This policy explains how Emailzeta LLC processes personal data in two situations: (A) when you use IberiaData as a visitor or customer, and (B) when your professional data appear in the directory. It complies with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
Controller: Emailzeta LLC, a limited liability company organised under the laws of the State of Wyoming (United States), with registered address at 30 N Gould St, Ste R, Sheridan, WY 82801, USA.
Contact for any privacy matter: info@emailzeta.com.
You can address any request to info@emailzeta.com; we reply within one month at the latest.
2. (A) Visitors, users and customers
Data we process and why:
- Account data (name, email, password stored only as a hash): to create and manage your account and provide the Service. Legal basis: performance of a contract (Art. 6.1.b GDPR).
- Billing and payment data (company name, tax ID, address, purchases): to sell credits, issue invoices and meet tax obligations. Card details are handled directly by Stripe; we never see or store them. Legal basis: contract and legal obligation (Art. 6.1.b and 6.1.c).
- Usage data (contacts unlocked, API requests, IP address, logs): to deliver what you bought, prevent fraud and abuse (including mass extraction) and secure the Service. Legal basis: contract and legitimate interest in the security of the Service (Art. 6.1.f).
- Sales enquiries (contact form): to reply to you. Legal basis: pre-contractual measures at your request and legitimate interest.
- Anonymous usage statistics (pages visited, origin, device type): to improve the Service. No cookies are used and the IP address is not stored; visits are grouped with an identifier that changes every day and cannot identify you. Kept for 13 months. Legal basis: legitimate interest.
Retention: while your account is active; afterwards, for the periods required by tax and commercial law (up to 6 years for accounting records) and for the limitation periods of possible claims. Security logs are kept for up to 12 months.
3. (B) Professionals and companies in the directory
Categories of data: name or company name, company tax ID (for legal entities only; the national ID of self-employed people is never published), province, approximate company size, professional website, and professional email and telephone (the latter are shown only to users who unlock them).
Source: sources accessible to the public, official registers and publications, and information published by the companies and professionals themselves in the course of their activity.
Purpose: to offer a B2B directory that facilitates professional and commercial contact between companies.
Legal basis: the legitimate interest of the controller and of the users of the directory in professional contact (Art. 6.1.f GDPR), with the presumption established in Article 19 of the LOPDGDD for the contact data of professionals and self-employed people used in relation to their professional activity. We have carried out a balancing test: only professional data are processed, private contact details are excluded where detected, and you can object at any time.
Recipients: users who unlock a contact obtain it under a licence that forbids resale and act as independent controllers, obliged to comply with the GDPR and with Spanish rules on commercial communications (LSSI-CE).
Retention: while the data remain relevant for the directory; records are reviewed periodically and removed when they are outdated or when you request it.
Your right to object: you can ask us at any time, free of charge, to stop showing your data via https://iberiadata.com/data-rights or info@emailzeta.com. We will remove the record from the directory and stop distributing it.
4. Service providers and international transfers
We use providers that process data on our behalf under a data-processing agreement:
- Railway Corp. (United States): hosting, databases and file storage.
- Stripe, Inc. / Stripe Payments Europe Ltd.: payment processing (acts as independent controller for its own anti-fraud purposes).
- Email delivery provider, for transactional messages.
Emailzeta LLC is established in the United States, so data are transferred outside the European Economic Area. These transfers rely on the EU–US Data Privacy Framework where the recipient is certified and, otherwise, on the Standard Contractual Clauses approved by the European Commission, together with additional security measures (encryption in transit and at rest, access control and logging).
5. Your rights
You can exercise the rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given, by writing to info@emailzeta.com or using the form at https://iberiadata.com/data-rights. We may ask you to prove your identity where necessary.
If you consider that your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country.
6. Security
We apply technical and organisational measures appropriate to the risk: encryption, hashed passwords, encrypted identifiers, two-factor authentication for administrators, access limits, audit logs and rate limiting against mass extraction.
7. Minors
The Service is aimed at companies and professionals and is not intended for people under 18.
8. Changes
We may update this policy. We will publish the new version on this page with its date and, if the changes are significant, we will notify registered users.