Privacy Policy VULPIS BOX SL

This Privacy Policy describes how Vulpis Box, S.L. (hereinafter, “the Company”), located at calle Alcalá 105 1ºD - 28009 Madrid, collects, uses, protects and, where applicable, shares the personal data of users of our Software as a Service (SaaS) SmartER, in accordance with Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), and the Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data Controller

• Company Name: Vulpis Box S.L.
• Address: Calle Alcalá, 105 1ºD 28009 Madrid
• Tax ID: B88.480.652
• Email: [email protected]

2. Personal Data Collected

• Identification data: Name, surname, email address, phone number, and postal address.
• Payment data: Information necessary to process payments, such as bank or credit card details.
• Usage data: Information on how users interact with the service, such as IP addresses, browsing data, preferences, and settings.
• Technical data: Information about the device used, such as browser type, operating system, and screen resolution.

3. Purpose of Data Processing

Personal data will be processed for the following purposes:

• Provision of the SmartER monitoring service, including user account management and technical support.
• Payment processing and billing.
• Improvement of service functionality and security through usage analysis.
• Compliance with legal obligations, such as tax requirements or anti-money laundering regulations.
• Sending of commercial communications, subject to the user's express consent.

4. Legal Basis for Processing

The processing of personal data is based on:

• The execution of the SaaS service agreement.
• The user's express consent, when necessary (e.g., for commercial communications).
• Compliance with legal obligations.
• The Company's legitimate interest, such as service improvement or fraud prevention.

5. Data Sharing

Personal data may be shared with:

• Service providers necessary for the delivery of the SaaS, such as hosting providers or payment processors, who will act as data processors.
• Competent authorities, when required by law.

6. International Transfers

If data is transferred outside the European Economic Area (EEA), the Company will ensure an adequate level of protection by means of:

• Standard contractual clauses approved by the European Commission.
• International agreements that ensure an equivalent level of protection.

7. Data Retention Period

Personal data will be retained for as long as necessary to fulfill the purposes described, and thereafter for the periods established by applicable regulations (for example, tax obligations or liability limitation periods).

8. User Rights

Users have the right to:

• Access their personal data.
• Request the correction of inaccurate data.
• Request the deletion of their data, where applicable.
• Object to the processing of their data under certain circumstances.
• Request restriction of processing.
• Request data portability.
• Withdraw their consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, users may contact the Company at: <a href="mailto:[email protected]">[email protected]</a>. The Company will respond within a maximum of one month.

9. Security Measures

The Company adopts appropriate technical and organizational measures to ensure the security of personal data, including:

• Encryption of data in transit and at rest.
• User authentication through secure passwords and, when applicable, two-factor authentication.
• Internal access controls to data.
• Periodic security audits.

10. Use of Cookies

The VULPIX SmartER service uses cookies and similar technologies to enhance the user experience, analyze service usage, and, where applicable, personalize content. For more information, see our Cookie Policy.

11. Complaints

If users believe that the processing of their data does not comply with the regulations, they can file a complaint with the Spanish Data Protection Agency.

12. Policy Updates

The Company may update this Privacy Policy to reflect regulatory changes or changes in the operation of the service. Users will be notified of updates via their contact email or through a notice in the service.

Madrid, May 30, 2025.