Privacy policy

1. Data Controller

The controller of the personal data collected is:
Company: Cardea OS S.L.
Address: C/Basilica 16, Madrid, Spain
Contact email: admin@cardeateam.com

2. Data Collected

We collect only the minimum data necessary to provide secure access to our applications, which mainly include:

• Email address

• Basic authentication data provided by external identity providers (Google, among others)

• We do not store passwords directly.

3. Purposes and Legal Bases

At Cardea OS S.L., we use the information provided by users for the following purposes:

• Allow secure access and authentication in our applications through Google Cloud’s Identity-Aware Proxy (IAP).
  Legal basis: contractual necessity.

• Manage authorized user accounts and grant appropriate permissions.
  Legal basis: contractual necessity.

• Perform usage analysis to improve our services.
  Legal basis: legitimate interest, or consent where required by law.

• Comply with legal obligations.
  Legal basis: legal obligation.

4. Data Retention

Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected, or until the user expressly requests its deletion.

5. Data Sharing and Processors

Cardea OS S.L. will not transfer your personal data to third parties, except in cases where there is a legal obligation or when it is strictly necessary for the proper provision of our services, always under strict guarantees of privacy and security.

We rely on trusted service providers, including Google Cloud (Identity-Aware Proxy – IAP), which acts as our data processor under the terms of the Google Cloud Data Processing Agreement.

6. International Data Transfers

Some personal data may be processed on servers located outside the European Economic Area (EEA). In such cases, we ensure that appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses or adequacy decisions.

7. User Rights

You may exercise the following rights at any time:

• Right of access to your personal data.

• Right of rectification of inaccurate data.

• Right of erasure when the data is no longer necessary for the purposes for which it was collected.

• Right to object and to request restriction of processing under certain circumstances.

• Right to data portability.

• Right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

Requests can be submitted by email to the contact provided above. We will respond within one month of receipt, free of charge, unless requests are manifestly unfounded or excessive.

You may also file a complaint with the competent supervisory authority (in Spain, the Spanish Data Protection Agency, www.aepd.es) if you believe that the processing of your personal data violates applicable regulations.

8. Cookies and Tracking

If our website or applications use cookies or similar technologies, we will provide clear information and, where required by law, obtain your prior consent. Essential cookies are necessary for the functioning of the site and may be set without consent. Non-essential cookies (such as analytics or advertising cookies) will only be set after you provide explicit consent.

Cookies will be stored on your device for no longer than 13 months from the date of consent, after which you will be asked to renew your preferences.

9. Security Measures

Cardea OS S.L. has adopted appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of your personal data, including the use of secure protocols such as Identity-Aware Proxy (IAP).

10. Children’s Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect data from minors. If we become aware that such data has been provided, we will delete it promptly.

11. Changes to This Policy

We reserve the right to modify this Privacy Policy to adapt it to future legal or technological developments. Any changes made will be duly communicated to users.

Last update: 09/11/2025