General Data Protection Regulation (GDPR)

1. GDPR Introduction

The General Data Protection Regulation (GDPR) is the European regulation that governs the processing of personal data. At AstroWeb, we are committed to fully complying with this regulation and protecting your rights as a user.

1.1 GDPR Principles

We are governed by the following principles:

• Lawfulness, fairness and transparency in processing
• Limitation of processing purposes
• Data minimization
• Accuracy of data
• Limitation of retention period
• Integrity and confidentiality
• Proactive responsibility

2. Legal Basis for Processing

We process your personal data based on the following legal grounds:

2.1 Consent

When you register, subscribe to our newsletter or accept cookies, you give explicit consent for the processing of your data.

2.2 Contract Performance

To provide you with our services, process payments and manage your account, we need to process your data as part of contract performance.

2.3 Legitimate Interest

To improve our services, prevent fraud and maintain the security of our website, we process data based on our legitimate interest.

2.4 Legal Obligation

We comply with legal obligations such as billing, accounting and compliance with tax regulations.

3. Your GDPR Rights

As a user, you have the following rights:

4. Data Processing

We detail how we process your personal data:

4.1 Data Categories

• Personal identification data (name, email, phone)
• Billing and payment data
• Website usage data
• Technical data (IP, cookies, browser)
• Communication and support data

4.2 Processing Purposes

• Provide and manage our services
• Process payments and billing
• Customer communication
• Service improvement and user experience
• Compliance with legal obligations
• Marketing (with explicit consent)

4.3 Retention Period

We retain your data only for the necessary time:

• Account data: While you maintain an active account
• Billing data: 7 years (legal obligation)
• Marketing data: Until you withdraw consent
• Usage data: 2 years for analysis and improvement
• Support data: 3 years for query tracking

5. Data Sharing

We share data only in the following circumstances:

6. Security and Protection

We implement technical and organizational security measures:

• Encryption of data in transit and at rest
• Restricted access and strong authentication
• Continuous security monitoring
• Regular and secure backups
• Staff training in data protection
• Regular risk assessments

7. International Transfers

Some of our providers may be located outside the EEA. We ensure that these transfers comply with GDPR:

• European Commission adequacy decisions
• Approved standard contractual clauses
• Codes of conduct and certification mechanisms
• Additional protection measures when necessary

8. Breach Notification

In case of personal data breach that may pose a risk to your rights and freedoms:

• We will notify the supervisory authority within 72 hours
• We will inform you without undue delay
• We will document all breaches
• We will implement immediate corrective measures

9. Data Protection Officer

We have designated a Data Protection Officer (DPO) to oversee our GDPR compliance. You can contact the DPO:

• Email: dpo@astroweb.tech

10. Supervisory Authority

If you are not satisfied with our response to your data protection inquiries, you have the right to file a complaint with the relevant supervisory authority in your country.

In Spain: Spanish Data Protection Agency (AEPD)

You can file your complaint through their official website.

11. Compliance Updates

We are committed to keeping our GDPR compliance updated. Any significant change in our practices will be communicated through our website.

12. GDPR Contact

To exercise your GDPR rights or make inquiries about data protection:

• Email: dpo@astroweb.tech
• Contact form on our website

We will respond to all requests within a maximum of 30 days.