Privacy Policy

Controller: Jesús Morán Morán (Tax ID 44789317Z), owner of Descarboniza.es.

Address: Calle Villafranca 77, 06200 Almendralejo (Badajoz), Spain.

Contact email: hola@descarboniza.es

No Data Protection Officer has been appointed, as it is not legally required. For any privacy-related query, please write to the address above.

Depending on your relationship with the platform, we may process:

• Account and identification data: name and email address. If you register with Google, we receive basic profile information (name and photo). Authentication is handled by Clerk.
• Payment data: if you take out a paid plan, the payment is processed by Stripe. We do not store your card details.
• Newsletter subscription data: your email address, if you subscribe (managed via MailerLite).
• Browsing and usage data: IP address, cookie identifiers, pages visited and usage events, via Google Analytics and Vercel's infrastructure.
• Communications: the content of messages you send us via forms or email.
• Data on directory companies and professionals: sector information obtained from public sources, which may include personal data of professionals (see section 9).
• First-party usage measurement (cookie-free): when you use the Vega tools, the site itself records which control you pressed, on which page and how many times, together with a random session identifier that lives only in that browser tab. If you have an account, we also store a salted hash of your user identifier, which lets us count how many distinct people use each tool without knowing who they are. We use no cookies for this, we never store the contents of the fields you fill in, and we do not track you outside our own site.
• Requests to contact technicians: name, email, optional phone and message, property reference and address, X-ray summary and a record of consent.

• Creating and managing your account and providing you with the platform's services — performance of a contract (Art. 6.1.b GDPR).
• Processing payments and issuing the corresponding invoices — performance of a contract and compliance with legal obligations (Art. 6.1.b and c).
• Sending you the newsletter and commercial communications — your consent (Art. 6.1.a).
• Analysing platform usage through analytics cookies — your consent (Art. 6.1.a).
• Ensuring security, preventing fraud, and maintaining and improving the sector directory — legitimate interest (Art. 6.1.f).
• Handling your requests and complying with legal obligations — legitimate interest and legal obligation.
• Understanding which parts of Vega are used and which are not, so we can decide what to build and what to fix — legitimate interest (Art. 6.1.f), through aggregated, cookie-free first-party measurement.
• Managing your contact request and sharing it with technicians in your area — your consent (Art. 6.1.a). You may withdraw it by writing to hola@descarboniza.es. This does not subscribe you to marketing communications.

We do not sell or rent your personal data. To provide the service we rely on providers that process it on our behalf (data processors), with whom we maintain contracts in accordance with Art. 28 GDPR:

• Clerk — Clerk, Inc. (USA). Authentication, login and user account management. Privacy policy.
• Stripe — Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA). Processing of subscription payments. We do not store card data. Privacy policy.
• Airtable — Formagrid, Inc. (USA). Hosting of directory and form data. Privacy policy.
• MailerLite — UAB «MailerLite» (Lithuania, EU). Sending the newsletter and communications to subscribers. Privacy policy.
• Vercel — Vercel, Inc. (USA). Web hosting, CDN and technical activity logs. Privacy policy.
• Resend — Resend (USA). Sending transactional emails (verification, service notices). Privacy policy.
• Google — Google Ireland Ltd. / Google LLC. Google Analytics (usage measurement) and Google login. Privacy policy.

If you request contact from a technician and tick the consent box, we share your contact details, property data and X-ray summary with up to ten studios or rehabilitation companies in the directory covering your area and holding an active or trial plan. There may be several recipients; the request is not exclusive. Descarboniza keeps the request to handle it, including when it cannot forward it to a technician.

We may also disclose data to public authorities or bodies where there is a legal obligation to do so, and to advisors or providers to the extent necessary to manage our relationship with you.

Some of these providers are located outside the European Economic Area, mainly in the United States. Such transfers are carried out with the appropriate safeguards provided for under the GDPR: Standard Contractual Clauses approved by the European Commission and/or the providers' certification under the EU-US Data Privacy Framework (European Commission adequacy decision). You may request information about these safeguards at hola@descarboniza.es.

• Account data: for as long as your account remains active. After you request account closure, we delete or anonymise it within a maximum of 30 days, unless we are legally required to retain it.
• Billing data: 6 years, in accordance with commercial and tax regulations.
• Newsletter: until you withdraw your consent (unsubscribe).
• Browsing and analytics: for the retention period configured in the analytics tool (generally up to 14 months).
• Requests and communications: for as long as necessary to handle them and for the statutory limitation periods for any potential liabilities.
• First-party usage measurement: 24 months at most. Vega usage events are deleted automatically once that period is reached.

You may exercise, at any time, your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as withdraw any consent you have given (without affecting the lawfulness of processing prior to withdrawal), by writing to hola@descarboniza.es. We may ask you to verify your identity.

If you believe we have not processed your data correctly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.

We use our own and third-party cookies. Non-essential cookies (for example, analytics cookies) are only activated with your consent, which you may grant, manage or withdraw at any time. You will find further detail in our Cookie Policy.

Descarboniza maintains a directory of sustainable-construction companies and professionals. Part of this information comes from publicly available sources (corporate websites, registers and published environmental declarations) and may include personal data of professionals, such as a contact name. The legal basis for this processing is our legitimate interest in offering a useful sector directory. If you appear in the directory and wish to rectify your data or object to its inclusion, write to us at hola@descarboniza.es and we will address it.

The platform is not directed at persons under 14 years of age and we do not knowingly collect their data. If we discover that we have processed the data of a minor under that age without the corresponding authorisation, we will delete it.

We apply appropriate technical and organisational measures (encryption in transit, access controls, and providers with recognised security standards) to protect your data against unauthorised access, alteration, disclosure, loss or destruction.

We do not make decisions based solely on automated processing, nor do we create profiles, that produce legal effects concerning you or similarly significantly affect you.

We may update this policy. We will publish the version in force on this page and indicate the date of the last update; material changes will be communicated where appropriate.

For any question about this policy or about the processing of your personal data, write to us at hola@descarboniza.es.