Privacy policy

1. Scope

This policy describes how Design Excellent Group SL ("we", "us") processes personal data when you visit the website supaguild.com and use its contact form. The SupaGuild application itself (the console at supaguild.com/app, the tenant sites at <association>.supaguild.com and the member portals) is governed by the privacy documents shown inside the application and by the data processing agreement of the SupaSailing platform it belongs to, under which each association is the controller of its members' data and the platform operator is the processor.

We process personal data in accordance with:

• Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR);
• Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD);
• Ley 34/2002 de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI-CE);
• Directive 2002/58/EC (ePrivacy), as transposed in Spanish law.

2. Data we collect

2.1 Contact form

When you write to us through the contact form we collect the name, email address, organisation, topic and message you enter, together with the time of submission and the IP address used, which we keep for abuse prevention.

2.2 Technical data

Our hosting and content delivery providers process the IP address, user agent and requested pages of every visit in server logs, for security and operation of the site.

2.3 Analytics

Only after you accept analytics cookies, Google Analytics 4 collects aggregated usage data (pages viewed, approximate country, device type, referring site) with IP anonymisation. Without your acceptance no analytics tag is loaded. See the cookie policy.

2.4 Account creation

If you create a SupaGuild account from this site, the data you enter at sign-up is processed under the application's own privacy documents, shown at registration.

3. Purposes and legal bases

Purpose	Legal basis (GDPR art. 6)
Answering your message and following up on a demo or quote request	6(1)(b), pre-contractual measures at your request
Measuring aggregated use of the website to improve it	6(1)(a), consent given through the cookie banner
Security, abuse and fraud prevention (rate limits, bot protection, logs)	6(1)(f), legitimate interest in operating a safe service
Compliance with legal obligations	6(1)(c), legal obligation

We do not sell personal data and we do not share it with third parties for their own marketing.

4. Recipients and sub-processors

The following providers process data on our behalf under data processing agreements:

Provider	Purpose	Data	Location
Cloudflare, Inc.	Content delivery, DDoS protection, bot check (Turnstile) on the contact form	IP address, browser signals	EU/US, Standard Contractual Clauses
Hostinger International Ltd	Hosting of the website and application servers	Server logs, form submissions in transit	EU
Emailit	Delivery of the email that carries your message to us	Name, email, message	EU
Google Ireland Ltd (Google Analytics 4)	Aggregated website analytics, only with your consent	Anonymised usage data	EU/US, Standard Contractual Clauses

The complete list of sub-processors of the SupaGuild application is published at supasailing.com/legal/subprocessors.

5. International transfers

Where a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission or on Standard Contractual Clauses with supplementary measures.

6. Retention

Data	Retention
Contact form messages	12 months after our last exchange with you
Server and security logs	12 months
Analytics data	14 months (Google Analytics default)

7. Security

All traffic is encrypted in transit (TLS). Access to systems that hold personal data is limited to authorised staff, protected by multi-factor authentication and logged. Our staff are bound by confidentiality obligations.

8. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw a consent at any time without affecting the lawfulness of processing before the withdrawal. To exercise them write to [email protected]. We answer within one month.

You may also lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid, aepd.es), or with the authority of your member state of residence.

9. Children

This website is not addressed to children under 16 and we do not knowingly collect their data. If you believe a child has sent us personal data, write to us and we will delete it.

10. Changes

We update this policy when our practices or the law change, and we show the date of the last update at the top of the page.

11. Contact