1. Applicable regulations
In short: we apply the European standard and the Brazilian one too, because we work with both markets.
- GDPR (Regulation (EU) 2016/679): applicable to individuals located in the European Union (art. 3.2) and to the controller, as it is established in Spain (art. 3.1).
- LOPDGDD (Organic Act 3/2018) and LSSI-CE (Act 34/2002), in Spain.
- LGPD (Act 13,709/2018): for operations involving individuals located in Brazil.
2. Principles we apply (art. 5 GDPR)
In short: lawfulness, fairness, transparency, minimization and accountability in every processing operation.
| Principle | How we comply |
|---|---|
| Lawfulness, fairness and transparency | Detailed Privacy Policy, information before data collection and a consent checkbox. |
| Purpose limitation | Form data is used only to handle and organize your request. |
| Data minimization | Minimal form fields; cookie-free analytics, with no session recording or heat maps; filtering of personal data in error telemetry. |
| Accuracy | You can correct your data at any time. |
| Storage limitation | Retention periods defined and published in the Privacy Policy; deletion or anonymization upon expiry. |
| Integrity and confidentiality | Technical and organizational measures described in section 7. |
| Accountability | Records of processing, periodic reviews and evidence of consent. |
3. Privacy by design and by default (art. 25)
We build privacy into our architecture and product decisions: analytics is self-hosted and cookie-free; the request management platform is our own; IP addresses are not stored in analytics; error telemetry is filtered before being sent; and personal data is never written to application technical logs.
4. Governance and accountability
- Data flow mapping for the form, analytics, telemetry and database.
- Records of processing activities (art. 30 GDPR), updated upon every relevant change.
- Periodic reviews of risks and controls, and impact assessments (DPIA) whenever a new processing operation may involve a high risk (art. 35).
- Data Protection Officer: not appointed, as the circumstances of arts. 37 GDPR and 34 LOPDGDD do not apply; contact point: security@carniattolabs.com.
- Lead supervisory authority: the AEPD, as the controller is established in Spain. There is no need to appoint a representative in the EU (art. 27 GDPR).
5. Data processors
In short: we only work with providers that sign a data protection agreement.
| Provider | Service | Safeguards |
|---|---|---|
| ia-flow (own) | Request management and classification (PostgreSQL + language model). | Direct control by the controller; EU servers; restricted access. |
| Umami (self-hosted) | Aggregated cookie-free analytics. | Own instance; no transfer to third parties. |
| Sentry | Errors and performance. | DPA (art. 28 GDPR); data in the EU region; U.S. parent company: EU-U.S. Framework or standard clauses. |
| Hetzner and OVHcloud | Site hosting. | DPA (art. 28 GDPR). |
6. International transfers
Data is hosted and processed in the European Union and is not transferred outside the European Economic Area. Should a provider with a parent company outside the EEA (such as Sentry) be able to access data, we require the safeguards of art. 46 GDPR (EU-U.S. Data Privacy Framework or standard contractual clauses) and assess the risk before contracting. Any change to these destinations will be reflected in the Privacy Policy.
7. Security and incident management
Responsible disclosure: if you find a vulnerability, you can report it through the channel indicated in our security.txt file (/.well-known/security.txt).
- Prevention: HTTPS, least privilege, secure secrets management, dependency updates and environment separation.
- Detection: error monitoring and access logs, with limited retention.
- Response: internal security breach management procedure, with notification to the AEPD within 72 hours where applicable (art. 33 GDPR) and communication to affected individuals if there is a high risk (art. 34). For individuals in Brazil, notification to the ANPD and to data subjects in accordance with art. 48 of the LGPD.
- Record-keeping: all incidents, including non-notifiable ones, are documented.
8. Individuals' rights
In short: we handle your requests within defined timeframes and keep a record of each one.
- Exclusive channel: security@carniattolabs.com.
- Timeframe: response within one month (extendable by two further months in complex cases, with a reasoned notice).
- Identity verification that is proportionate and free of charge; we only charge for manifestly unfounded or excessive requests (art. 12.5 GDPR).
- Traceability: every request, decision and response is recorded.
9. Artificial intelligence
We use a language model (Gemma 4, via Ollama, on EU servers) solely for the initial qualification of contact requests (section 4 of the Privacy Policy). We apply transparency, minimization (name and message only), human oversight — replies and proposals are drafted by a person — and no automated decision-making with legal effects. We will review this use in light of Regulation (EU) 2024/1689 (the AI Act) and applicable data protection law.
10. Individuals in Brazil (LGPD)
For data subjects located in Brazil, we process data under the legal bases of art. 7 of the LGPD (consent, execution of preliminary procedures related to a contract, and legitimate interest) and we recognize the rights under art. 18 (confirmation, access, correction, anonymization, portability, deletion, information about sharing and withdrawal of consent). The contact channel for these requests is the same one indicated above; you may also turn to the ANPD (www.gov.br/anpd).
11. Supervisory authorities
- Spain: Spanish Data Protection Agency (AEPD) — www.aepd.es.
- European Union: the supervisory authority of your EU member State of residence.
- Brazil: National Data Protection Authority (ANPD) — www.gov.br/anpd.
12. Review
We review this page at least once a year and whenever our processing operations, providers or the applicable regulations change.