Privacy policy

Who is responsible for your data

[TO CONFIRM: registered company name], trading as Idcare Digital, operates this website and is the data controller for the personal data described below.

We have not designated a Data Protection Officer. [TO CONFIRM: whether a DPO is designated — if one is, their contact details must appear here.]

What this site collects, and what it does not

This website has no accounts, no login, no analytics, no advertising and no third-party scripts of any kind. It sets no cookies today. The only thing it keeps on your device is your answer to the consent banner, and that answer travels to no server. A CRM and a marketing tool are planned; when they are connected they will run only if you allow them in that banner. See the cookie policy.

There are exactly two ways personal data reaches us through this site.

1. The enquiry forms

Two forms — Request a demo and Request a quote — collect what is needed to answer a professional enquiry:

Purpose. To read your enquiry and reply to it. Nothing else. We do not add you to a mailing list, we do not profile you, and we do not pass your details to anyone outside the recipients named below.

Legal basis. Article 6(1)(b) of the GDPR — processing necessary for steps taken at your request prior to entering into a contract. You asked us a commercial question; answering it is the processing. [TO CONFIRM: your adviser may prefer Article 6(1)(f), legitimate interest, for enquiries that are exploratory rather than pre-contractual. Both are defensible; the policy should name the one you rely on.]

Recipients. The submission is delivered as a single email to two addresses inside the company: info@idcaredigital.com and filipi@idcare.es.

Where it is stored. Nowhere. This is not a figure of speech and it is worth being precise about: the component that receives the form validates it, sends one email, and returns. There is no database, no queue, no customer relationship system and no log entry containing your name or address. The only copy of your enquiry is the email in our mailbox.

How long we keep it. As long as the email stays in our mailbox. [TO CONFIRM: the mailbox retention period actually configured. “As long as the email exists” is a description, not a retention policy, and a reviewer will ask for a number.]

2. Abuse prevention

To stop a script submitting the forms thousands of times, the service counts recent submissions per sender. It does this without keeping your IP address: the address is combined with a secret value and hashed, and only the hash is held — in memory, for ten minutes, on the machine handling the request. It is never written to disk and cannot be turned back into an address.

Legal basis. Article 6(1)(f) — our legitimate interest in keeping a public form usable.

Service providers

The site runs on Microsoft Azure. Microsoft acts as our processor for:

Microsoft’s own operational logs of requests to the site may include IP addresses and browser identifiers, held under Microsoft’s terms and retention rather than ours. We do not use those logs and do not connect them to anything.

The resources are deployed in Azure’s West US 2 region, except for the email sending, whose data stays in Europe. [TO CONFIRM: the contracting Microsoft entity, and that the Microsoft Products and Services Data Protection Addendum is in force for this subscription.]

We use no other processor. No analytics provider, no email marketing platform, no form service, no session recording, no chat widget, no video embedding.

Transfers outside the European Economic Area

There are some, and it is worth saying so plainly. This site’s pages are served from Microsoft Azure’s West US 2 region, in the United States. When you visit, your request reaches a server located there, and Microsoft’s operational logs of that request may include your IP address.

The transfer relies on Microsoft Corporation’s participation in the EU-US Data Privacy Framework, which the European Commission found adequate in its adequacy decision of 10 July 2023, together with the Standard Contractual Clauses in Microsoft’s Data Protection Addendum. [TO CONFIRM: that the Addendum is in force for this subscription, and the contracting Microsoft entity.]

This transfer can be removed altogether by moving the hosting to a European Union region, with no change to this site.

Your rights

Under the GDPR and Spain’s Organic Law 3/2018 you may ask us to give you access to your data, correct it, delete it, restrict or object to our use of it, and receive it in a portable form.

Write to info@idcaredigital.com. We will answer within one month. We may ask you to confirm your identity, and we will not ask for more than is needed to do that.

Two things follow from storing nothing, and they are honest rather than convenient:

• If you ask us to delete your data, we delete the email. There is nothing else to find.

• If you ask what we hold about you, the answer is the email you sent and our replies.

If you are not satisfied with how we have handled your request, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es), or to the supervisory authority in your own country.

Children

This site is addressed to library, museum and university professionals. It is not intended for children and we do not knowingly collect data from them.

Changes

Any change to this policy appears here with a new date. If a change is significant — a new processor, a new purpose, data starting to be stored — we will say what changed rather than only updating the date.