Regulatory Framework

1.1 Data Controller

The data controller responsible for the processing of personal data under this Privacy Protocol is FlintAnchorLabs, registered at 48001, Calle Gran Via 5, Bilbao, Spain. All inquiries regarding data processing activities should be directed to [email protected].

1.2 Categories of Personal Data Processed

In the course of providing our services, FlintAnchorLabs processes the following categories of personal data:

• Identity Data: Full name, professional title, organizational affiliation provided during inquiry submission or service engagement.
• Contact Data: Email address, telephone number, physical mailing address provided for communication and service delivery purposes.
• Technical Data: Internet Protocol (IP) address, browser type and version, operating system, device identifiers, and access timestamps collected automatically through server logging.
• Usage Data: Pages visited, navigation patterns, session duration, and interaction events collected through analytics instrumentation where consent has been obtained.
• Financial Data: Transaction identifiers and payment confirmation data processed through Stripe, Inc. payment infrastructure. FlintAnchorLabs does not store credit card numbers, CVV codes, or full banking details on its own servers.

1.3 Legal Basis for Processing

All personal data processing activities conducted by FlintAnchorLabs are grounded in one or more of the following legal bases as defined under Article 6 of the EU General Data Protection Regulation (GDPR):

• Consent (Art. 6(1)(a)): Where you have provided explicit, informed, and unambiguous consent for specific processing purposes, such as marketing communications or analytics tracking.
• Contractual Necessity (Art. 6(1)(b)): Where processing is necessary for the performance of a contract to which you are a party, or for taking pre-contractual steps at your request.
• Legitimate Interest (Art. 6(1)(f)): Where processing is necessary for the purposes of our legitimate interests, such as fraud prevention, network security, and service improvement, provided these interests are not overridden by your fundamental rights.
• Legal Obligation (Art. 6(1)(c)): Where processing is necessary for compliance with a legal obligation to which FlintAnchorLabs is subject under EU or Spanish law.

1.4 Data Retention Periods

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected:

• Inquiry Data: Retained for a maximum of 12 months from the date of submission if no service engagement is initiated.
• Client Engagement Data: Retained for the duration of the service relationship plus 6 years in accordance with Spanish commercial record-keeping obligations.
• Technical Logs: Server access logs are retained for a maximum of 90 days unless required for ongoing security investigations.
• Analytics Data: Anonymized and aggregated after 26 months; no individual-level tracking data is retained beyond this period.

1.5 Data Transfers

FlintAnchorLabs operates within the European Economic Area (EEA). Where personal data is transferred to service providers located outside the EEA (such as Stripe, Inc. for payment processing), such transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission or are covered by adequacy decisions ensuring an equivalent level of data protection.

1.6 Your Rights Under GDPR

As a data subject, you exercise the following rights at any time by contacting [email protected]:

• Right of Access (Art. 15): The right to obtain confirmation of whether your personal data is being processed and to receive a copy of that data.
• Right to Rectification (Art. 16): The right to request correction of inaccurate personal data or completion of incomplete data.
• Right to Erasure (Art. 17): The right to request deletion of your personal data where there is no compelling reason for continued processing.
• Right to Restriction (Art. 18): The right to request restriction of processing in specific circumstances, such as during the accuracy verification process.
• Right to Data Portability (Art. 20): The right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): The right to object to processing based on legitimate interests, including direct marketing.
• Right to Lodge a Complaint: The right to file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you believe your data protection rights have been infringed.

1.7 Security Measures

FlintAnchorLabs implements appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include but are not limited to: TLS/SSL encryption for all data in transit, encrypted storage for sensitive data at rest, access control mechanisms with principle of least privilege, regular security assessments, and employee training on data protection obligations.

2.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They enable the site to recognize your browser, maintain session state, and collect analytical information about your browsing behavior. Cookies are governed by the EU ePrivacy Directive (2002/58/EC) as transposed into Spanish law.

2.2 Categories of Cookies Used

FlintAnchorLabs employs the following categories of cookies on its website:

• Strictly Necessary Cookies
  These cookies are essential for the basic functionality of the website. They enable core features such as session management, security token validation, and load balancing. Without these cookies, the website cannot operate correctly. Legal basis: Legitimate interest (no consent required).
  • session_id — Maintains user session state (duration: session)
  • csrf_token — Cross-site request forgery protection (duration: session)
  • cookie_consent — Stores your cookie preferences (duration: 12 months)
• Analytics Cookies
  These cookies collect anonymized information about how visitors interact with the website, including pages visited, time spent, and navigation patterns. This data helps us optimize site performance and user experience. Legal basis: Explicit consent (opt-in required).
  • _ga — Google Analytics visitor identification (duration: 26 months)
  • _gid — Google Analytics session grouping (duration: 24 hours)

2.3 Managing Cookie Preferences

When you first visit our website, a cookie consent banner will appear allowing you to accept or decline non-essential cookies. You may update your preferences at any time by clearing the cookie_consent cookie from your browser settings, which will re-trigger the consent banner on your next visit.

