Privacy and Cookies

1. Data controller

The controller of the personal data processed through Bacan.com is:

Document pending completion before publication: replace the fields in brackets with the actual legal details of the data controller.

If Bacan.com formally appoints a Data Protection Officer in accordance with the applicable regulations, their contact details will be published in this policy. Until there is a formal appointment, privacy queries must be sent to the privacy email address indicated above.

• Controller: [Legal name of the company or responsible person]
• Trade name: Bacan.com
• Tax ID / company registration / tax identification number: [To be completed]
• Registered address: [To be completed]
• General email address: [soporte@bacan.com]
• Privacy email address: [privacidad@bacan.com]
• Contact of the Data Protection Officer, if applicable: [dpd@bacan.com]

2. Scope of application

This Privacy Policy applies to personal data processed by Bacan.com in relation to:

By using Bacan.com services, you declare that you have read this Privacy Policy and that the data you provide is true, accurate, current and corresponds to your identity or to an entity that you legitimately represent.

• Browsing the Bacan.com website.
• The contracting, trial, renewal or cancellation of services.
• Shared hosting, reseller hosting, VPS/Cloud, email, DNS, SSL certificates, installable applications, technical support and related services.
• Registration, resale, transfer, renewal or management of domains.
• Communications by email, tickets, forms, chat, telephone, WhatsApp or other channels offered by Bacan.com.
• Customers, users, resellers, affiliates, commercial leads, suppliers and persons who contact Bacan.com.
• Any other service that expressly links to this policy.

3. Bacan.com’s role as controller and processor

Bacan.com may act in different roles depending on the processing carried out.

3.1 Bacan.com as data controller

Bacan.com acts as data controller with respect to the data necessary to manage its relationship with customers, users, suppliers, leads, resellers and website visitors.

This includes, among other things, account data, billing, contracting, support, security, fraud prevention, Bacan.com’s own commercial communications, domain management and compliance with legal obligations.

3.2 Bacan.com as data processor

When the Customer hosts personal data of third parties in the contracted services, for example on a website, online store, database, email account, CRM, CMS or application installed on their hosting or VPS, the Customer may act as data controller with respect to such data, and Bacan.com may act as data processor only insofar as it provides the infrastructure or technical service contracted.

In such cases, the Customer is responsible for having a valid legal basis for processing such data, informing the data subjects, handling their rights and complying with the applicable regulations. Bacan.com will process such data only in accordance with the contract, the Customer’s documented instructions, the applicable regulations and the measures necessary to provide, protect and maintain the service.

When necessary, Bacan.com may make available to the Customer a data processing agreement or specific data processing clauses.

4. What personal data we process

Bacan.com processes only the data necessary to provide its services, manage the contractual relationship, handle requests, protect the infrastructure and comply with legal obligations.

Depending on the case, the following categories of data may be processed:

4.1 Identification and contact data

• First and last name.
• Company or entity represented.
• Identity document, tax ID, company tax number, RUC, passport or other tax identifier where necessary.
• Postal or tax address.
• Country, province/state, city or billing details.
• Email address.
• Telephone number.
• Administrative, technical or billing contact details.

4.2 Account and access data

• Username.
• Passwords stored in encrypted form or by means of a hash where applicable.
• Access history.
• IP address.
• Login records.
• Technical activity linked to the Client Area, control panels or support systems.
• Account preferences, language, notifications or service settings.

4.3 Contractual and billing data

Bacan.com does not store full bank card details when external payment gateways are used. Payment processing may be carried out by payment providers under their own terms and privacy policies.

• Services contracted.
• Orders, renewals, upgrades, cancellations and plan changes.
• Invoices, quotations and supporting documents.
• Payment status.
• Payment method data tokenized through external payment gateways.
• Commercial, administrative or technical incidents.
• History of service-related communications.

4.4 Support and communications data

• Support tickets.
• Emails sent or received.
• Messages sent through forms.
• Communications by chat, telephone, WhatsApp or other enabled channels.
• Recordings or logs of conversations where necessary and legally permitted.
• Attachments, screenshots, logs or technical information sent by the Customer to resolve incidents.

