top of page

Data Protection Policy

GDPR Compliance, Operational Principles, and ARCO-POL Rights
 

1. Overview and Organizational Data

Vision Factory considers data privacy and security fundamental to its operations. This page outlines our data protection framework, operational safeguards, and procedures under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

  • Data Controller: Vision Factory

  • Legal Representative / CEO: Piotr Sadowski (NIE: Y6466556M)

  • Registered Office: Carrer de la Vinya 33B, 08041, Barcelona, Spain

  • Phone: +34 623 176 781

  • Privacy Contact: info@visionfactory.org

  • Supervisory Authority: Agencia Española de Protección de Datos (AEPD) | www.aepd.es
     

2. Core Principles of Data Governance

All personal data processing activities at Vision Factory strictly follow Article 5 GDPR principles:
 

  • Lawfulness, Fairness, and Transparency: Data is handled fairly, lawfully, and with full transparency toward the user.

  • Purpose Limitation: Data is collected strictly for specified, explicit, and legitimate business purposes.

  • Data Minimization: Only the minimum personal data strictly necessary to fulfill the intended purpose is processed.

  • Accuracy: Processes are maintained to keep information accurate and up to date.

  • Storage Limitation: Data is kept only as long as necessary for its intended purpose and statutory legal obligations.

  • Integrity and Confidentiality: Technical and organizational measures safeguard data against unauthorized access, loss, or damage.

  • Accountability: Vision Factory maintains active compliance records and documentation.
     

3. Register of Processing Activities (ROPA Summary)

In compliance with Article 30 GDPR, Vision Factory maintains an updated Record of Processing Activities. The primary categories are:

A. Website Inquiries and Customer Relations

  • Data Collected: Full name, email address, telephone number, and message contents.

  • Legal Basis: Consent (Art. 6.1.a GDPR) and Legitimate Interest in handling communications (Art. 6.1.f GDPR).

  • Retention: Retained for up to 12 months post-resolution, unless continuing commercial ties exist.

B. Client Administration and Service Contracts

  • Data Collected: Corporate name, fiscal ID/NIE/VAT, billing address, representative details, banking data.

  • Legal Basis: Contract execution (Art. 6.1.b GDPR) and compliance with legal fiscal duties (Art. 6.1.c GDPR).

  • Retention: Retained for statutory periods (5 to 6 years pursuant to Spanish Commercial and Tax law).

C. Technical Infrastructure and Security Logs

  • Data Collected: IP addresses, user agents, access timestamps, traffic telemetry.

  • Legal Basis: Legitimate interest in maintaining web security and threat mitigation (Art. 6.1.f GDPR).

  • Retention: Retained in server logs for up to 6 months.
     

4. Technical and Organizational Security Measures (TOMs)

Under Article 32 GDPR, Vision Factory deploys appropriate technical and organizational defenses, including:

  • Encryption: All communications and traffic on www.visionfactory.org are encrypted via TLS/SSL.

  • Access Controls: Strict role-based access control (RBAC) and multi-factor authentication for internal systems.

  • Data Resilience: Scheduled automated backups stored in secure, segregated environments.

  • Vendor Oversight: Carefully vetted hosting and technology vendors subject to binding Data Processing Agreements.

  • Incident Management: Defined procedures to detect, manage, and notify the AEPD of any security incidents within 72 hours where required by Article 33 GDPR.
     

5. How to Exercise Your Rights (ARCO-POL)

You have the right to access, rectify, delete, restrict, transfer, or object to the processing of your personal data at any time:

  • 1. Request Channel: Send an email to info@visionfactory.org with the subject line 'Data Protection Rights Request', or send physical mail to Piotr Sadowski, Vision Factory, Carrer de la Vinya 33B, 08041, Barcelona, Spain.

  • 2. Required Info: Include your full name, clear details of the request, and a valid copy of identification (DNI/NIE/Passport).

  • 3. Resolution: Requests are answered within 30 days of receipt, in accordance with Article 12 GDPR.

  • 4. Regulatory Recourse: If you consider your data rights unaddressed, you may submit a claim directly to the Spanish Data Protection Agency (AEPD) via www.aepd.es.

​

6. Contact Information

For any inquiries regarding data protection policies or compliance practices, contact Piotr Sadowski at info@visionfactory.org or +34 623 176 781.

bottom of page