Privacy policy

01 Data controller

The controller of personal data collected through this website is:

02 Personal data we collect

Depending on how you interact with Arreluna, we process different categories of data:

Contact form

• Name, email address and, optionally, your project’s website.
• The content of the message and the reason for your enquiry.

Purchase of plugins and services

• Full name or company name, tax ID and registered address required to issue the invoice.
• Email address and transaction details (product, amount, date).
• Payment data (card, etc.) is entered directly into the payment gateway and is not stored by Arreluna.

Subscription to communications

• Name and email address when you voluntarily subscribe to our communications.

Browsing

• Technical and usage data collected through cookies and similar technologies (see cookie policy), always with your consent when required.

03 Purposes and legal basis

We process your data for the following purposes under the legal bases set out in Article 6 of the GDPR:

• Handling your enquiries via the contact form or email. Legal basis: your consent when sending the message and our legitimate interest in responding.
• Managing plugin and service purchases, including licence delivery, support and invoicing. Legal basis: performance of a contract and compliance with legal obligations (tax and accounting).
• Sending commercial communications about Arreluna news, updates and products. Legal basis: your consent, or legitimate interest when you are already a customer and similar products are involved; you may object at any time.
• Analysing website usage and, where applicable, showing advertising. Legal basis: your consent given through the cookie banner.
• Complying with legal obligations and responding to requests from competent authorities. Legal basis: compliance with a legal obligation.

04 Retention periods

• Enquiries: while your request is being handled and afterwards for as long as needed to address any potential liability.
• Billing data: for the periods required by tax and accounting legislation (generally up to 6 years under the Commercial Code and tax regulations).
• Communications subscription: until you withdraw your consent or unsubscribe, which you can do at any time via the link in each email.
• Browsing data: for the periods set out in the cookie policy.

05 Recipients and data processors

We do not share your data with third parties except where legally required. To provide our services we work with providers acting as data processors who only access the data strictly necessary and with the guarantees required by the GDPR:

06 International transfers

Some of the providers listed above may process data outside the European Economic Area (for example, in the United States). In such cases, transfers are carried out under the safeguards provided by the GDPR, such as the European Commission’s Standard Contractual Clauses or, where applicable, the EU–US Data Privacy Framework for participating organisations.

07 Your rights

You may exercise the following rights over your personal data at any time:

• Access: find out what data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data when it is no longer necessary.
• Objection: object to the processing of your data in certain circumstances.
• Restriction: request that processing of your data be restricted.
• Portability: receive your data in a structured, commonly used format.
• Withdraw consent given, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise them, write to info@arreluna.com indicating which right you wish to exercise. If you consider that your request has not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

08 Data security

We apply appropriate technical and organisational measures to ensure a level of security adequate to the risk, preventing the loss, misuse, alteration or unauthorised access to personal data. The website uses encrypted connections (HTTPS/SSL) and we work with providers offering equivalent guarantees.

09 Changes to this policy

This privacy policy may be updated to reflect regulatory changes or new services. The current version will always be the one published on this website, with its last updated date indicated. We recommend reviewing it periodically.