Privacy policy.

VULNIT LABS SL, trading as vulnit and based in Spain, is the controller of the personal data described in this policy.

For privacy questions or to exercise your rights, contact [email protected].

• Contact information: your name, work email, company, message and information you provide in related correspondence.
• Technical information: our hosting provider receives information such as your IP address, requested pages, browser information and request times when delivering and protecting the website.

Name, work email, company and message are required to submit the contact form. You can also contact us directly by email.

• Responding to enquiries and preparing proposals: taking steps you request before entering a contract with you, or our legitimate interest in answering other enquiries and communicating with business contacts.
• Operating and protecting the website: our legitimate interest in delivering a reliable service, resolving technical issues and preventing spam and abuse.
• Website analytics: your consent, to understand how visitors use the website and improve its content through Google Analytics.
• Advertising measurement: your consent, to measure whether a submitted contact enquiry followed a Google Ads interaction.
• Meeting legal requirements: complying with applicable legal obligations, including binding requests from competent authorities.
• Handling disputes: our legitimate interest in establishing, exercising or defending legal claims.

We do not use the data covered by this policy to make solely automated decisions that have legal or similarly significant effects on you.

We use service providers for website hosting, contact form processing and business email. Netlify hosts this website and processes contact form submissions on our behalf. Providers acting as processors handle data under the applicable data-processing terms.

Data may also be disclosed to competent authorities where legally required, or to professional advisers where necessary to handle legal claims.

Our providers may process data outside the European Economic Area, including in the United States. Transfers require an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

Netlify's Data Processing Agreement provides for the EU-U.S. Data Privacy Framework and, where that framework does not apply, Standard Contractual Clauses. Contact us for information about the safeguards relevant to your data or to request a copy.

We keep enquiry correspondence while handling your request and any related business discussions. If an enquiry leads to an engagement, relevant correspondence becomes part of the engagement records.

Technical records are kept for the time needed to operate the website, resolve service issues and investigate abuse. Records needed to meet legal obligations or handle claims are retained for the applicable legal periods. Otherwise, personal data is deleted when it is no longer needed for its purpose.

Subject to the conditions in data protection law, you can request access to your personal data, correction of inaccurate data, deletion, restriction of processing and a portable copy of your data.

You can object to processing based on legitimate interests on grounds relating to your situation. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

Send your request to [email protected]. We may ask for information reasonably needed to verify your identity. We respond within one month, unless the law allows an extension.

You can complain directly to the Spanish Data Protection Agency (AEPD) or another competent data protection authority, including the authority where you live or work in the European Union.

A necessary cookie remembers your cookie choices. Optional Analytics and Advertising measurement are separate choices. They are off unless you explicitly select them, and you can change or withdraw them with Cookie preferences in the footer.

Analytics uses Google Analytics to understand how visitors use the website and improve its content. With your consent, it processes cookie identifiers, pages visited, interactions, referral sources, approximate location, and browser and device details.

Advertising measurement uses Google Ads only after you consent to it. After Netlify confirms a contact form submission, it records a conversion for Google Ads attribution using advertising identifiers and the public page and referring site context. It does not send your name, email, company, message, form fields or other user-provided data to Google Ads.

We do not enable enhanced conversions, remarketing or advertising personalization. We do not use User-ID or Google Signals. We send public page addresses without fragments. From the query string, we send only the campaign parameters that identify an ad click or a campaign link (gclid, gbraid, wbraid and utm_*). From the referring website, we send only its domain.

The necessary first-party cookie vulnit_analytics remembers your Analytics and Advertising measurement choices for up to 180 days. It stores only those choices. Closing the notice without choosing does not give consent. Withdrawing a choice stops new measurement events from this page and removes its related first-party measurement cookies. If the Google tag has already loaded, we notify Google of the updated consent choice. It does not delete measurements already collected.

Google may process measurement data outside the European Economic Area, including in the United States. Its data-processing terms and international transfer information describe applicable safeguards, including the EU-U.S. Data Privacy Framework and Standard Contractual Clauses where applicable. See also how Google uses information from sites that use its services.

After Analytics acceptance, the first-party cookies vulnit_ga and vulnit_ga_84PZCZEZ83 distinguish visitors and maintain session information for up to 180 days. User-level and event-level Analytics data retention is set to two months, without resetting the period on new activity. This limit does not apply to aggregated reports.

After Advertising measurement acceptance, first-party cookies such as vulnit_au and vulnit_aw support conversion attribution for up to 180 days. Advertising click cookies with the vulnit_ prefix may store identifiers that link an enquiry to an ad interaction.

Rejecting optional measurement does not prevent you from using the website or contacting us. Links to other websites take you to services with their own privacy policies. This policy covers the vulnit website and the enquiries described here.

We may update this policy when the website or our data handling practices change. The date above identifies the latest revision.