Privacy Policy

Last updated: August 2026

Escudo Web Software, S.L., with registered address at Calle Cerería 17, Local A, 45600 Talavera de la Reina (Toledo, Spain) — hereinafter "Escudo Web", "we" or "our" — wants you to understand how we collect, use and disclose your personal data.

To that end, we have aligned our privacy policy with Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter, the "GDPR"), and with Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

The purpose of this notice is to explain clearly what personal data we collect, why we collect it, what we do with it, how we protect it and what rights you have.

1. Introduction

Escudo Web appreciates the interest you have shown in our company and in our products and services by visiting our website (escudoweb.com) or our related communication channels, including but not limited to our social media profiles and our blogs (together, the "Escudo Web Pages").

This privacy notice applies to the personal data we collect or process when you interact with the Escudo Web Pages. That interaction may take several forms: browsing our pages, using our products or services, receiving marketing communications or contacting our customer support team. It may involve visitors, customers, schools, suppliers or business partners.

Escudo Web also processes personal data outside the Escudo Web Pages (for example, in specific applications, research projects or dedicated portals). In those cases a different privacy notice will apply, and Escudo Web will expressly state that the applicable notice is not this document.

Last but not least: your privacy genuinely matters to us. When you interact with the Escudo Web Pages you place your trust in us, and we are committed to protecting it at all times.

2. What personal data do we collect, and why?

When this notice uses the term "personal data", we mean any information relating to you that makes it possible to identify you, either directly or in combination with other information in our possession.

2.1. Contact forms on the Escudo Web Pages

You may contact our customer support team through the forms available on the Escudo Web Pages. When you use them, we collect the following data:

• Name.
• Email address.

Purpose. We use this data solely to reply to you by email as quickly as possible. The information is forwarded to the Escudo Web technical support team.

Legal basis. These forms are always used at your own request, so the processing is based on your consent and on our legitimate interest in responding to the enquiries we receive [Article 6(1)(a) and 6(1)(f) GDPR].

2.2. Marketing communications

You may voluntarily subscribe to our marketing and promotional communications. In that case we will process the following data:

• Email address.

Purpose. To send you marketing communications by email only. We may also send you Escudo Web press releases through the same channel.

Legal basis. The processing is based on the consent you give us freely and voluntarily [Article 6(1)(a) GDPR].

How to unsubscribe. You may withdraw your consent at any time using the unsubscribe link at the bottom of every marketing email. Withdrawing your consent does not affect the lawfulness of processing carried out beforehand.

2.3. Lugus and iRiS

For the Lugus and iRiS programs to work correctly, the following personal data relating to users is processed:

• Full name.
• Name of the Lugus project associated with the school.
• Email address.
• Secondary email address (parents or legal guardians).
• Geolocation history (optional).
• History of IP addresses used to connect.
• Browsing history (optional).

We also collect the following information through Google's Admin SDK:

• Organisational units of the Google domain.
• Users of the Google domain.
• Groups of the Google domain.
• Devices of the Google domain.

This information is stored on our providers' servers, located within the European Economic Area, and is used to import the structure (organisational units), users and groups of the customer's Google domain, so that they do not have to be created again in our system. The sole purpose of this processing is to improve the usability of the tool. The conditions under which this information may be processed are set out in the "Disclosure of your personal data" section of this document.

Users who are minors. In some cases the users of these solutions are minors. The school that acquires the software licence is responsible for obtaining the consent of parents or legal guardians for the transfer of this information, and for preventing use of the tool where such consent has not been obtained.

Purpose and legal basis. We use this personal data solely for the correct operation of the software, which is activated at the request of the school that acquires it. The processing is therefore necessary for the performance of the corresponding contract [Article 6(1)(b) GDPR], with Escudo Web acting as data processor on behalf of the school.

3. Disclosure of your personal data

Escudo Web does not and will not disclose your personal data to third parties, except where required by the courts, the Public Prosecutor's Office or the competent authorities in the exercise of their functions, on the terms provided for by law.

We do not sell, rent or trade your personal data, nor do we disclose it to third parties for advertising or profiling purposes unrelated to the services you have contracted.

3.1. Service providers (data processors)

In order to provide our services we rely on technology providers who access the data on behalf of and under the instructions of Escudo Web, exclusively for infrastructure hosting.

