Privacy policy.

VULNIT LABS SL, trading as vulnit and based in Spain, is the controller of the personal data described in this policy.

For privacy questions or to exercise your rights, contact [email protected].

• Contact information: your name, work email, company, message and information you provide in related correspondence.
• Technical information: our hosting provider receives information such as your IP address, requested pages, browser information and request times when delivering and protecting the website.

Name, work email, company and message are required to submit the contact form. You can also contact us directly by email.

• Responding to enquiries and preparing proposals: taking steps you request before entering a contract with you, or our legitimate interest in answering other enquiries and communicating with business contacts.
• Operating and protecting the website: our legitimate interest in delivering a reliable service, resolving technical issues and preventing spam and abuse.
• Website analytics: your consent, to understand how visitors use the website and improve its content through Google Analytics.
• Meeting legal requirements: complying with applicable legal obligations, including binding requests from competent authorities.
• Handling disputes: our legitimate interest in establishing, exercising or defending legal claims.

We do not use the data covered by this policy to make solely automated decisions that have legal or similarly significant effects on you.

We use service providers for website hosting, contact form processing and business email. Netlify hosts this website and processes contact form submissions on our behalf. Providers acting as processors handle data under the applicable data-processing terms.

Data may also be disclosed to competent authorities where legally required, or to professional advisers where necessary to handle legal claims.

Our providers may process data outside the European Economic Area, including in the United States. Transfers require an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

Netlify's Data Processing Agreement provides for the EU-U.S. Data Privacy Framework and, where that framework does not apply, Standard Contractual Clauses. Contact us for information about the safeguards relevant to your data or to request a copy.

We keep enquiry correspondence while handling your request and any related business discussions. If an enquiry leads to an engagement, relevant correspondence becomes part of the engagement records.

Technical records are kept for the time needed to operate the website, resolve service issues and investigate abuse. Records needed to meet legal obligations or handle claims are retained for the applicable legal periods. Otherwise, personal data is deleted when it is no longer needed for its purpose.

Subject to the conditions in data protection law, you can request access to your personal data, correction of inaccurate data, deletion, restriction of processing and a portable copy of your data.

You can object to processing based on legitimate interests on grounds relating to your situation. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

Send your request to [email protected]. We may ask for information reasonably needed to verify your identity. We respond within one month, unless the law allows an extension.

You can complain directly to the Spanish Data Protection Agency (AEPD) or another competent data protection authority, including the authority where you live or work in the European Union.

We use Google Analytics to understand how visitors use this website and improve its content. With your consent, it processes information such as cookie identifiers, pages visited, interactions, referral sources, approximate location, and browser and device details.

Analytics is optional. You can accept or reject it and withdraw consent at any time using Cookie preferences in the footer. Analytics collection only starts after you consent. Rejecting analytics does not prevent you from using the website or contacting us.

A necessary first-party cookie, vulnit_analytics, remembers your choice for up to 180 days. It stores only whether you accepted or rejected analytics. Closing the notice without choosing does not give consent.

Google may process analytics data outside the European Economic Area, including in the United States. Its data-processing terms and international transfer information describe the applicable safeguards, including the EU-U.S. Data Privacy Framework and Standard Contractual Clauses where applicable.

After acceptance, the first-party cookies vulnit_ga and vulnit_ga_84PZCZEZ83 distinguish visitors and maintain session information for up to 180 days. Withdrawing consent stops collection and removes these analytics cookies; it does not delete measurements already collected.

We send the public page address without query strings or fragments, and only the referring website's domain. We do not send contact form values, use User-ID or enable Google Signals, advertising personalization or enhanced measurement.

User-level and event-level data retention is set to two months, without resetting the period on new activity. This limit does not apply to aggregated reports. See also how Google uses information from sites that use its services.

Links to other websites take you to services with their own privacy policies. This policy covers the vulnit website and the enquiries described here.

We may update this policy when the website or our data handling practices change. The date above identifies the latest revision.