GranOps Privacy Notice

Contact details

Post

Calle del Doctor Castelo, 15, 1.º D, 28009 Madrid, Spain

Email

privacy@granops.com

UK representative

Our representative in the UK is Michael Mihaylov Minkov, michael@metaspace.com, 14 Waldegrave Road, London W5 3HT, United Kingdom.

Data protection officer

We do not have a data protection officer. Please contact us using the details above.

What information we collect, use, and why

We collect or use the following information for your account:

• Account information, including registration details
• Information used for security purposes
• Your email address
• Emails between you and GranOps about the service

We collect or use the following information for your Organization's contract and billing:

• The name and role of the person who signs the contract
• The billing email address
• If your Organization is a sole trader: your name, tax identification number and address
• The signed contract, invoices and payments
• The card or bank account used to pay: Stripe holds it, and we see only the card's brand, last digits and expiry, or the account's last digits

We collect or use the following information to keep the service secure:

• Records of your visits, sign-ins and the emails GranOps sends you: your IP address, your browser and device, the page or email, the time and the outcome

We collect or use the following information for statistical purposes:

• Website and app user journey information
• Your country and region, your device type, browser and operating system, and a code that links your visits

We use Vercel Analytics to see, in anonymous totals, how the dashboard and the Scanner are used, so we can improve them. The dashboard and the Scanner each have their own switch in their menu to turn it off on your device.

We collect or use the following information to comply with legal requirements:

• Name
• Contact information
• Records of any data protection request or complaint you make

Lawful bases and data protection rights

Under UK and EU data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the website of the Information Commission (ICO).

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the website of the Information Commission (ICO):

• Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
• Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure – You have the right to ask us to delete your personal information. Read more about the right to erasure.
• Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
• Your right to object to processing – You have the right to object to the processing of your personal data. Read more about the right to object to processing.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information for your account are:

• Legitimate interests – we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • A secure, working service for your Organization: your account lets you sign in to the dashboard and the Scanner, and we write to you by email about the service.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for your Organization's contract and billing are:

• Contract – we have to collect or use your information so we can enter into or carry out your Organization's contract with us. All of your data protection rights may apply, except the right to object.
• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for collecting or using personal information to keep the service secure are:

• Legitimate interests – we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • A secure, working service: we use these records only to keep the service secure and working, and to investigate and evidence security incidents.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for statistical purposes are:

• Legitimate interests – we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Learning how the dashboard and the Scanner are used, so we can improve them.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for legal requirements are:

• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests – we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • We keep a record of any request or complaint you make about your personal information, so that we can show we met our obligations. The record holds only what is needed to show this.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where we get personal information from

• Directly from you
• Your Organization, which gives us your email address so that we can create your account
• Your Organization, if it names you as the person who signs or pays for its contract
• Stripe, which tells us about the payments made with your card or bank account

How long we keep information

We keep your information for no longer than this:

• Your account: we delete it at our next quarterly retention sweep after your Organization removes you, and at the latest 30 days after your Organization's contract with us ends.
• Records of your visits, sign-ins and the emails we send you: our providers delete them within six months at most.
• Usage analytics: the code that links your visits is deleted after 24 hours. We can see the anonymous statistics for 12 months.
• Emails between you and GranOps about the service: six years, as Spanish commercial law requires.
• Your Organization's contract and billing records: six years after we close our accounts for the year they belong to (for the contract, the year of its last invoice), as Spanish commercial and tax law requires. A record that supports a tax loss or deduction carried forward is kept while the tax authority can still check it, up to ten years.
• A record of a data protection request or complaint you make: five years after we close it, or six if your Organization has a location in the UK, and longer while a complaint or claim about it is open.
• Backups: a copy of information we delete can stay in our database backups for up to 7 days.

For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.

Who we share information with

Data processors

Supabase, Vercel, Resend, Cloudflare and Google Workspace

This data processor does the following activities for us: These providers run the service for us, under written contracts that give them the same data protection duties. Supabase holds the service's database, your account included, in the EU (Ireland). Vercel hosts the dashboard and the Scanner, and measures how they are used. Resend sends the service's emails. Cloudflare carries and protects network traffic. Google Workspace holds our email and documents, including signed contracts.

Stripe

This data processor does the following activities for us: Stripe collects your Organization's payments by card or direct debit, and holds the card or bank account used to pay.