You may also control cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling strictly necessary cookies may impair the functionality of the website.

2.4 Third-Party Cookies

FlintAnchorLabs uses Google Analytics for anonymized usage analytics. Google LLC acts as a data processor under a Data Processing Agreement. Google Analytics cookies are only activated after you provide explicit consent. Stripe, Inc. may set cookies during payment processing; these are governed by Stripe's own privacy policy.

3.1 General Refund Framework

FlintAnchorLabs provides premium digital engineering services on a project-based and retainer-based model. Given the bespoke nature of our work, refund provisions are structured around project milestones and deliverable verification as follows:

3.2 Pre-Engagement Cancellation

If a service engagement has been agreed upon but no work has commenced, you are entitled to a full refund of any advance payment within 14 calendar days of the payment date, in accordance with EU consumer protection directives. Cancellation requests must be submitted in writing to [email protected].

3.3 Milestone-Based Refunds

For engagements structured around phased delivery, refund eligibility is assessed per phase:

• Phase 1 (Discovery & Mapping): Fully refundable if cancelled before delivery of the Discovery Report. Once delivered, this phase is considered complete and non-refundable.
• Phase 2 (Core Engineering): Refundable proportional to incomplete deliverables as documented in the project specification. Completed and accepted work is non-refundable.
• Phase 3 (Deployment & Delivery): Non-refundable once production deployment has been initiated, unless the failure is attributable to FlintAnchorLabs's negligence or breach of contractual obligations.

3.4 Quality Disputes

If you believe that delivered work does not meet the specifications outlined in the project agreement, you must submit a written dispute within 30 calendar days of delivery. FlintAnchorLabs will review the claim within 10 business days and, if substantiated, will either remedy the deficiency at no additional cost or issue a proportional refund for the affected deliverable.

3.5 Refund Processing

Approved refunds are processed within 10 business days to the original payment method. Refund amounts are denominated in the same currency as the original transaction (EUR). FlintAnchorLabs is not responsible for currency conversion fees or bank charges incurred during the refund process.

4.1 Scope of Services

FlintAnchorLabs provides premium digital engineering services including but not limited to web development, UI/UX design, backend architecture, API integration, infrastructure automation, and strategic digital consulting. The specific scope, deliverables, timelines, and pricing for each engagement are defined in a written project specification agreed upon by both parties prior to commencement of work.

4.2 Payment Terms

Payment obligations are structured as follows unless otherwise specified in the project specification:

• Project-Based Engagements: 40% upon project specification approval, 30% at midpoint milestone, 30% upon final delivery and acceptance.
• Retainer Engagements: Monthly invoicing with net-15 payment terms. Invoices are issued on the first business day of each month.
• Late Payment: Overdue invoices accrue interest at a rate of 8% per annum above the European Central Bank base rate, in accordance with EU Directive 2011/7/EU on late payments in commercial transactions.

4.3 Intellectual Property

Upon full payment of all invoiced amounts, all intellectual property rights in deliverables produced specifically for the client under a project engagement are assigned to the client. FlintAnchorLabs retains the right to use generalized methodologies, frameworks, and know-how developed during engagements for future projects, provided such use does not disclose confidential client information.

Pre-existing intellectual property owned by FlintAnchorLabs or third parties and incorporated into deliverables (e.g., open-source libraries, proprietary utility modules) remains subject to its original licensing terms. FlintAnchorLabs will disclose all such third-party components in the project documentation.

4.4 Confidentiality

Both parties agree to maintain the confidentiality of all proprietary information disclosed during the course of an engagement. This obligation survives the termination of the service relationship for a period of 3 years. Confidential information includes but is not limited to business strategies, technical architectures, source code, client data, and financial arrangements.

4.5 Limitation of Liability

FlintAnchorLabs's total aggregate liability under any engagement shall not exceed the total fees paid by the client for the specific service giving rise to the claim. FlintAnchorLabs shall not be liable for indirect, consequential, incidental, or punitive damages, including but not limited to loss of revenue, data, or business opportunities, except in cases of willful misconduct or gross negligence.

4.6 Force Majeure

Neither party shall be liable for failure or delay in performing obligations where such failure or delay results from circumstances beyond the reasonable control of the affected party, including but not limited to natural disasters, pandemic, government actions, cyberattacks, or infrastructure failures. The affected party must notify the other party within 48 hours of the force majeure event and use reasonable efforts to mitigate its impact.

4.7 Governing Law & Jurisdiction

This Service Covenant is governed by the laws of the Kingdom of Spain and, where applicable, the regulations of the European Union. Any disputes arising from or in connection with these terms shall be submitted to the exclusive jurisdiction of the courts of Bilbao, Biscay, Spain, without prejudice to the consumer's right to bring proceedings in their country of residence under EU Regulation 1215/2012.

4.8 Amendments

FlintAnchorLabs reserves the right to amend these terms with 30 days' written notice. Continued engagement after the amendment date constitutes acceptance of the modified terms. Clients may terminate the engagement without penalty within the 30-day notice period if they do not accept the amendments.