Privacy Policy

Privacy Policy

Last updated: 06/06/2026

1. Data controller

The controller of the personal data collected through the platform DatomWorx (hereinafter "DatomWorx") is:

• Owner: Daniel Tomás Moronta
• Tax ID: 54049424E
• Trade name: DatomWorx
• Address: Carrer dels Jurats 22, 19, Valencia, España
• Privacy contact email: info@datomworx.com
• Website: https://datomworx.com
• Data Protection Officer (DPO): not appointed (not mandatory under art. 37 GDPR for processing of this scale). For any privacy query use the email indicated above.

2. Data we process

Depending on how you use DatomWorx, we may process the following categories of data:

• Registration data: name or alias, email address and password (stored encrypted with bcrypt). You decide what name you give us.
• Google sign-up data: if you register with your Google account, we receive your name, email address and, where applicable, your profile picture and account identifier, according to the permissions you authorise.
• Account and plan data: plan type (Trial, Free, Pro or BOSS), subscription status, passes purchased or assigned, and relevant activity history (last login, active devices).
• Content you create: the projects, trajectories, templates, exams, settings and other content you generate in the DatomWorx applications (for example, projects and trajectories in the Traffic Simulator, or exams in DatomWorx Exams) and those you decide to share with other users.
• Data related to collaborative use: when you share a project, a template or any content with another DatomWorx user, we record that relationship (who shares, with whom, what content, sharing date) to provide the collaboration function and allow you to revoke access at any time.
• Tax data (BOSS accounts only): tax name, Tax ID, address and phone, necessary to issue invoices.
• Payment data (paid plans only): the card or payment-method data is processed directly by Stripe Payments Europe Ltd. (Ireland). We only keep the customer identifier and the transaction reference to issue invoices and provide support. We never see or store full card numbers.
• Technical and usage data: IP address, browser type, operating system, language, session identifiers and access/security logs.
• Data derived from map use: when you activate Google Maps in the applications that integrate it (for example, the simulator), your interactions with the map are processed by Google (see section 6).

3. Purposes and legal bases (art. 6 GDPR)

Purpose	Legal basis
Create and manage your account and allow access to DatomWorx.	Performance of the contract (art. 6.1.b GDPR).
Provide the service features (save projects, simulate, share, maps).	Performance of the contract.
Manage subscriptions, payments, BOSS passes and invoicing.	Performance of the contract and legal obligation (tax and accounting regulations).
Handle queries, support and complaints.	Performance of the contract or legitimate interest (art. 6.1.f GDPR).
Ensure security, prevent fraud and abuse.	Legitimate interest and legal obligation.
Comply with tax, accounting and commercial obligations.	Legal obligation (art. 6.1.c GDPR).
Optional cookies (analytics, marketing).	Consent (art. 6.1.a GDPR), revocable at any time.
Sending commercial communications about DatomWorx (news, tips).	Express consent (optional checkbox at registration).

We do not use automated decision-making systems or profiling with significant legal effects on users. Decisions about your account (plan assignment, suspensions, etc.) are made by people or by simple technical rules (for example, subscription expiry) that do not fall within the scope of art. 22 GDPR.

4. Retention periods

• Account data: for as long as you keep your account active. If you request its deletion, it is erased within a maximum of 30 days, unless the law requires us to keep it longer.
• Invoicing and payments: 6 years from issuance, in accordance with art. 30 of the Spanish Commercial Code and tax regulations.
• Technical and security logs: 12 months from their generation.
• Legal acceptance signatures (consents): for the duration of the account and a minimum of 5 years after its termination to evidence GDPR compliance.
• Accounts anonymised for not signing new legal versions (see section 10): personal data and content are erased after the 3 months described in section 10. Only the invoices and minimum records required by tax and accounting law are kept, dissociated from the owner's identity.

5. Recipients (data processors)

We share data with the following providers, all with data-processing agreements compliant with art. 28 GDPR:

• Hosting: Hostinger International Ltd. (based in the European Union; physical infrastructure in a data centre in the European Economic Area).
• Payment gateway: Stripe Payments Europe Ltd. (Ireland, EU).
• Maps: Google Ireland Ltd. (Ireland, EU), provider of the Google Maps Platform service.
• Transactional email: Hostinger SMTP service, same data-processing agreement as the hosting.

