If you use a tool without requesting the report

“Does … apply?” checks, rules map, Evalúa 2.0 (while you take the test), calculator and supplier assessment. Your answers, figures or supplier details stay in your browser and we do not send them to our servers. In the checks, the map and Evalúa, your progress is stored only in that tab and is deleted after two hours, when you close the tab or when you press “Delete my answers”. In the calculator and the supplier assessment, the data is held in the page's memory and is lost when you reload or leave it. If you use “Copy link” in the calculator, the link contains your figures: share it only with people who should see them. To give you the Evalúa 2.0 result, your answers (closed options, with nothing that identifies you) are also calculated on our server; see section 2.7.2 for what we keep.

Email and domain check. We process the domain you type only to run the check. If you type a full email address, we only use the domain. We look up public information: DNS records (MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, DNSSEC, CAA) and, where relevant, public files and responses for that domain (for example the MTA-STS policy, the website certificate and headers, and security.txt). We do not store the domain or the result: they are not recovered when you reload the page. The link to share the tool does not include your domain.

Website check (without a report). We process the domain to read public information from its home page and from the standard paths /.well-known/security.txt and /security.txt (HTTPS, certificate, headers and the cookies the site declares), with request limits. We do not try to access private areas or test for vulnerabilities. Without a report, we do not store the domain or the result in our database. Use it only for a website you manage or have permission to check.

Moving from a check to Evalúa. If you continue to Evalúa, we store only the domain in that browser tab so we do not have to ask you again. It is valid for two hours and is deleted once it is used; if you do not reach Evalúa, it may remain stored until you close the tab.

Abuse prevention. We limit how many checks, requests and emails can be made in a given time: for example, how many reports can be sent to the same email address per day, how many times a domain is analysed per hour (including from the same connection) or how many reports are requested from the same connection. To do this we calculate hashes: codes derived with a secret key (HMAC-SHA256) from your IP address and, depending on the tool, from your email address, the domain checked or the combination of IP address and domain. Each limit uses a different hash, and we do not store the IP address, email address or domain in clear in that record. Each hash is kept for 48 hours from the request and then deleted (at the latest by the next daily purge). Separately, we only keep daily counts of how many requests were allowed or stopped under each limit, without hashes.

Aggregate counts. We count per day how often each tool is used and what type of result it gives (for example, “NIS2: applies”). Each count is just a number per tool, day and type of event: it carries no cookies, IP address, email address, domain or any identifier, so it does not reveal who used the tool or link one use to another. That is why we do not ask for your consent to it. To prevent it from being falsified, each usage signal goes through the abuse prevention described above. In the calculator we only do this if you accept analytics cookies.

Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in providing the check you run without requiring you to register, protecting the service and third parties against abuse and understanding how the tools are used in aggregate. You can object by writing to contacto@mineryreport.com.

2.7.2. Pseudonymised copy of Evalúa 2.0

Data: when you finish the test, we store your answers and your profile (sector, company size and the other profile questions, always as closed options), the questionnaire version and your score. We do not store your IP address, email address, domain, company or any free text with them. So that this copy can be linked to your report if you request one, we also store a hash of a single-use key that only your browser holds.

Purpose: to calculate your result, improve the test and, once there is enough data, offer aggregated comparisons. Comparisons only show group counts, never individual assessments.

Legal basis: our legitimate interest in improving the test and producing aggregated statistics (Art. 6(1)(f) GDPR). You can object by writing to contacto@mineryreport.com.

Retention:

• If you request the report while your browser still holds the key, this copy is not kept separately: it is linked to your report and follows its rules (sections 2.7.3 and 2.7.6, including “Delete this report”). If it can no longer be linked (for example, because more than two hours have passed), we delete it and store a new copy with the report.
• If you do not request the report, the copy is kept for 12 months from when you finish the test. The key that links it to you is deleted after 2 hours (at the latest by the next daily purge); after that we can no longer tell which copy is yours, so we cannot locate it to handle a request about it.

2.7.3. Report by email

Data, by tool:

In all cases we also keep: the language, the date of the request and, as proof of what you were told and what you ticked, the exact text and version of the privacy information and of each box, with its date.

