Privacy Policy

Draft. Pending completion of the owner's details and legal review.

Last updated: [PUBLICATION DATE]

1. Who processes your data

The controller of the processing activities carried out by ProfitRocket on its own behalf is [COMPANY NAME], tax identification number [TAX ID], with registered address at [FULL ADDRESS] and privacy contact [PRIVACY_EMAIL]. Contact details of the data protection officer, where one has been appointed: [COMPLETE OR REMOVE THIS SENTENCE].

This policy explains how we process data relating to visitors, people who contact us, account holders and customer representatives. The identity of the provider is also available in the Legal Notice.

2. Account data and store data

There are two distinct situations:

Our relationship with you: we manage your registration, contact, billing and necessary service usage data for the purposes described in this policy.
Personal data from your stores: when we process order information on your instructions, we act as a processor, or as a sub-processor where you act on behalf of another controller. That processing is governed by the Data Processing Agreement. This policy is not a general authorisation for us to decide new uses of your buyers' data.

If you bought from a store that uses ProfitRocket, you should normally contact that store to exercise your rights in relation to the purchase. If we receive your request about data we process on their behalf, we will forward it to the relevant customer and cooperate under the applicable agreement, without disclosing information to unauthorised people.

3. What information we may receive

Depending on the features you use and the integrations available, the relevant information includes:

Context	Information to be specified according to the actual configuration
Registration and sign-in	Account identifier, name and email; identifier and authorised data from the sign-in provider you choose.
Purchase and billing	Necessary business and tax details, plan, customer and subscription identifiers, payment status and invoices. [CONFIRM WHICH PAYMENT DATA PROFITROCKET RECEIVES].
Contact and support	Contact details, messages, files and incident details you choose to provide.
Operation and security	[ACTUAL INVENTORY: FOR EXAMPLE, SESSION IDENTIFIERS, IP, ACCESS TIMESTAMPS AND TECHNICAL LOGS; REMOVE ANYTHING NOT COLLECTED].
Optional usage and measurement	[STATE WHETHER ANALYTICS, PIXELS OR ADVERTISING MEASUREMENT EXIST, WITH DATA AND PROVIDERS; REMOVE IF NOT USED].

Data may come from you, from an authorised person at your company, or from the services you choose to connect. The scope of each connection is disclosed when you authorise it. Imported files should be limited to the information needed for the analysis.

Fields marked as required are necessary to handle the relevant request or feature. If they are not provided, it may not be possible to complete it; this will not be used to require data unrelated to that purpose.

4. Why we use it and on what basis

Purpose	Applicable basis
Creating and managing the account of a person contracting in their own name, providing the service and handling pre-contractual requests	Performance of the contract or steps requested before contracting.
Interacting with representatives and contacts of a business customer	Legitimate interest in managing the professional relationship, limited to necessary data and subject to the corresponding balancing test.
Managing payments and tax or accounting obligations	Performance of the contractual relationship and compliance with the corresponding legal obligations.
Preventing unauthorised access and investigating technical incidents	Legitimate interest in protecting the service, with proportionate measures; legal obligations where applicable.
Handling rights requests and requests from authorities	Compliance with legal obligations.
Sending promotional communications, where offered	Specific consent as the criterion of this policy. You may withdraw it and unsubscribe without losing the access you purchased.
Optional measurement requiring authorisation	Prior consent, with the scope described in the cookie policy and the preference panel.

Legitimate interests do not authorise any processing whatsoever. You may request information about the balancing test and object where applicable. Necessary messages about security, billing or service delivery are not presented as marketing.

5. Providers, recipients and transfers

Data may be processed by providers involved in the features you actually use, such as hosting, authentication, billing or support, with the role and safeguards that apply in each case. Not all of them necessarily act as processors: their specific role must be identified.

Actual recipients and providers:

Legal entity	Service and data involved	Role	Countries of processing and access	Information and safeguards
[TO BE COMPLETED]	[TO BE COMPLETED]	[PROCESSOR / INDEPENDENT CONTROLLER / OTHER]	[TO BE COMPLETED]	[LINK AND SAFEGUARDS]

Data may also be disclosed to authorities and other recipients where a legal obligation exists. The list of sub-processors for store data is set out in the annex to the Data Processing Agreement and must be kept consistent with this information.

Transfers outside the EEA: [IDENTIFY WHICH EXIST, WHICH DATA THEY AFFECT, THE DESTINATION AND THE VALID MECHANISM APPLIED, AS WELL AS HOW TO OBTAIN INFORMATION ABOUT THE SAFEGUARDS; IF NONE EXIST, STATE SO ONLY AFTER VERIFICATION]. The mere location of a server in Europe does not by itself demonstrate that there is no access from other countries.

6. How long we keep data

Category	Retention period or criterion to be applied
Account and contractual relationship	For the duration of the relationship and, after closure, [JUSTIFIED PERIOD/CRITERION FOR HANDLING LIABILITIES].
Billing	[SPECIFIC LEGAL PERIODS APPLICABLE TO THE OWNER AND BLOCKING CRITERION, WHERE APPLICABLE].
Enquiries and support	[PERIOD FROM CLOSURE OF THE ENQUIRY AND JUSTIFIED EXCEPTIONS].
Security logs	[ACTUAL PERIOD AND CRITERION FOR INCIDENTS REQUIRING PRESERVATION].
Consents and opt-outs	[PERIOD/CRITERION FOR EVIDENCING CHOICES AND RESPECTING OBJECTIONS].
Backups	[ACTUAL ROTATION CYCLE AND EFFECTS OF AN ERASURE REQUEST].

Information kept due to a legal obligation or to handle liabilities will be used only for those purposes. Store data processed on the customer's behalf will be returned or deleted in accordance with their instructions, the processing agreement and any applicable obligations.

7. Your rights

You may request access, rectification, erasure, objection, restriction and portability where applicable. You may also withdraw consent without affecting the lawfulness of prior processing. Write to [PRIVACY_EMAIL] stating your request and how we can locate our relationship with you.

We will verify identity proportionately. We do not automatically require a full copy of an identity document; we will only ask for additional information where it is necessary to resolve reasonable doubts.

We will respond within the legal deadline: generally one month from receipt. Where complexity or the number of requests allows an extension, we will inform you within the first month of the reasons and of the extension, which may be up to two further months. You may also lodge a complaint with the Spanish Data Protection Agency or the competent authority.

8. Automated decisions and profiling

[CONFIRM WHETHER SOLELY AUTOMATED DECISIONS WITH LEGAL OR SIMILARLY SIGNIFICANT EFFECTS EXIST. IF THEY DO, DESCRIBE THE LOGIC, SIGNIFICANCE, CONSEQUENCES AND SAFEGUARDS; IF THEY DO NOT, STATE SO AFTER VERIFICATION].

Profitability reports are addressed to the customer to support their analysis. This does not justify creating buyer profiles for our own undisclosed purposes.

9. Changes and further information

Updates to this policy will reflect real changes in processing or legal requirements. Material changes will be communicated by an appropriate means; if new processing requires consent, it will be requested before it begins. Publishing a new policy does not replace that consent.