International transfers

Although all the above providers contract through their European subsidiary, some of them (in particular Google and Stripe) belong to corporate groups headquartered in the United States. As a result, part of the technical processing of the data may take place on group infrastructure outside the European Economic Area.

These transfers are covered by:

• The Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914).
• The EU-US Data Privacy Framework, where the providers are adhered to it.
• Supplementary technical and organisational measures (encryption in transit and at rest, access controls, pseudonymisation where applicable).

You can consult the specific safeguards in the privacy policies of Google and Stripe linked in this document. We do not carry out additional international transfers of personal data outside the European Economic Area beyond those described in this section.

6. Use of Google Maps

Some DatomWorx applications (for example, the simulator) integrate Google Maps as an optional feature. When you activate it, Google Ireland Ltd. may process your technical data (IP, device identifier, map queries) in accordance with its Google Privacy Policy. If you do not want that processing, do not activate the real maps.

7. Your rights

As the data subject you may exercise the following rights at any time:

• Access: obtain confirmation of whether we process your data and which data.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request the deletion of your data.
• Objection: object to the processing in certain circumstances.
• Restriction: request that we restrict the processing.
• Portability: receive your data in a structured, machine-readable format.
• Withdrawal of consent for cookies and commercial communications at any time, without affecting prior processing.
• Not to be subject to automated decisions that produce significant legal effects (a right that applies even though, as indicated in section 3, we do not carry out this type of decision).

To exercise them, write to us at info@datomworx.com stating "Exercise of GDPR rights" and attaching a copy of your ID or equivalent document. We will respond within the legal period of 30 days, extendable to 60 if the request is complex.

If you consider that your rights have not been properly attended to, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

We apply reasonable and proportionate technical and organisational measures to protect your data:

• Encryption of communications via HTTPS/TLS.
• Passwords stored with bcrypt hashing (they cannot be recovered in plain text).
• CSRF tokens on all forms and invisible anti-bot protection on login/registration.
• Security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy).
• Periodic encrypted backups.
• Access restricted to the owner and to strictly necessary persons.
• Logging of security incidents and notification to the AEPD within 72 hours where applicable (art. 33 GDPR).

9. Minimum age

The service is intended exclusively for persons over 18 years of age. By registering you declare and warrant that you have reached the legal age of majority. If we detect that a user is under 18, we will immediately suspend their account and erase their personal data within a maximum of 30 days, except for data we are legally required to keep (invoicing).

10. Changes to this policy

If we modify this policy, we will notify you upon entering the application by means of a prominent notice. We distinguish two types of changes:

10.1. Minor changes

Wording corrections, clarifications, readability improvements or adjustments with no impact on your rights. They will apply automatically after a period of 15 days from notification. They do not require express signature; if you continue using the service after those 15 days, tacit acceptance will be understood in accordance with the general doctrine of acceptance by conclusive acts.

10.2. Substantial changes

New processing purposes, new data processors, changes to your rights, changes to international transfers or equivalent modifications that affect your privacy. We will ask you for a new express acceptance. The procedure will be:

• You will have 15 days from notification to review and sign the new version. During that period you may continue using the service normally.
• After 15 days without signing, your session will be automatically closed. To access the service again you must:
  • Sign the new version by clicking "Accept", or
  • Log out definitively without accepting, by clicking "Review later and log out". You may try again at any time while your account remains active.
• If 3 months from notification pass without signing, your account will be automatically anonymised: your personal data and all your content (projects, templates, settings, shared items, etc.) will be irreversibly erased. Only the invoices and minimum records required by tax and accounting regulations will be kept for the legal period of 6 years, dissociated from your identity.

You may delete your account voluntarily at any time from "Settings → Delete account" or by writing to info@datomworx.com.

11. Contact

For any query about privacy or data protection: info@datomworx.com.

Versión 1.4 · publicada el 06/06/2026