Purpose:

• To prepare the report, email it to you (with a PDF attached) and give you access to it through a personal link.
• To record your request in our internal sales management tool so we can organise the contacts we receive.
• To improve the rules and questionnaires with aggregated data.

Legal basis: performing your request (Art. 6(1)(b) GDPR) for the report and access to it. For organising contacts and improving the tools with aggregated data, our legitimate interest (Art. 6(1)(f) GDPR), which you can object to by writing to contacto@mineryreport.com.

Requesting a report does not subscribe you to any marketing communications. Report and management emails are transactional: they only contain what you asked for.

The result is for guidance only. It is produced by fixed rules and scoring from your answers: it has no legal effects and does not significantly affect you, and it is not an automated decision under Article 22 GDPR. It is not an audit or legal advice and does not certify compliance with any law.

2.7.4. If you ask a partner to contact you

Data: the report data and the box “I would like a partner to contact me to discuss the result”, which is separate and unticked by default.

Purpose: for a partner to call or write to you to discuss the result.

Legal basis: your request (Art. 6(1)(b) GDPR). Ticking it does not authorise marketing communications: if you had unsubscribed, that choice is still respected.

2.7.5. Communications you only receive if you ask for them and confirm

There are three, each with its own box, unticked and separate from the privacy box:

• “Does … apply?” checks: “I would like to receive news and content from Minery Report about this law”.
• Evalúa 2.0 next steps (Spanish only): a series of up to six emails with next steps after the test, depending on your role (the series described in section 2.2). You only receive it if you ask for it and confirm.
• Evalúa 2.0 six-month reminder (Spanish only): a single email, with no data from your test, so you can retake the test and compare results. It is separate from the series: you can ask for either or both.

In English we do not offer the Evalúa series or the six-month reminder. The website check and the calculator have no communications box.

Double confirmation: ticking the box is not enough. You then confirm it with the button on your report page. The confirmation link expires after 7 days and, in any case, cannot be confirmed more than 30 days after the request. Without that confirmation we send you nothing.

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 21(1) of Spain's LSSI).

Six-month reminder: it is sent from the day that falls six months after the report in which you confirmed it, between 09:00 and 19:00 (Madrid time), within a maximum period of 14 days. If it cannot be sent in that period, if you have unsubscribed or if your data has already been deleted, it is not sent. Retaking the test does not move it or extend retention.

Unsubscribing and withdrawal: every marketing email has a one-click unsubscribe link (no login needed) and supports your email program's “Unsubscribe” option. The unsubscribe link in the six-month reminder is valid for 180 days from when it is sent; after that, or at any time, you can also reply “baja” (unsubscribe), use your report management page (section 2.7.6) or write to contacto@mineryreport.com. Unsubscribing from the six-month reminder only withdraws that reminder. Unsubscribing from the series, or pressing “I don't want to receive marketing communications” on the management page, also withdraws the six-month reminder, even if it was already scheduled. Every unsubscription is recorded in the suppression list described in section 2.3, kept for 3 years from the unsubscription, even if we delete the rest of your data earlier. If you unsubscribed, ticking the box again in a later request does not reactivate those communications while we keep the unsubscription.

2.7.6. Links, managing your reports and deletion

• Report link: personal; expires after 90 days. If you forward it, the recipient will be able to see that report, but not your other reports or your management details.
• Management link: you request it with your email address and it is only sent to that inbox. It expires after 24 hours and can be used once. From the management page you can view your reports, request a new link, delete a report, close all links you have shared, withdraw the six-month reminder and stop receiving marketing communications.
• Cookies: to open the report and the management page we use technical session cookies that expire after 30 minutes (they are deleted from our database the next day). They do not measure anything. Details in the Cookie policy (Spanish).

What “Delete this report” deletes: the report and its PDF, its links, sessions and deliveries, the results stored with it (answers, figures, the domain and check result, or the linked Evalúa assessment) and also the answers, result, profile and role that had been copied to your request in our internal sales management tool. Your other reports are not affected.

