Who is responsible for your data
- Data controller
- DARKDATA, S.L.
- Tax ID (CIF)
- B67703793
- Registered office
- Calle Manuel Ceruelo 9B 1ºB, 15702 Santiago de Compostela (A Coruña), España
- Data protection contact
- info@darkphish.es
This policy covers the marketing site darkphish.es only. When an organisation runs an awareness programme on the DarkPhish platform, that organisation is the controller of its employees’ data and we act as its processor under a separate written agreement.
What we collect
Only what you type into the demo-request form, plus the minimum our servers need to stay up:
- What you send us — your name, work email, company, the size and sector of your organisation, what you are interested in, and optionally your phone number and a message.
- Technical records — the IP address the request came from, the time it arrived and your browser’s user-agent string. These are kept to rate-limit abuse and to investigate incidents.
We do not buy lists, we do not enrich what you send us from third-party data brokers, and we do not ask for any special category of data. Please do not include confidential information in the free-text message.
Why we use it, and on what legal basis
- To answer your request — reply to you, arrange a demonstration and prepare a proposal. Legal basis: the steps taken at your request before entering a contract (GDPR art. 6.1.b), together with your consent given on the form (art. 6.1.a).
- To send you related commercial information about DarkPhish, where you asked for it. Legal basis: your consent (art. 6.1.a), withdrawable at any time.
- To keep the site secure and available — rate limiting, abuse prevention, incident investigation. Legal basis: our legitimate interest in protecting the service (art. 6.1.f).
- To meet legal obligations where one applies, for example accounting or answering a lawful request from an authority. Legal basis: legal obligation (art. 6.1.c).
We do not use your data to profile you automatically, and no decision producing legal effects on you is taken by automated means.
How long we keep it
- Demo requests that do not become a commercial relationship: up to 24 months from your last contact with us, then deleted.
- Where a contract follows, for as long as the relationship lasts and afterwards for the periods required by commercial and tax law (generally six years).
- Technical records: up to 12 months.
When a retention period ends, data is deleted or irreversibly anonymised.
Who else sees it
Your data is not sold, rented or traded. It is shared only with:
- the providers that host and operate this site and our internal tooling, acting as processors under a written contract and only on our instructions;
- public authorities, where we are legally required to disclose it.
Our infrastructure is located in the European Union. Where a provider would involve a transfer outside the European Economic Area, we use one of the safeguards allowed by chapter V of the GDPR — an adequacy decision or the European Commission’s standard contractual clauses.
Your rights
You can ask us at any time to:
- access the personal data we hold about you;
- correct it if it is wrong or incomplete;
- delete it, where we no longer need it;
- restrict or object to our use of it;
- receive it in a portable, machine-readable format;
- withdraw your consent, without that affecting anything done before you withdrew it.
Write to info@darkphish.es from the address you contacted us with, or to DARKDATA, S.L., Calle Manuel Ceruelo 9B 1ºB, 15702 Santiago de Compostela (A Coruña), España. We answer within one month. There is no charge.
If you are not satisfied with our answer, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or to the supervisory authority where you live.
How it is protected
The site is served only over HTTPS. The form endpoint validates and size-limits everything it receives, rate-limits by origin and discards automated submissions. Access to stored requests is restricted to the people who need it to answer you, over authenticated connections.
No system is perfect. If a breach were ever to affect your rights, we would notify the supervisory authority and, where the regulation requires it, you.
Changes to this policy
We update this page when what we do with data changes. The date at the top is the date of the current version. Material changes affecting people we already hold data for are notified by email.