Privacy Policy for the INFONITE portal and console

For people holding a user account on the platform 👤

Controller	LUCUAL18 SL (L18), owner and operator of the INFONITE platform
Who this is for	People designated by a client company who hold an access account for the portal and console
Version	2026.8.500
Language	English (en) — translation. The original version of this policy is in Spanish (es)
In force since	2026-08-13
Replaces	— (first version)
Privacy contact	privacy@infonite.tech

1. Who processes your data

LUCUAL18 SL (hereinafter, L18), owner and operator of the INFONITE platform, with tax ID B88083563 and registered address at Avenida de los Voluntarios 114, 28260 Galapagar (Madrid), Spain.

For any question about your data, or to exercise your rights: privacy@infonite.tech.

2. What this policy covers, and what it does not

This policy concerns your user account on the INFONITE portal and console: access, your profile, and your use of the platform on behalf of the company that gave you access.

What it does NOT cover:

• The citizens' data retrieved through the platform. That processing is different, has its own information, and is explained to each person at the moment they use the service.
• The relationship between you and your company. Your account exists because your company assigned it to you; whatever your company decides about your access, your role or your use of the tool is governed by its own internal policy, not by this one.
• Simply visiting our public websites without an account, which has its own policy.

3. What data we process

• Your account data: username, name and surname, display name, email address and whether it has been verified, phone number and whether it has been verified, postal contact address, language, country, time zone, and your profile picture if you choose to set one.
• The invitation data your account was created with: who invited you, when, and when you accepted.
• Access data: your password, stored irreversibly encrypted — never in clear text and never readable by us —, the number of failed attempts, the date of your last password change, and the date of your last login.
• The date you accepted the terms of use.

4. Where it comes from

From the company that gave you access, which provides the minimum data needed to invite you, and from you, when you complete or modify your profile.

5. Why we process it and on what legal basis

Purpose	Legal basis
Creating and maintaining your account and giving you access to the platform	Performance of the contract with the company that gave you access, of which your account is a necessary means
Verifying your identity at login and protecting the account against unauthorised access	Legitimate interest in the security of the platform
Communicating with you about the service (technical notices, changes, incidents)	Legitimate interest in managing the service
Keeping the record of which terms you accepted and when	Compliance with our accountability obligations

6. Who it is disclosed to

• The company that gave you access. It decides who in its organisation holds an account: it creates yours by inviting you and can deactivate it, and whoever invited you knows the data they used to do so. What does not happen, and you should know it: the console shows nobody your activity. There is no record of what you do in it that your company can consult, and no permission levels between colleagues. What the console shows is the application's configuration — which connections it has available and, soon, its settings: redirect URL, colours, logo — and general usage statistics of the application. End users' data cannot be consulted from the console.
• Our hosting provider (OVH, in France), acting on our behalf.

We do not disclose your data to anyone else, and we never sell it.

7. International transfers

No transfers of your data take place outside the European Economic Area: the platform and its database are hosted in the European Union.

8. How long we keep it

Your account is kept for as long as you hold access to the platform.

When your account is removed, your personal data is erased immediately and permanently, and we keep only an internal anonymised record — a technical identifier, the dates and the removal flag — to preserve the platform's traceability. That record can no longer tell who you were. If you rejoin, your company simply invites you again and a new account is created.

Only if a liability or an ongoing procedure existed would the strictly necessary data be blocked as the law requires, and erased afterwards.

The record of your acceptance of the terms is kept for as long as it may be needed to prove it.

9. What is stored in your browser

We do not use cookies. When you log in, your session is kept in the browser's own storage (not in a cookie), and serves only to keep you identified while you use the platform: without it you would have to re-enter your credentials on every page.

It is removed when you log out, and you can remove it at any time by clearing the site's data from your browser. In addition, the session expires on its own at most one hour after it starts: past that time, the platform asks you to sign in again.

The platform also stores your appearance preference (light or dark theme). It cannot identify you and is removed the same way.

10. Security

Your password is stored using irreversible encryption functions: we do not keep it in clear text and we cannot read it. The platform verifies your email address, monitors failed login attempts, and restricts access to execution information to a small number of administrative roles.

If you find a vulnerability, we would be grateful if you wrote to us at security@infonite.tech.

11. Automated decisions and profiling

There are none. Your account generates no profile about you and leads to no automated decision.

12. Your rights

You may exercise your rights of access, rectification, erasure, restriction of processing, objection and portability by writing to privacy@infonite.tech, attaching a document proving your identity. Exercising these rights is free of charge and we will reply within one month.

Bear in mind that the creation and removal of your account are decided by the company that gave you access: if what you want is for your account to disappear, the fastest route is to request it from your company — without prejudice to your right to contact us directly as well.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

13. Changes to this policy

If we amend this policy, we will publish the updated version and the date it was last updated. Every version is retained so that it can always be established which information was in force at any given time.

14. Languages

This policy was originally written in Spanish (es). The English (en) version is a translation of that text, published under the same version number and with the same content.

If you find any discrepancy between the two, the Spanish version prevails, as the original text. You may ask us for any clarification at privacy@infonite.tech.