Only a record of your request remains in our internal sales management tool until the 12 months are up: your email address and, if you gave them, your company, phone number and company size; proof of what you were told and accepted; and a minimal trace of the deleted report (which tool you used, how you arrived, the date of the request, whether you asked a partner to contact you and the date of deletion). We keep that trace to show that we handled your deletion request, so that a resubmission of the same request does not recreate the report, and to continue handling your contact request if you made one. If you want us to delete that record earlier too, write to contacto@mineryreport.com.

2.7.7. How long we keep the data

If you enter into a contract with us, the retention periods of that relationship apply.

2.7.8. Who has access to this data

We do not sell your data or disclose it to third parties for their own purposes. The following providers from section 4 act on our behalf:

• Vercel (hosting and running the website and tools; functions configured in Dublin, with global delivery) and Supabase (database, project configured in Ireland). There may be access from outside the EEA, with the safeguards described in section 5.
• Plus Five Five, Inc. (Resend), which sends the report, management and confirmation emails, the Evalúa series and the six-month reminder. It processes the data in the United States, with the safeguards in section 5. What leaves the EEA is your email address and the content of those emails (the report and its PDF).
• Our own team, in the internal sales management tool, only with what is needed to handle your request.

DNS lookups. To read a domain's public configuration, the checks and Evalúa 2.0 query Cloudflare's and Google's public DNS resolvers (cloudflare-dns.com and dns.google) from our servers. They only receive the domain name being looked up: we do not send them your IP address, email address or any other data about you.

In addition, the checks connect from our servers to the website or servers of the domain you look up: its owner may see those connections in their logs, but receives no data about you.

2.7.9. Analytics and session recording

• We do not record sessions in the tools. Microsoft Clarity and Metricool are not loaded on any page where you use a tool (Evalúa 2.0, the email and domain check, the website check, the “Does … apply?” checks, the rules map, the calculator and the supplier assessment) or on the report and management pages.
• Google Analytics 4, only if you accept statistics cookies, receives which tool you use, how many steps you take, the type of result and where you go next, always as values from a closed list. It never receives your email address, domain, company or answers.
• The pages where you enter your figures or suppliers, the website check pages, the report and the management page also do not load Google Tag Manager, Google Analytics or the cookie banner, and are not included in the visit count.
• Introductory pages without a form (the tools index and the landing pages of the calculator and the supplier assessment) follow section 2.6 and the Cookie policy (Spanish).

2.7.10. What we do not do

• We do not sell your data or disclose it for unrelated purposes.
• We do not subscribe you to anything because you requested a report.
• We do not store your answers, figures or supplier details unless you request a report (except the pseudonymised Evalúa 2.0 copy in section 2.7.2).
• We do not store the domain or result of the email check.
• We do not send your answers to Google Analytics or record sessions in the tools.
• We do not match your data with third-party files or use it for advertising profiles.
• Evalúa comparisons only show aggregated counts, never data about a specific person or company.

2.7.11. Your rights in the tools

In addition to section 6:

• Delete a report, close its links or stop receiving communications: from your management link (section 2.7.6), without writing to us.
• Unsubscribe from a communication: with one click from the email itself.
• Object to processing based on legitimate interest (using the tools without a report and abuse prevention, organising contacts, improving the tools, the pseudonymised Evalúa copy and the aggregate counts), and exercise access, rectification, erasure, restriction and portability: by writing to contacto@mineryreport.com or to dpo@mineryreport.com.
• You can lodge a complaint with the Spanish Data Protection Agency (AEPD) (section 6).

3. Do you have to give us your data?

No. The fields marked as required on the forms are the minimum we need in order to reply to you: if you do not provide them, we will not be able to handle the request. Everything else is optional.

4. Who has access to your data?

We do not sell your personal data. To provide our services we use the providers listed below.

Providers that process data on our behalf act as processors. Where a service processes data for its own purposes, we say so expressly.

We use Vercel to host and run the site and the panel, and Supabase for the database, authentication and files. During the transition we temporarily keep a copy of the previous system in Lovable. You can ask us for information about the providers and the safeguards that apply to their processing.

Microsoft Clarity: if you accept Statistics and Marketing, Microsoft receives browsing data as an independent controller, not exclusively on our behalf. Its terms cover its own purposes, including providing and improving its services and Microsoft Advertising. See the details and options in the Microsoft Privacy Statement. Capture starts only after your consent.

