1. Contact data
When a person submits a form or contacts Databilidad, we may process name, company, email, message, reason for contact and any information voluntarily included.
This data is used to answer the query, prepare a demo, send requested information, manage a proposal or maintain the pre-contractual or commercial relationship initiated by the person.
2. Technical and security data
We may record minimum technical information needed for security, abuse prevention, service availability and incident diagnosis, such as date, requested route, technical events, form status or required navigation metadata.
For visits to the public website, the IP address is currently used only transiently in memory to curb abusive requests; new web telemetry rows do not retain the IP, its hash or network prefix, though they may retain approximate location (country, region and city). Some historical web records created before this change may retain a pseudonymized IP hash and network prefix (/24 for IPv4, /64 for IPv6), together with that location, for up to 12 months; this change does not rewrite those records and they remain subject to their retention period. Producer-app telemetry and its security records may retain a pseudonymized IP hash and network prefix tied to the session. The full IP address is never kept as a permanent record.
From that approximate location, producers can view, for their own products only, aggregated statistics by country, region and, when visit volume is high enough, approximate city or town. They never see the record of an individual visit: that city- or region-level breakdown is only shown once a product has received a minimum number of visits, and visitor groups too small to distinguish safely are merged into one combined category or, if still too small, withheld entirely -- specifically to reduce the risk that a single visitor could be singled out within that data.
This is combined with QR-code scans on batch pages: the batch's public identifier, timestamp, browser/device, and whether the scanned code was valid or had been revoked.
These logs are processed with minimization and restricted access criteria.
3. Producer app analytics and telemetry
The producer app (web and mobile) sends the same analytics systems used by the public consumer website minimal screen-view events and technical error reports, for strictly operational purposes: understanding real tool usage and detecting failures.
These data come from producers themselves using the app in the course of their work with Databilidad, not anonymous visitors of the public site. Their legal basis is Databilidad's legitimate interest in operating and improving its own tool, with no cookie consent required (no third-party cookies or advertising profiling are involved).
The app requests device permissions solely for its own features: camera, for photos and videos of products and batches uploaded directly to the producer's catalog; microphone, only for the audio of those videos; and files/storage, to import CSV/XLSX catalogs and select photos or videos already on the device. The session credential is stored in the device's secure system storage (Android Keystore) and never leaves it except to authenticate requests with Databilidad's servers.
4. Usage statistics
Databilidad may collect website usage statistics to understand content performance, detect errors and improve the experience. Our basic measurement records visits and visible page sections, together with a session identifier and broad device, source and approximate location data; these records are retained for up to 12 months.
With analytics consent, we add detailed events for clicks, scrolling, media and visible time per section. Optional events are retained for up to 12 months, the persistent browser identifier lasts at most 13 months, and Google Analytics is loaded only with consent. When consent is withdrawn, optional measurement stops and that identifier is cleared; consent is requested again after 12 months.
5. Legal bases
Form processing relies on consent and, when the person requests information, a demo or a proposal, on pre-contractual measures. Technical security may rely on legitimate interest.
Non-essential cookie-based analytics only runs with consent.
6. Retention and deletion
Contact requests are retained for the time needed to answer and manage the relationship. As a general criterion, they are kept for up to 12 months if no contractual relationship begins, unless law, deletion request or liability evidence requires otherwise.
Other categories, subject to the same exceptions: website analytics, QR-code scans and producer-app telemetry are kept up to 12 months; internal technical diagnostic logs up to 6 months; the compliance audit trail up to 24 months; infrastructure backups are rotated every 90 days.
Anonymized or aggregated statistics may be retained for longer when they no longer identify a natural person.
7. Processors and providers
Hosting, email, security, analytics or infrastructure providers may participate in operating the website. When they access personal data, they act under Databilidad's instructions and confidentiality obligations.
8. Rights and contact
You may request access, rectification, erasure, objection, restriction, portability or withdrawal of consent by writing to databilidad.com/contacto. A person on the team always resolves these requests, never an automated system.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.