Privacy statement & cookies consent

Privacy Policy

1. Introduction

At VancastVideo, privacy and the protection of personal data are a priority. We are committed to processing personal data lawfully, fairly, and transparently, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Organic Law 3/2018 (LOPDGDD), and all applicable regulations governing information society services.

VANCAST maintains an Information Security Management System (ISMS) certified in accordance with ISO/IEC 27001, ensuring that the processes, controls, and security measures applied to the processing of personal data meet internationally recognized standards for confidentiality, integrity, and availability of information.

This Privacy Policy describes how personal data is collected, used, and protected in connection with the use of the vancastvideo.com website and the VancastVideo Platform.

2. Data Controller

3. Scope

This policy applies to:

• Users of the vancastvideo.com website
• Administrative users of the VancastVideo platform
• Commercial contacts and subscribers to informational communications
• Clients and end users, depending on their role

4. Roles and responsibilities

4.1 VANCAST as Data Controller

VANCAST acts as data controller with respect to:

• Contact data and informational or commercial communications
• Account management, billing, and support
• Website navigation and technical cookies

4.2 VANCAST as Data Processor

When using the VancastVideo platform, the client acts as the data controller for the personal data hosted or processed through the platform, while VANCAST acts as data processor, in accordance with the main agreement and the corresponding Data Processing Agreement (DPA).

5. Purposes of processing and legal bases

Personal data is processed for the following purposes:

a) Service provision

• User account management
• Access to and use of the platform
• Technical support and customer service

Legal basis: performance of a contract (Art. 6.1(b) GDPR)

b) Informational or commercial communications

Sending information related to VancastVideo products and services by electronic means, provided that a valid legal basis exists and with the possibility to object at any time.

Legal basis: consent of the data subject (Art. 6.1(a) GDPR) or legitimate interest in B2B relationships, where applicable.

c) Request management

Handling inquiries, incidents, or requests.

Legal basis: consent or legitimate interest.

d) Service improvement

Aggregated and anonymized statistical analysis.

Legal basis: legitimate interest.

6. Data retention

Personal data will be retained:

• For the duration of the contractual relationship
• As long as a legal obligation exists
• Or until deletion is requested

Once the applicable retention periods expire, the data will be deleted or properly blocked in accordance with applicable regulations.

7. Data subject rights

Data subjects may exercise the following rights:

• Access
• Rectification
• Erasure
• Restriction of processing
• Objection
• Data portability

By submitting a written request to:

• Email: privacy@vancast.net
• Postal address: c/. Reina Victoria, 31, 3º 2ª, 08021 Barcelona, Spain

Data subjects also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD).

8. Security measures

VANCAST has implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR.

In particular, VANCAST operates under an ISO/IEC 27001–certified Information Security Management System (ISMS), providing a structured framework for managing information security and protecting personal data.

These measures include, among others:

• Role-based logical and physical access controls
• Secure authentication and credential management
• Encryption of data in transit and, where applicable, at rest
• Monitoring, logging, and auditing of access and activity
• Vulnerability management and security updates
• Business continuity and incident recovery procedures
• Security awareness and training for authorized personnel

These measures are reviewed and updated on a regular basis.

VANCAST also maintains documented incident management, business continuity, and disaster recovery procedures designed to ensure the operational resilience of the platform.

8 bis. Alignment with DORA and the financial sector

VANCAST designs and operates the VancastVideo platform taking into account the digital operational resilience requirements applicable to financial entities, in accordance with Regulation (EU) 2022/2554 (DORA).

The technical and organizational measures implemented by VANCAST enable clients in the banking, insurance, and financial sectors to:

• Ensure the security, availability, and integrity of digital services
• Reduce operational risk associated with mission-critical communications
• Maintain traceability, control, and oversight of ICT services
• Support the management of third-party ICT risk

VANCAST actively cooperates with its clients in risk assessments, audits, vendor questionnaires, and compliance reviews, providing the technical and organizational information required to support their regulatory obligations.

9. Sub-processors and suppliers

VANCAST may engage subcontractors for services necessary to provide the platform (hosting, CDN, technical services, etc.).

All sub-processors:

• Act under contractual agreements
• Comply with GDPR requirements
• Are subject to confidentiality and security obligations

VANCAST selects its suppliers based on technical solvency, regulatory compliance, and information security criteria, contractually requiring security levels equivalent to those defined in its ISO/IEC 27001–certified ISMS.

For regulated sectors, VANCAST applies enhanced control over the ICT supply chain.

10. International data transfers

10.1 Infrastructure and hosting

The platform is primarily hosted on Amazon Web Services (AWS) within the European Union. Data may be securely replicated within the European Economic Area (EEA).

10.2 Use of services in other regions

Any international data transfer outside the EEA will be carried out solely on the basis of valid legal mechanisms, such as Standard Contractual Clauses (SCCs) or other appropriate safeguards under the GDPR.

For financial-sector clients, any use of services outside the EEA will be subject to prior regulatory and operational risk assessment.

11. Applicable law

This Privacy Policy is governed by Spanish and European law.

Any dispute shall be submitted to the courts of Barcelona, unless otherwise required by applicable law.

Cookies Policy

12. Use of cookies

The VancastVideo platform uses exclusively technical and strictly necessary cookies to ensure its proper functioning.

These cookies:

• Enable navigation and authentication
• Maintain user sessions
• Do not perform advertising tracking
• Do not create user profiles

Characteristics:

• Limited duration (up to 1 month)
• Automatic renewal upon access
• Server-side session storage

Cookies on this website:

This website is hosted by Wix and uses the following cookies:

• wixSession (essential, session): maintains the visit's session with Wix so that the website works
• sec-fetch-unsupported (essential, session): set by Wix only when the browser cannot enable certain security features
• consent-policy (essential, 12 months): stores the user's choice on analytics cookies
• bSession (analytics, 30 minutes, only with consent): used by Wix Analytics to group the pages viewed into one visit

With the user's consent, Wix Analytics also records the pages viewed, so that VANCAST can count visits and understand how the website is used. Without consent, no analytics cookies are set and the visit is not reported to Wix Analytics.

Managing consent:

On the first visit, a banner asks the user to accept or reject analytics cookies. Rejecting them does not affect the use of the website. The choice can be changed at any time from “Cookie settings” at the bottom of every page.

13. Third-party cookies and external links

The website may contain links to external services not controlled by VANCAST. Users are encouraged to review the privacy and cookies policies of those services.

The calendar for booking a demo is provided by Calendly and is loaded from calendly.com only after the demo request form has been sent. Calendly may set its own cookies, which are governed by Calendly's cookie policy.

14. Modifications

VANCAST reserves the right to update this Privacy and Cookies Policy to reflect regulatory or functional changes. The current version will always be available on the website.