Privacy Policy

1. Introduction

PASTORIA PROJECT, S.L. ("we", "us", or "our") operates the Mid2Bid platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD).

2. Information We Collect

2.1 Personal Data You Provide

• Account information: name, email address, company name, country
• Profile information: job title, phone number, professional interests
• Payment information: processed securely through Stripe (we do not store card details)
• Communications: messages, feedback, and support inquiries

2.2 Automatically Collected Data

• Device information: browser type, operating system, device identifiers
• Usage data: pages visited, features used, time spent on the Service
• Log data: IP address, access times, referring URLs
• Cookies and similar technologies (see our Cookie Policy)

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on:

• Contract performance (Art. 6(1)(b)): To provide and maintain our Service, process subscriptions, and deliver market intelligence features.
• Legitimate interests (Art. 6(1)(f)): To improve our Service, analyze usage patterns, prevent fraud, and ensure security.
• Consent (Art. 6(1)(a)): For marketing communications, non-essential cookies, and specific data processing activities where we request your explicit consent.
• Legal obligation (Art. 6(1)(c)): To comply with applicable laws, regulations, and legal processes.

4. How We Use Your Information

• Provide, operate, and maintain the Mid2Bid platform
• Process transactions and send related information
• Send administrative information, updates, and security alerts
• Respond to inquiries and provide customer support
• Analyze usage to improve our Service and user experience
• Develop new products, services, features, and functionality
• Detect, prevent, and address technical issues and fraudulent activities
• Comply with legal obligations and enforce our terms

5. Data Sharing and Disclosure

We may share your information with:

• Service providers: Third parties that help us operate our Service (hosting, payment processing, analytics, email delivery)
• Business transfers: In connection with any merger, acquisition, or sale of assets
• Legal requirements: When required by law, court order, or governmental authority
• Consent: With your explicit consent for other specific purposes

We do not sell your personal data to third parties. All third-party service providers are contractually bound to protect your data and process it only for specified purposes.

6. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions for countries with equivalent data protection standards
• Binding Corporate Rules where applicable

7. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy, unless a longer retention period is required by law. Account data is retained while your account is active and for up to 5 years after account closure for legal and regulatory compliance. You may request earlier deletion subject to legal retention requirements.

8. Your Rights Under GDPR

Under the GDPR, you have the following rights:

• Right of access (Art. 15): Request a copy of your personal data
• Right to rectification (Art. 16): Request correction of inaccurate data
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to restriction (Art. 18): Request limitation of processing
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent (Art. 7): Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at info@mid2bid.com. We will respond within one month as required by GDPR. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication mechanisms
• Regular security assessments and vulnerability testing
• Employee training on data protection
• Incident response procedures

10. Children's Privacy

Our Service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide notice via email or through the Service.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: