Privacy policy

• Controller: Yellowpoint Labs, Sociedad Limitada
• Tax ID (NIF): B93761716
• Address: Passeig de Campllong, 33, 17449 Campllong (Girona), Spain
• Data protection contact email: soporte@davant.app

As of the date of this policy, Yellowpoint Labs, S.L. has not appointed a data protection officer, considering, in light of its processing activities and the information available, that none of the mandatory appointment scenarios set out in Article 37 of the GDPR or Article 34 of the LOPDGDD applies. This assessment will be reviewed if the nature, scope or purpose of the processing changes.

This policy explains how we process the personal data of people who visit davant.app, contact us or sign up to receive information about the product launch. It also provides information about the categories of data processed, the purposes, the legal bases, the retention periods or criteria, the recipients and processors, possible international transfers and the rights of data subjects.

We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), and with the regulations applicable to information society services and electronic commercial communications, where applicable.

3.1. Contact form (/contacto page)

• Data: name, email address and the content of the message you send us. Any other data you choose to include voluntarily in the message. We recommend not including in the form especially sensitive data or third-party information that is not necessary for your enquiry; in such a case, Davant reserves the right to delete and not process such sensitive data if it is not essential for providing the services offered.
• Purpose: to attend to and respond to your enquiry, and to maintain any subsequent communication arising from it. The data provided through this form is not added to our waiting list nor used to send you commercial communications, unless there is an independent legal basis that allows it and, where necessary, you have given the corresponding consent.
• Legal basis: the data subject's consent (Art. 6.1.a GDPR), given when submitting the form. Where the enquiry concerns a contractual or pre-contractual relationship, the basis will be the application of pre-contractual measures (Art. 6.1.b GDPR). Where applicable regulations require consent, it will be requested separately.
• Retention period: for the time necessary to handle the enquiry and, subsequently, for the limitation periods of any legal actions that may arise.

3.2. Waiting list and launch communications (home page)

• Data: email address, browsing language and origin of the visit. Together with these we keep proof of your consent: date and time of sign-up, IP address from which it was made, and the information or consent accepted.
• Purpose: to inform you about the development, availability and launch of the product, as well as to send you related content. Proof of consent is kept solely to demonstrate compliance with our legal obligations (Art. 5.2 and 7.1 GDPR).
• Legal basis: the data subject's consent (Art. 6.1.a GDPR), given expressly by means of an unchecked box.
• Retention period: until you withdraw your consent or request to unsubscribe. Every communication will include an unsubscribe link.

3.3. Web analytics and advertising measurement

• Data: device and browser identifiers, IP address, pages visited, visit duration, traffic source and interactions with the site, only to the extent that they are processed through authorised cookies or similar technologies. Non-essential cookies or technologies will not be activated before the user can accept the corresponding categories, and the accept and reject options will be offered with equivalent presentation.
• Purpose: to understand the use of the website, measure the performance of our advertising campaigns and improve our content.
• Legal basis: the data subject's consent, given through the cookie settings panel (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE). These processing activities are not activated until you accept the corresponding categories.
• Retention period: according to the periods indicated in the Cookie Policy. Aggregated data in Google Analytics 4 is kept for 14 months.

3.4. Browsing and security

• Data: IP address, date and time of access, browser type and technical logs generated by our hosting provider.
• Purpose: to ensure the security of the website, prevent fraudulent use and keep it working properly.
• Legal basis: the controller's legitimate interest in the security of its systems (Art. 6.1.f GDPR).
• Retention period: that established by the hosting provider for its technical logs.

All the data we process comes directly from the data subject. We do not collect data from third parties or from publicly accessible sources.

We do not disclose your data to third parties, except by legal obligation or where necessary for the exercise or defence of rights. We do work with providers who access it to provide us with their services, with whom we have signed the corresponding data processing agreements in accordance with Article 28 of the GDPR:

Some of the listed providers may process data outside the European Economic Area, in particular in the United States. The existence, destination and legal mechanism of each transfer will be determined based on the specific provider and the service actually contracted.

Such transfers are covered by the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023, and/or by the Standard Contractual Clauses approved by the European Commission, together with any additional measures that may be necessary.

You may exercise the following rights at any time:

• Access: to know what data of yours we process.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request that we delete your data when it is no longer necessary.
• Objection: to object to processing based on our legitimate interest.
• Restriction: to request that we suspend processing in certain cases.
• Portability: to receive your data in a structured, commonly used format.
• Withdrawal of consent: at any time, without this affecting the lawfulness of prior processing.

To exercise them, write to us at soporte@davant.app indicating the right you wish to exercise and attaching a copy of a document proving your identity. We will respond within a maximum period of one month.

If you believe we have not handled your request correctly, you may file a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the encryption of communications via the HTTPS protocol, access control and periodic review of our providers.

The services on this website are not aimed at children under 14 years of age. We do not knowingly collect data from children of that age. If we detect that we have processed a minor's data without the valid consent of the holder of parental authority or guardianship, we will proceed to delete it.

We do not make automated decisions or carry out profiling that produces legal effects on data subjects or similarly significantly affects them.

We may update this policy to adapt it to regulatory changes or new processing activities. We will always publish the current version on this page, indicating its update date. Where changes significantly affect the processing or the rights of data subjects, we will take any required information or communication measures and, in any case, will notify you through the contact means available to us.