Privacy policy

This English text is a courtesy translation of the Spanish original, provided so that the document can be read in English. In the event of any discrepancy between the two versions, the Spanish version prevails and is the only one with legal effect. The Spanish original is published at blastack.com/es/privacidad.

In an internal communications platform, the same company processes personal data in two positions that Regulation (EU) 2016/679 (GDPR) distinguishes clearly, and with different obligations. Telling them apart is the first thing to understand about this document.

Blastack as controller

Of the data of anyone who visits blastack.com, writes to the contact address, creates a trial account or signs up for the service. Here it is we who decide why and how that data is processed, and we answer for it. This is what sections 3, 8 and 9 set out.

Blastack as processor

Of the data that the customer company enters into the platform about its own workforce. Here the controller is the customer company: it decides what data it adds, what for, who has access and how long it is kept. We only process it following its instructions, under the data processing agreement required by Article 28 of the GDPR. This is what sections 4 and 5 set out.

The practical consequence is simple: if you are an employee of a company that uses Blastack, the controller of your data is your employer, not us. The section on rights explains who to approach and what we do if you write to us.

Controller

APRENDIZAJES DEL FUTURO, S.L.

Tax ID (NIF)

B23853310

Registered address

Passatge Domènech 3, 08470 Sant Celoni (Barcelona), Spain

Email address

info@blastack.com

Data protection officer

No data protection officer has been appointed, as none of the circumstances set out in Article 37 GDPR applies.

Any question about data protection, including the exercise of your rights, can be raised at info@blastack.com or in writing to the address given above.

These are the processing activities that we decide on, with their purpose, their legal basis and their retention period.

We do not carry out profiling and we do not take automated decisions that produce legal effects concerning individuals or similarly significantly affect them.

When a company signs up for Blastack, it adds data about its own workforce to the platform. That data still belongs to the customer company, which is the controller. We host it and process it on its behalf. Depending on the features the company decides to use, it may include:

• Identification and contact details: first name and surname, email address and telephone number.
• Organisational data: job title, department, site and role within the platform.
• Profile photograph, if the person uploads one.
• Date of birth and start date, if the company switches on the birthdays and work anniversaries features.
• Content created: posts, comments, reactions, internal messages, uploaded documents and peer recognition.
• Activity records needed for the service: post reads, acknowledgements of receipt for documents, event attendance confirmations and survey answers.
• Technical access data: IP address, browser and connection dates, and the audit log of significant administrative actions.

We do not use any of this data for our own purposes: not for advertising, not for profiling, not for training automated systems, and we do not disclose it to anyone. It is only accessed where this is strictly necessary in order to provide support or resolve an incident, and those accesses are logged.

When the customer company marks a survey as anonymous, the answer is stored with no link to the person who submitted it. This is not a promise made by the screen: the record of who answered what never comes into existence in the database, so neither an administrator at the company nor we can reconstruct it.

It is for the customer company to decide what data it adds, to have a legal basis for processing it, to inform its workforce in the terms of Articles 13 and 14 of the GDPR, and to comply with any applicable employment law, including consulting the employees' legal representatives where appropriate.

The relationship between the customer company, as controller, and Blastack, as processor, is documented in a data processing agreement under Article 28 of the GDPR, which forms part of the Terms of service and is accepted on signing up. It can be provided signed separately at the customer's request. Under that agreement we undertake to:

• Process the data only on the controller's documented instructions, and tell it if we believe an instruction infringes data protection law.
• Maintain confidentiality, including after the relationship ends, and require the same commitment from anyone who may access the data.
• Apply the technical and organisational measures of Article 32 of the GDPR that are summarised in the security section.
• Not engage another processor without the controller's authorisation. The current sub-processors are listed in the recipients section, and any change is notified far enough in advance for the customer to be able to object.
• Assist the controller so that it can deal with the requests to exercise data subject rights that it receives from its workforce.
• Help it comply with its obligations under Articles 32 to 36 of the GDPR, including impact assessments where these apply.
• Notify it without undue delay of any personal data breach affecting its data, with the information it needs in order to comply with its own notification obligations.
• Return or delete the data when the service ends, at the controller's choice, on the terms of the retention section.
• Make available to it the information needed to demonstrate compliance and allow audits, including inspections, with reasonable notice.

The service is provided from our own servers located in the European Union, in a data centre in France operated by Hostinger International Limited. Backups remain in the same jurisdiction.

