Privacy policy

Data controller

Controller: Bitcar Home SL
Tax ID: B22657662
Address: Calle Picapedreros, 2 — 14029 Córdoba (Córdoba), Spain
Email: regifactu@agoraflor.es
Data Protection Officer: None has been appointed, as none of the cases in Article 37 of the GDPR apply. For any data protection queries: regifactu@agoraflor.es

This policy explains what personal data we process, why, on what legal basis, for how long, and your rights. It complies with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on Personal Data Protection and the guarantee of digital rights (LOPDGDD).

Enquiries sent via the contact form

Data we collect. What you enter in the form: name, email and message (required), and, if you choose to provide them, phone number and subject. Three technical details are stored with your message: submission date and time, browser identifier (user-agent) and an encrypted, irreversible value calculated from your IP address. We do not store your IP address in plain text: only a cryptographic hash (SHA-256 with a secret key) is stored. It can detect bulk submissions but cannot reconstruct the original IP.

Please do not include special category data (health, beliefs, trade union membership,…

Professional area (private access)

Data. Identification and professional contact details you provide when requesting access and those held in your account: first and last name, email, company represented, job title, company tax details, phone number, and access logs (login date and time).

Purpose. To set up your account, authenticate access, provide the contracted service and manage our business relationship.

Legal basis. Performance of the contract or steps taken at your request before entering a contract (GDPR Art. 6.1.b), compliance with the company’s legal obligations (GDPR Art. 6.1.c) and our legitimate interest in…

Technical and security logs

The server hosting the site generates technical operating logs —service start-ups, errors and warnings— solely to maintain security, diagnose issues and prevent attacks. These logs may capture the IP address used for a request if it causes an error or triggers a security measure. Legal basis: legitimate interest in ensuring network and information security (GDPR Art. 6.1.f, recital 49). Retention: 90 days.

They are not used to build browsing profiles or combined with data you provide through the form.

Who we share your data with

We do not share your personal data with third parties or sell it, and we do not use it for profiling or third-party advertising.

Form messages are not forwarded by email to any external inbox: they are stored directly on our own infrastructure, without an email provider.

Only the providers needed to deliver the service can access them as processors, under a contract signed in accordance with GDPR Article 28:
· Hosting and infrastructure provider: Amazon Web Services (AWS), eu-south-2 region (Spain)

No other processors are involved in the processing described in this policy: we do not use…

International transfers and automated decisions

We do not transfer data outside the European Economic Area. All infrastructure supporting this site and the message inbox is hosted in the hosting provider’s Spain region, as noted above. If we add a provider involving an international transfer, we will state this here along with the safeguard used: an adequacy decision, standard contractual clauses or other measure.

We do not make automated decisions that have legal or similarly significant effects on you, or create profiles. The form’s anti-spam check is our own: a signed token sent with the request, with no cookies, no browser storage…

Your rights

You can exercise these rights at any time:
· Access: find out what data we process about you.
· Rectification: correct inaccurate or incomplete data.
· Erasure: ask us to delete data when it is no longer needed.
· Objection: object to processing based on our legitimate interest.
· Restriction: ask us to suspend processing while a complaint is resolved.
· Portability: receive your data in a structured, commonly used format.
· Withdraw consent at any time, without affecting the lawfulness of earlier processing.

To exercise your rights, email regifactu@agoraflor.es or write to Calle…

Security, minors and changes

We apply technical and organisational measures appropriate to the risk: HTTPS encryption with HSTS across the site, session cookies with HttpOnly, Secure and SameSite=Strict attributes, protection against request forgery, IP addresses stored only as cryptographic hashes, user-level access controls for inbox data, and information backups.

This site is for professionals and businesses. We do not knowingly collect data from children under 14. If we find any, we will delete it.

Our cookie and browser storage use is explained in the cookie policy (/cookies).

We may update this policy when laws…