Others we share personal information with

• Stripe, which is also an independent controller for its own payment services, under its own privacy policy, and passes each payment to the banks and card networks that process it.
• Public authorities, where the law requires: the tax authority (the Agencia Estatal de Administración Tributaria) for billing records, and data protection authorities, for example when we notify them of a breach or answer their request.

Sharing information outside the UK and the EEA

Where necessary, we will transfer personal information outside of the UK and the EEA. When doing so, we comply with the UK GDPR and the EU GDPR, making sure appropriate safeguards are in place.

Website visitors

This section is for you if you visit our website, www.granops.com. The website stores no cookies on your device unless you turn off usage analytics (see Cookies), and Vercel Analytics stores none.

Usage analytics

We collect or use the following information for statistical purposes:

• The pages you visit, and the website or app that sent you to us, such as an AI assistant
• Whether you tap a link to call us, message us on WhatsApp or email us, and the language of the page
• Your country and region, your device type, browser and operating system, and a code that links your visits

We use Vercel Analytics to see, in anonymous totals, how the website is used, so we can improve it.

Our lawful bases for collecting or using this information are:

• Legitimate interests – we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Learning how the website is used, so we can improve it.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

You have the right to object to usage analytics. To object, turn it off with this switch:

How long we keep it: the code that links your visits is deleted after 24 hours. We can see the anonymous statistics for 12 months.

Hosting logs

We collect or use the following information to keep the website secure:

• Records of your visits: your IP address, your browser and device, the page, the time and the outcome

Our lawful bases for collecting or using this information are:

• Legitimate interests – we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • A secure, working website: we use these records only to keep the website secure and working, and to investigate security incidents.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

How long we keep it: Vercel deletes these records within a day.

Vercel, our processor, hosts the website and runs its usage analytics. It sends this information to the United States, under the safeguards in Sharing information outside the UK and the EEA.

People who contact GranOps

This section is for you if you email us, message us on WhatsApp or call us, for example about using GranOps for your business.

We collect or use the following information to answer you:

• Your name, and your business's name if you give it
• Your email address or phone number
• Your messages, and what you tell us on a call

Our lawful bases for collecting or using this information are:

• Legitimate interests – we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Answering the people who contact us, and talking with businesses about using GranOps before they sign.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Google Workspace, our processor, holds our email. WhatsApp messages pass through Meta, which runs WhatsApp, under its own terms and privacy policy.

How long we keep it: if your business signs with us, your messages become correspondence about its contract, which we keep for six years, as Spanish commercial law requires. Otherwise we delete them 12 months after your last message, or sooner if you object.

Cookies

The dashboard and the Scanner

The dashboard and the Scanner store these cookies on your device. Vercel Analytics stores none.

• Sign-in cookies (sb-…-auth-token): keep you signed in. They are deleted when you sign out; otherwise each lasts up to 400 days and is renewed while you use the service.
• Measurement objection (granops-measurement-objection): remembers that you turned off usage analytics with the switch. It lasts 400 days and is renewed each time you visit. If you clear your cookies, your objection goes with them and usage analytics turns back on until you turn it off again.
• Scanner Location (granops-scanner-location): remembers which Location this device scans at, if your Organization has more than one, so the Scanner doesn't ask each time. It lasts up to one year and is renewed each time the Scanner uses it.
• Scanner Key (granops-scanner-key): keeps this device signed in to the Scanner with a Scanner Key. It lasts up to 400 days and is renewed each time the Scanner is opened. It is deleted when the device logs out, and replaced when the device signs in again.

The website

The website stores one cookie on your device, and only if you turn off usage analytics. Vercel Analytics stores none.

• Measurement objection (granops-measurement-objection): remembers that you turned off usage analytics with the switch in Website visitors. It lasts 400 days and is renewed each time you visit. If you clear your cookies, your objection goes with them and usage analytics turns back on until you turn it off again.

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: privacy@granops.com

Post: GranOps Technologies, S.L., Calle del Doctor Castelo, 15, 1.º D, 28009 Madrid, Spain

If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the Information Commission (ICO).

The ICO's address:

ICO Head Office
4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

You can also complain to the AEPD, Spain's data protection authority, at aepd.es, or to the data protection authority where you live or work.