This access does not constitute a disclosure of data: these are data processors bound by a contract in accordance with Article 28 GDPR, which requires them to process the data solely for the purposes entrusted to them, to maintain confidentiality, to apply the required security measures and to delete or return the data once the service ends. All of them operate within the European Economic Area, as set out in section 4.3.

3.2. Third-party services

We are not responsible for the security, collection, use or disclosure practices or policies of other organisations — such as Google, Apple, Microsoft or Meta, as well as application developers, social media platform providers, operating system providers, telecommunications operators or device manufacturers — even where you provide them with personal data through or in connection with the Escudo Web Pages. These organisations have their own privacy policies and notices, and we recommend that you review them.

This privacy notice likewise does not cover the privacy or information-handling practices of third parties, including those operating websites or services linked from the Escudo Web Pages. The inclusion of a link does not imply that we endorse the linked site or service.

3.3. Cookies and other tracking technologies

This website does not use cookies, neither its own nor third-party ones, and uses no analytics or advertising tools. For that reason you are not asked for any consent when you visit it.

Other Escudo Web channels — such as our social media pages or our applications — may use cookies and similar technologies, subject in each case to the terms of the corresponding platform.

For further information, please see our Cookie Policy.

4. How do we protect your personal data?

4.1. Security measures

We apply organisational, technical and administrative measures designed to protect personal data within our organisation. However, no data storage or transmission system can guarantee absolute security. If you believe that your relationship with us is no longer secure, please tell us immediately following the procedure described in the section "How can you contact us?".

4.2. Retention period

We will retain your personal data for as long as necessary or permitted for the purposes for which it was collected. The criteria that determine the retention periods are:

1. The duration of our relationship with you in connection with the Escudo Web Pages.
2. The existence of legal obligations binding upon us.
3. Whether retention is advisable in light of our legal position (for example, limitation periods, litigation or administrative investigations).

4.3. Data location: no international transfers

Escudo Web does not carry out international data transfers. All the personal data we process is stored and processed entirely on servers located within the European Economic Area (EEA), subject at all times to the GDPR and to Spanish data protection legislation.

Likewise, we require our service providers to host and process the data exclusively within EEA territory. Your data is not transferred, hosted or replicated in third countries.

5. Your rights and choices

You may at any time request access to your personal data, its rectification or erasure, the restriction of or objection to its processing, as well as data portability (that is, receiving an electronic copy in order to transmit it to another company, to the extent that applicable legislation recognises this right). You may also withdraw your consent at any time.

To exercise these rights, write to us at info@escudoweb.com. We will respond to your request in accordance with applicable law and, in any event, within one month of receipt.

In your request, please state clearly which personal data you wish to change, whether you want it deleted from our database, or what restrictions you wish to place on its use. For your own protection, we may only be able to act on requests relating to the data associated with the email address you write from, and we may need to verify your identity before processing it.

You may also stop receiving commercial communications from Escudo Web at any time by clicking the unsubscribe link at the bottom of every marketing email.

Please note that:

• We may need to retain certain information for record-keeping purposes, to comply with legal retention obligations (for example, tax or accounting) or to complete transactions started before your request.
• Some residual information may remain in backups and other records for the period set out in our retention policies.
• Even if you ask to stop receiving commercial communications, we will continue to send you administrative messages necessary for the provision of the service, which cannot be opted out of.
• If you exercise certain rights or choices, you may no longer be able to use some Escudo Web services, in whole or in part.

We also inform you that you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the competent supervisory authority in your country or region.

6. Information for parents and guardians

The Escudo Web Pages are not directed at minors, as defined by applicable legislation, and we do not knowingly collect personal data from minors without the consent of their parents or legal guardians. It is Escudo Web policy to comply with legislation requiring such authorisation before collecting, using or disclosing personal data relating to minors.

We are committed to protecting the privacy of minors, and we strongly encourage parents and guardians to take an active part in their children's online activities and interests.

If a parent or guardian becomes aware that a minor in their care has provided us with personal data without their consent, they may notify us at info@escudoweb.com. If we become aware that we have received personal data from a minor without the corresponding authorisation, we will delete it from our records.

7. How can you contact us?

If you have any questions about this privacy notice or about how Escudo Web processes your personal data, you may write to our data protection officer at info@escudoweb.com or to the postal address Calle Cerería 17, Local A, 45600 Talavera de la Reina (Toledo), Spain.

You also have the right to lodge a complaint with the competent supervisory authority in your country or region.