4.5 Technical and security data

• IP addresses.
• Server logs.
• Access logs for FTP, SSH, panels, email, web, databases or other services.
• Email headers.
• Security events.
• Technical traffic data.
• Device, browser or session identifiers.
• Cookies and similar technologies.
• Information about resource usage, errors, blocks, malware, spam, abuse or unauthorized access attempts.

4.6 Domain-related data

When the Customer registers, transfers, renews or manages a domain through Bacan.com, data required by the accredited registrar, wholesale provider, TLD Registry, ICANN or other competent entities may be processed and disclosed.

This data may include:

Bacan.com is not necessarily the direct accredited registrar of the domain. In many cases it acts as a reseller, intermediary or domain management provider.

• Domain registrant data.
• Administrative contact.
• Technical contact.
• Billing contact, where applicable.
• Verification email address.
• Data required to validate identity, eligibility or ownership.
• Information published or consultable on a limited basis through RDAP, WHOIS or other equivalent systems, according to the applicable policies.

4.7 Marketing and analytics data

Where there is a sufficient legal basis, Bacan.com may process:

• Newsletter subscription data.
• Communication preferences.
• Interaction with campaigns.
• Browsing data obtained through analytics or marketing cookies, if the user accepts them.
• Aggregated or statistical information about use of the website.

4.8 Special categories of data

Bacan.com does not request special categories of personal data, such as health data, ideology, religion, trade union membership, sexual orientation, biometric data or genetic data.

If the User or Customer voluntarily provides this type of information without it being necessary for the service, Bacan.com may delete it or apply additional protection measures where appropriate.

5. Purposes of processing and legal bases

Bacan.com processes personal data for the following purposes and legal bases:

Where the legal basis is consent, the User may withdraw it at any time without retroactive effect.

Where Bacan.com relies on legitimate interest, the User may object to the processing on grounds relating to their particular situation, unless there are compelling legitimate grounds or the need to establish, exercise or defend claims.

• Create and manage customer accounts: Performance of a contract or pre-contractual measures.
• Process orders, activations, renewals, changes and cancellations: Performance of a contract.
• Provide hosting, email, VPS/Cloud, DNS, certificates, support and related services: Performance of a contract.
• Register, transfer, renew or manage domains: Performance of a contract and compliance with sector-specific obligations.
• Issue invoices, manage payments and comply with accounting or tax obligations: Legal obligation.
• Handle commercial, technical or administrative queries: Pre-contractual measures, performance of a contract or legitimate interest.
• Manage tickets, incidents, support and operational communications: Performance of a contract and legitimate interest.
• Prevent fraud, spam, abuse, malware, phishing, attacks or unauthorized access: Legitimate interest and, where applicable, legal obligation.
• Protect the infrastructure, network security and service quality: Legitimate interest.
• Perform backups, technical audits and activity logs: Legitimate interest, performance of a contract and service security.
• Send service notices, incidents, renewals, technical changes or contractual information: Performance of a contract and legitimate interest.
• Send Bacan.com’s own commercial communications: Consent or legitimate interest where permitted by law.
• Carry out web analytics or remarketing: Consent, where required.
• Manage claims, disputes, abuses or legal requests: Legitimate interest and legal obligation.
• Selection of staff, collaborators or suppliers: Pre-contractual measures, consent or legitimate interest, depending on the case.

6. Recipients and processors

Bacan.com may share personal data only when necessary to provide the service, comply with legal obligations, protect its infrastructure, manage payments, process domains or handle Customer requests.

The recipients or categories of recipients may include:

Bacan.com will endeavor to sign the necessary data processing agreements with its providers when they act as processors, in accordance with the applicable regulations.

• Infrastructure, data center, network, connectivity, security, CDN, DDoS mitigation, monitoring and backup providers.
• Control panel, automation, billing, support, transactional email, chat, telephone or ticketing system providers.
• Payment gateways, banks, financial institutions and payment processors.
• Accredited registrars, wholesale providers, TLD Registries, ICANN and entities related to domain management.
• SSL/TLS certificate providers and identity validators where applicable.
• Analytics, measurement or marketing providers, only where there is a sufficient legal basis and, where appropriate, the user’s consent.
• Legal, tax and accounting advisers, auditors or professional consultants.
• Administrative, judicial, police, tax, regulatory or data protection authorities where there is a legal obligation or valid request.
• Providers necessary to investigate or mitigate abuse, fraud, malware, spam, phishing, attacks or security incidents.

