Verification privacy

This page explains what personal data we process when a representative confirms their company’s registry data, why, for how long, and how to exercise your rights. It covers the verification process only.

Before a statement exists: your verification request

• If you write to us or fill in the form at /verificacion to request verification for your company, we process: the company name and NIF as you typed them, your contact name, your position, a corporate email address, who told you to write to us, and an optional note.
• We use it only to decide whether to invite your company into the pilot and to contact you about that decision.
• Legal basis: legitimate interest in assessing and handling requests to join the pilot (GDPR Article 6.1.f).
• If we mark your request as spam or ineligible, we keep it for up to 90 days from receipt and then delete it.
• If your request becomes an accepted invitation, it is then retained under the terms of the statement record described below, and this section no longer applies to it.
• You can exercise the same rights described under "Your rights" by writing to mapasocietario@ncdata.eu.

What we collect

• Your name and the registry position recorded in BORME. Both are already public in the register; what we add is the fact that you made a specific statement on a specific date.
• Your email address, to send you the link and any reconfirmation requests.
• An internal note on how your identity was established and how the email domain was tied to the company.
• The exact statement you accepted, the registry evidence as at that moment, and the time of acceptance.
• We do not collect your IP address or browser fingerprint.

What we publish

• Your name, your registry position, the acceptance date, the declared facts and the status of the statement.
• The name of the person who reviewed it on our side.
• We do NOT publish your email address, the identification note, evidence references, or access links.

For how long

• The published statement and its history: for the life of the service, because the value of the record is that it can be consulted later.
• Sealed evidence (statement, registry evidence, timestamps): up to 5 years after the statement expires.
• Your email and the identification note: the same period, but stored separately and erasable on request.

Your rights

• You can request access, rectification, erasure, restriction or object by writing to mapasocietario@ncdata.eu.
• Personal evidence (email, identification note) is erased on request. When we do, we keep only the original cryptographic digest, so the record still shows nothing was substituted, and we note visibly that evidence was erased at the subject’s request.
• On the public record itself: complete erasure would destroy the record’s purpose, so we assess each request individually rather than refusing by default. If we cannot comply, we will tell you why.
• You may complain to the Spanish data protection authority (AEPD).

What we do NOT claim

• We do not verify your identity. We check that you hold the registry position stated, and we review your authority to make the statement.
• We do not certify that your statement is true. We record who made it and when.
• The audit log is tamper-evident, not immutable: its integrity rests on daily external checkpoints.