Privacy Policy
This Privacy Policy describes how StackMint S.L. processes users' personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
1. Data controller
Owner: StackMint S.L. (in formation)
Tax ID (CIF): Pending assignment
Registered address: Málaga (C.P. 29014), España
Email: info@stackmint.cloud
Registry data: Company in the process of incorporation and registration at the Commercial Registry (Registro Mercantil) of Málaga.
2. Data we process
- Contact data: name and email when you contact us or request information.
- Account and billing data: data needed to manage your account, plan and, where applicable, billing.
- Technical usage data: IP address, access logs, API keys and request metadata, for security and service provision.
- Browsing data: information collected through analytics cookies (see Cookie Policy).
- Screening query data (ComplianceWatch): the names and data the client submits for checking against sanctions and PEP lists may contain personal data of third parties. With respect to such data, StackMint S.L. acts as a data processor on behalf of the client (controller).
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Service provision and account management | Performance of a contract (Art. 6(1)(b)) |
| Handling enquiries and communications | Consent / legitimate interest (Art. 6(1)(a)/(f)) |
| Billing and accounting/tax obligations | Legal obligation (Art. 6(1)(c)) |
| Security, fraud prevention and audit logs | Legitimate interest (Art. 6(1)(f)) |
| Web analytics (Google Analytics) | Consent (Art. 6(1)(a)) |
4. Processing on behalf of the client (data processor)
When you use ComplianceWatch to screen names against sanctions and PEP lists, such data is processed solely to execute the requested query, in accordance with Article 28 GDPR. The client is the data controller and must have a legal basis for the screening. A Data Processing Agreement (DPA) is available to clients. Sanctions and PEP lists are sourced from official public sources (OFAC, EU, UN, UK, INTERPOL, FBI and PEP sources).
5. Data retention
We retain data for as long as necessary for the purpose for which it was collected and thereafter for legally required periods (e.g. tax and commercial obligations). Audit logs are kept for the period necessary to ensure the security and traceability of the service.
6. Recipients and processors
We do not share data with third parties except where legally required. To provide the service we use providers acting as processors, including our hosting provider and Google Ireland Ltd. (Google Analytics and Google Search Console). These providers process data according to our instructions.
7. International transfers
Use of Google Analytics may involve transfers of data to the United States. Such transfers rely on the appropriate safeguards provided for in the GDPR (e.g. the EU-US Data Privacy Framework and/or Standard Contractual Clauses).
8. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@stackmint.cloud, stating the right you wish to exercise. If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Security measures
We apply appropriate technical and organisational measures to protect personal data (encryption in transit, access control, audit logging and data minimisation).
10. Changes to this policy
We may update this Privacy Policy. The current version is always the one published on this website, indicating its last-updated date.