No international transfers of data outside the European Economic Area take place. Neither the hosting, nor the backups, nor support, nor administration work are provided from outside the EEA, so there is no need to rely on standard contractual clauses or on other safeguards under Chapter V of the GDPR.

Files uploaded to the platform are stored on the server's own disk, in a folder per company, and are not reachable by direct address: every download checks the session and company membership again. The database is only accessible from the server itself and is not exposed to the internet.

The typefaces and the other resources on the site are served from our own server. When a blastack.com page loads, the browser makes no request to any third party, so no third party receives your IP address simply because you visited us.

We do not disclose personal data to third parties. It is only communicated where there is a legal obligation — to the tax authorities, to law enforcement or to the courts — or where it is necessary in order to bring or defend legal claims.

• Hostinger International Limited, as the provider of the infrastructure where the servers are hosted. It acts as a processor, has the corresponding agreement in place and does not access the content.
• The external advisers who provide accounting, tax or legal services, limited to billing data and bound by professional secrecy.

We do not use web analytics, advertising or campaign management services, or social media plugins, so none of those companies receives data about the people who visit the site or use the platform.

The commercial site, blastack.com, does not use cookies. There is no analytics, no campaign measurement, no advertising and no social media buttons. That is why you will not see a banner asking for your consent: there is nothing to consent to.

The platform, app.blastack.com, uses a single first-party cookie that is strictly necessary in order to keep the session open:

It is a cookie exempt from the consent requirement under Article 22.2 of the LSSI-CE, as it is essential in order to provide a service expressly requested by the user. It can be blocked in the browser, but then it is not possible to sign in to the platform.

As controller, we keep each category of data for the period stated in its entry in section 3. Once that period ends, the data is blocked — kept but not used — for as long as legal liabilities may remain, and is erased afterwards.

As processor, we keep the platform data for as long as the contract with the customer company is in force. When it ends, the company has 30 calendar days in which to export its information. After that period, the data and the files are permanently erased within a maximum of 30 further days, including backups, apart from anything we are required to keep by law, which is limited to billing data.

Trial accounts that do not lead to a contract are closed at the end of the 15 days and their data is deleted on the same basis.

We apply technical and organisational measures appropriate to the risk, in accordance with Article 32 of the GDPR. Among others:

• Passwords are not stored: what is kept is a derived value obtained with scrypt and a different salt for each user.
• The session identifier is stored encrypted, so a dump of the table does not allow anyone to be impersonated.
• Isolation between companies is checked on every database query, not only in the interface.
• The database is not exposed to the internet and is only accessible from the server itself.
• Communications travel encrypted and files are served checking the session and company membership on every download.
• Temporary access lockout after several failed attempts, and closure of open sessions when the password is changed.
• Audit log of additions, removals, role changes and content approvals.
• Regular backups within the same jurisdiction.

The detail of how this is built, including what we do not offer yet, is on the security page.

The GDPR gives individuals the following rights over their data:

Access

Knowing whether we process your data and obtaining a copy of it.

Rectification

Correcting inaccurate data or completing incomplete data.

Erasure

Asking for it to be deleted when it is no longer necessary or the processing is not justified.

Objection

Objecting to processing based on legitimate interest on grounds relating to your particular situation.

Restriction

Asking for it to be kept but not used while a challenge is being resolved.

Portability

Receiving the data you have provided to us in a structured and commonly used format.

Withdrawal of consent

Where the processing is based on your consent, withdrawing it at any time without this affecting the lawfulness of the processing carried out beforehand.

To exercise them, simply write to info@blastack.com or to the address given in section 2, stating which right you are exercising and enclosing a copy of a document that proves your identity. We will reply within one month, extendable by a further two months if the request is particularly complex, in which case we will tell you. Exercising these rights is free of charge.

If you are an employee of a company that uses Blastack and your request concerns the data held on the platform, the one who has to deal with you is your employer, because it is the controller. If you write to us we will tell you so, and we will pass the request on to your employer without delay, so that it does not get lost along the way.

If you consider that we have not dealt with your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es). You do not have to complain to us first, although we appreciate the chance to put it right ourselves.

The service is aimed at companies and at the people who work in them. It is not intended for children under 16 and we do not deliberately collect their data. If a customer company adds data about people under that age, it is that company which must have the appropriate legal basis.

This policy may be updated because of changes in the law, recommendations from supervisory authorities or how the service develops. The version in force is always the one published on this page, with the update date shown at the top.

Where the change is substantial, customers will be notified by email or within the platform a reasonable time before it takes effect.