GuardRoom
Privacy policy
1. What data we process
- Identification and contact data: name, email address, company, telephone number (if you provide it), country.
- Access and security data: password (stored in a non-reversible form), second factor, active sessions, IP address and browser.
- Activity log in the data room: which documents you open, download or print, when and from where, and your acceptance of the NDA.
- Technical usage data needed for the operation and security of the service.
We do not use your data for advertising and we do not sell it.
2. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account and invitations | Performance of the service contracted with the client and pre-contractual measures |
| Controlling access and protecting the platform (second factor, limits, antivirus) | Legitimate interest in security and the obligation to apply appropriate measures |
| Logging activity in the data room and producing reports for the client | Legitimate interest of the client and of Intu XXV, S.L. in traceability, and the contract with the client |
| Sending you service notifications (invitations, verifications, security alerts) | Performance of the service |
| Handling enquiries and incidents | Legitimate interest |
| Handling requests sent through the contact form | Consent of the data subject |
| Complying with legal obligations | Legal obligation |
3. How long we keep it
- Account and access data: while the account is active and, afterwards, for as long as needed to deal with liabilities.
- Activity log (audit trail): 6 years, protected against modification and deletion during that period.
- Data room content: as set by each client, until the project is closed and deleted.
- Contact form requests: 12 months; they are deleted afterwards.
- Backups: database, 7 days in the production region and 35 days in the daily copy in another EU region; files, 30 days for old or deleted versions.
4. Who we disclose it to
- The client that invites you, which sees your activity in its data room.
- Service providers (processors):
- Scaleway SAS (infrastructure, database, storage, encryption keys and transactional email). Data is hosted in the European Union: production in the Netherlands (Amsterdam) and copies in France (Paris).
- Other technical providers do not access any personal data.
- Authorities, where the law requires it.
We do not transfer your data outside the European Economic Area.
5. Security
Documents are encrypted with keys managed in the EU. Every access is logged. Access to the platform requires two-step verification. The Platform Administrator can only see the content of a data room with the express, time-limited and logged authorisation of the project administrator.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to info@intuxxv.es, with a copy of a document that identifies you. For data forming part of a data room’s content, also contact the client that invited you. If you are not satisfied with the response, you may complain to the Spanish Data Protection Agency (www.aepd.es).
7. Contact form on this website
- Purpose: handling your request for a quote or for information.
- Legal basis: your consent, which you give by ticking the box on the form and may withdraw at any time by writing to info@intuxxv.es.
- Data: name, work email, company and, if you wish, type of transaction, plan of interest and message.
- Retention: 12 months from the request; they are deleted afterwards.
- Recipients: none, other than the processors named in section 4.
Support in the application (the ticket form at app.guardroom.eu) has its own processing, described in the privacy policy of the application.
8. Who processes your data
It depends on the data:
- Your account and access data (name, email, company, two-step verification, access log): the controller is Intu XXV, S.L. (NIF B88449939, Calle Orense 34, 28020 Madrid, Spain). Contact: info@intuxxv.es.
- Documents and data room content: the controller is the client that invited you. Intu XXV, S.L. processes it only as a processor, following the client’s instructions, and does not access it on its own initiative.
- Data you send through the contact form on this website: the controller is Intu XXV, S.L. (see section 7).