1. Data controller
- Controller: Jesica Perez Montesino, trading as Hiddium.
- NIF: 47609330C.
- Address: Av. Enllaç, Sant Cugat del Vallés, Barcelona, 08173, España.
- Email: Hiddium <info@hiddium.com>.
2. What data may be collected
- Identification and contact details such as name, surname, email, telephone number and shipping or billing address.
- Order, payment and transaction-related information required to manage purchases.
- Information included in messages sent through the contact form or customer support channels.
- Newsletter subscription data where the user has given explicit consent.
- Minimized technical data such as the date and time, normalized page route, HTTP result, response duration, request identifier, bot classification and a truncated network prefix where it is needed for security.
The complete IP address and complete browser User-Agent are not stored in the observability platform. IPv4 addresses are truncated to a /24 network and IPv6 addresses to a /48 network before any technical record is persisted.
3. Purposes of processing
- To manage orders, deliveries, returns, customer support and invoicing.
- To comply with legal, tax and accounting obligations.
- To prevent fraud and maintain the security of the website and payment flows.
- To diagnose failures, maintain availability and produce aggregate statistics about page requests, performance and known automated crawlers.
- To send commercial communications only where the user has expressly consented to receive them.
These aggregate measurements do not use persistent analytical identifiers and cannot determine whether a person is a new or returning visitor.
4. Legal basis
- Performance of a contract for order management and customer service linked to purchases.
- Compliance with legal obligations for tax, accounting and consumer protection purposes.
- Consent for newsletter subscriptions or other optional commercial communications.
- Legitimate interest in preventing fraud, protecting network and information security, diagnosing technical incidents and understanding aggregate service performance, balanced against data minimization and short retention periods.
5. Retention periods
- Purchase-related data will be kept for as long as necessary to manage the contractual relationship and to comply with legal obligations.
- Contact data obtained through a form without any associated purchase will only be retained for as long as necessary to respond to the enquiry and no longer than needed for that purpose.
- Newsletter data will be kept until the user withdraws consent or unsubscribes.
- Operational logs are automatically deleted after 14 days. Aggregate Prometheus metrics, which contain no IP, User-Agent, user, session, order or payment identifiers, are retained for 90 days.
- A technical record may be isolated for longer only where this is necessary to investigate a specific security incident or establish, exercise or defend legal claims.
6. Recipients and international transfers
Observability data is hosted on Hiddium's own infrastructure in the European Union or European Economic Area. Access is restricted to authorized administration personnel and the European hosting provider acting as a processor. Data may be disclosed to public authorities only where legally required.
The local observability platform does not introduce international transfers or sell, share or reuse technical data for advertising or profiling.
7. User rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, where applicable, by contacting the data controller. In particular, you may object to processing based on legitimate interest.
You may also withdraw consent for commercial communications at any time by writing to Hiddium <info@hiddium.com> or using the unsubscribe option included in those messages.
You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).