In addition, your data may be disclosed to public authorities, law-enforcement agencies and courts where there is a legal obligation.

Processing carried out on our behalf requires the processor terms provided for in Article 28 GDPR. Independent controllers are also governed by their own terms and policies, identified here.

5. Does your data leave the European Union?

The database where the form data is stored is hosted in the European Union. Even so, there is access and processing from outside the European Economic Area, which must have the safeguards of Chapter V GDPR:

Microsoft Clarity stores its data in Microsoft data centres in the United States. Its documentation identifies Microsoft Ireland Operations Limited as the counterparty for EU customers and describes Standard Contractual Clauses for transfers to Microsoft Corporation. This processing takes place only if you consent to Clarity.

• Vercel, Supabase and the temporary copy in Lovable: the configured European region does not mean that all processing is limited to the EEA. They may use infrastructure and subprocessors in other countries. The applicable safeguards are set out in the corresponding processing agreements, including, where relevant, the European Commission's Standard Contractual Clauses. You can ask us for information about those safeguards.
• Plus Five Five, Inc. (Resend), which sends the form notices, the acknowledgement, the Regulatory Radar newsletter, the email series after the Evalúa test and the reports and emails of the free tools, processes the data in the United States: your email address and, in the internal notices, what you write on the form leave the EEA for those sends. Safeguards: Standard Contractual Clauses (Module 2) and certification under the EU-US Data Privacy Framework.
• Google Ireland Limited (corporate email, analytics and advertising) processes the data in Ireland, with possible access from the United States. Safeguards: EU-US Data Privacy Framework and Standard Contractual Clauses.

If you want a copy of the safeguards applied to a particular provider, ask us and we will provide them.

6. What rights do you have?

You can exercise the following rights at any time:

• Access — to know what data of yours we process and to obtain a copy (Art. 15 GDPR).
• Rectification — to correct data that is inaccurate or incomplete (Art. 16).
• Erasure — to ask us to erase it when it is no longer needed (Art. 17).
• Restriction — to ask us to keep it but stop processing it in certain cases (Art. 18).
• Objection — to object to processing based on legitimate interest, including direct marketing (Art. 21).
• Portability — to receive the data you have provided to us in a structured, commonly used format (Art. 20).
• Withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).

How to exercise them: by writing to contacto@mineryreport.com, or directly to the Data Protection Officer at dpo@mineryreport.com, or by post to Minery Report, S.L., Paseo de la Castellana 115, 10th floor left, 28046 Madrid, Spain, stating which right you want to exercise.

On proving your identity: we will not ask you for a copy of your identity document as a matter of course. We will only ask for additional documentation if we have reasonable doubts about who is writing to us, and we will ask for the minimum needed to resolve them.

Response time: one month from receipt, extendable by a further two months if the request is complex, and we will tell you why.

Complaints: if you consider that we have not handled your request properly, or that we are processing your data unlawfully, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es). We would be grateful if you wrote to us first: if we have got it wrong, we would rather put it right.

7. How do we protect your data?

We apply technical and organisational measures under Article 32 GDPR: encryption in transit, access control on a least-privilege basis, activity logging, separation of environments and periodic reviews.

We have an information-security management system certified to ISO/IEC 27001:2022 — certificate no. CI 9765-ES, valid until 4 March 2029 — whose scope is the information systems that support software development consultancy, technical assistance and cybersecurity services. We apply those same controls to the processing of the data we receive through this website. If you need a copy of the certificate, ask us.

No measure removes the risk entirely, and we are not going to tell you otherwise. If a security breach occurs that affects your personal data and is likely to result in a high risk to your rights, we will tell you without undue delay, and we will also notify the supervisory authority under Article 33 GDPR.

8. Children

This site is aimed at professionals and organisations. We do not knowingly collect data from children under 14. If you find that a child has given us data, write to us and we will erase it.

9. Changes to this policy

We may update this policy when the processing, the providers or the law change. The current version is always the one published on this page, with its last-updated date. If the change materially affects processing based on your consent, we will tell you and, where appropriate, ask for your consent again.