Privacy policy

Who the controller is

The controller of your data is Ingenieros Web S.L., Spanish tax ID (CIF) B86699436, registered at C/ Ordicia 31, 28041 Madrid, España.

For anything related to your personal data, including exercising your rights, write to rgpd@ingenierosweb.co. For general questions about the service, info@ingenierosweb.co.

What data we process

We process only what we need to run the service:

• Account data: your name and email address. Your password is stored hashed and we cannot read it.
• Organisation data: the name of your club and the people you invite, with the role you assign them.
• Data you enter: the equipment inventory, bookings, loans and safety reviews you record. They are yours, and we process them only to make the application work.
• Technical data: IP address and request metadata, logged by our hosting provider for security and error diagnosis.
• Usage data: only if you accept analytics cookies. Aggregated statistics about which pages are visited.

Why we use it and on what legal basis

• Providing the service and managing your account: performance of a contract (Art. 6(1)(b) GDPR). Without this data we cannot give you access.
• Sending essential emails — invitations, verification, password recovery: performance of a contract (Art. 6(1)(b) GDPR).
• Keeping the service secure and preventing abuse: legitimate interest (Art. 6(1)(f) GDPR).
• Measuring site usage with Google Analytics: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

Who else accesses your data

We do not sell your data or share it with third parties for commercial purposes. We do rely on providers acting as processors, who may use it only to provide us their service:

• Vercel Inc. — application hosting.
• Amazon Web Services — infrastructure: database, image storage (S3) and transactional email (SES). S3 and SES run in the eu-west-1 region (Ireland).
• Google Ireland Ltd. — web analytics, only if you have given consent.

Transfers outside the European Union

Some of these providers are US-based and may process data outside the European Economic Area. Those transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the Data Privacy Framework they adhere to.

How long we keep it

We keep your account data while your account is active. If you delete it, we erase your personal data except what we must retain by law, and only for as long as that obligation requires.

Analytics data is retained per the Google Analytics configuration, up to a maximum of 14 months.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability at any time, and withdraw any consent you gave. Write to rgpd@ingenierosweb.co and we will reply within one month at the latest.

If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.

Security

Traffic is encrypted over HTTPS, passwords are stored using key derivation functions, and access to each organisation’s data is restricted by role. No system is infallible, but we maintain technical and organisational measures proportionate to the risk.

Minors

RocNest is aimed at sports clubs and organisations, and accounts must be created by people over 14. If a club manages equipment for underage members, it is the club that must have the appropriate legal basis to process their data.

Changes to this policy

If we change this policy we will publish the new version here and update the revision date. If the change is substantial, we will let you know.