DRAFT — pending lawyer review. Not legal advice. Version 2026-10-30.
Privacy policy
Controller: RGC GLOBAL NET SERVICES, SOCIEDAD LIMITADA · Tax ID: B05885538 · Address: c/ Sor Maria Torres 30, 3r, 43440 l'Espluga de Francolí (Tarragona) · Privacy contact: privacy@rgcglobalnet.com
1. Our two roles
We are the controller of lead, account and marketing data (people who request a report, create a free or paid account, or opt in to communications). We are a processor (GDPR art. 28) of shop data that a merchant connects to the hosted service (catalog and, where applicable, order/attribution data); the merchant is the controller and our DPA applies.
2. What data, why, legal basis, retention
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Audited URL and basic result (no signup) | Show the score | Legitimate interest (6.1.f) — not shopper personal data | Anonymous aggregates; raw results 90 days |
| Email, language, store URL, consent record | Send the requested full report and weekly monitoring (double opt-in) | Consent (6.1.a) / steps at the data subject's request (6.1.b) | Until unsubscribe; unconfirmed emails deleted after 7 days; after unsubscribe only proof of consent/withdrawal for 12 months |
| Account: verified email, company, API keys, usage | Provide the free or paid service | Contract (6.1.b) | Account lifetime + 30 days, then deleted |
| Marketing email (separate, unticked box) | Product news and offers | Consent (6.1.a; ePrivacy rules) | Until withdrawn (one-click unsubscribe in every email) |
| Billing | Payment via Paddle [PENDING: payment provider to be confirmed] as merchant of record (independent controller) | Contract and legal obligation (6.1.b, 6.1.c) | As required by tax law — held by Paddle [PENDING: payment provider to be confirmed] |
| Connected shop data | Feeds, EU validator, ACP/UCP/MCP endpoints, attribution | As processor, on the merchant's instructions (DPA) | Contract term; deleted 30 days after termination |
| Technical logs (truncated/hashed IP) | Security, abuse prevention | Legitimate interest (6.1.f) | 30 days |
We do not sell data. No automated decisions with legal effects. Marketing consent is never a condition for the account or report. No analytics tools and no third-party trackers.
3. Processors and recipients
| Sub-processor | Purpose | Location / safeguards |
|---|---|---|
| Cloudflare, Inc. | Hosting, database (D1), edge network | USA/global; EU–US Data Privacy Framework and SCCs (to verify) |
| Resend, Inc. | Transactional email (report, verification, unsubscribe) | USA; DPF/SCCs (to verify) |
| Paddle.com Market Ltd [PENDING: payment provider to be confirmed] | Payments as merchant of record — independent controller, not a processor | UK/EU (to verify; billing not live yet) |
Planned list (2026-10-31, ESTIMATE). Final list confirmed before launch.
4. Your rights
Access, rectification, erasure, objection, restriction, portability, and withdrawal of consent at any time (without affecting prior lawful processing). Email privacy@rgcglobalnet.com; we reply within one month. You may complain to the Spanish DPA (www.aepd.es) or your local authority. If a shop passed us its customers' data, contact that shop first (it is the controller).
5. Changes
We will email you about material changes. Consent wording: version consent-v1-2026-10-30.