7. International data transfers

Bacan.com services may involve the processing of data in different countries, including countries in the European Economic Area and, in some cases, countries outside the EEA.

Where international transfers of personal data are made outside the EEA or to countries that do not have an adequacy decision, Bacan.com will apply appropriate safeguards where necessary, such as:

The User may request additional information about the categories of providers and mechanisms used for the international transfers applicable to their case.

• Adequacy decisions recognized by the European Union.
• Standard Contractual Clauses.
• Supplementary technical and organizational measures.
• Minimization, encryption, pseudonymization or access limitation where feasible.
• Contracts with providers that offer sufficient guarantees.

8. Retention periods

Bacan.com will retain personal data for the time necessary to fulfill the purpose for which it was collected and, thereafter, for the applicable legal or contractual periods.

By way of guidance:

Once the applicable periods have ended, the data will be securely deleted, blocked or anonymized, unless there is a legal obligation, dispute, investigation or legitimate reason to retain it for longer.

• Account and contracted services: for as long as the contractual relationship remains in force and, after its termination, for the periods necessary to comply with legal, tax, accounting, contractual or claims-related obligations.
• Billing and accounting: for the periods required by the applicable tax, commercial or accounting regulations.
• Tickets and support communications: for the time necessary to provide support, maintain an incident history and address possible liabilities.
• Domain data: for the life of the domain and the periods required by registrars, Registries, ICANN, wholesale providers or applicable regulations.
• Security logs: for the minimum time necessary for security, fraud prevention, abuse detection, incident investigation or legal compliance.
• Marketing: until the user withdraws consent, unsubscribes or objects to the processing where applicable.
• Cookies: according to the duration indicated in the corresponding Cookie Policy or configuration panel.
• Backups: during the technical retention cycle of backups defined for each service.

9. Rights of data subjects

Data subjects may exercise, where applicable, the following rights:

To exercise these rights, any of the following means may be used:

1. From the Client Area, where available. 2. Through the Bacan.com contact form. 3. By writing to [privacidad@bacan.com]. 4. By writing to the general email address [soporte@bacan.com].

To protect the account and prevent improper access, Bacan.com may request additional information or identity verification before handling the request.

Exercising rights is free of charge, except for manifestly unfounded, excessive or repetitive requests, in which case Bacan.com may act in accordance with the applicable regulations.

Bacan.com will respond within the legally established periods. Where the request is complex or there are multiple requests, the period may be extended in accordance with the applicable regulations.

• Right of access.
• Right to rectification.
• Right to erasure.
• Right to object.
• Right to restriction of processing.
• Right to data portability.
• Right to withdraw consent where processing is based on consent.
• Right not to be subject to individual automated decisions with legal or similarly significant effects, where applicable.
• Right to lodge a complaint with the Spanish Data Protection Agency or another competent supervisory authority.

10. Data security

Bacan.com applies technical and organizational measures that are reasonable and appropriate to the risk in order to protect personal data against loss, misuse, unauthorized access, disclosure, alteration or destruction.

These measures may include, among others:

The Customer must also adopt appropriate security measures, including the use of secure passwords, additional authentication where available, updating CMSs, plugins and applications, safeguarding credentials and periodically reviewing access.

• Encryption of communications through HTTPS/TLS.
• Access control and least privilege.
• Passwords encrypted or stored by means of a hash where applicable.
• Firewalls, intrusion detection or prevention systems and anti-abuse rules.
• Technical monitoring.
• Backups.
• Activity logging.
• Segmentation and isolation of services where feasible.
• Anti-malware, anti-spam or anti-fraud protection.
• Incident management procedures.
• Training or internal instructions on confidentiality and security.
• Confidentiality agreements or contractual clauses with providers.

11. Minors

Bacan.com services are intended for adults or legally represented entities.

Bacan.com does not seek to collect data from minors. If it is detected that an account has been created by a minor without valid authorization, Bacan.com may suspend it, cancel it or delete the associated data, without prejudice to retaining the information necessary to comply with legal or security obligations.

12. Automated decisions and profiling

Bacan.com does not make automated decisions with legal effects on users or with similarly significant effects.

However, it may use automated or semi-automated systems to:

Where processing is based on consent, the user may withdraw it. Where it is based on legitimate interest, the user may object under the terms provided by the applicable regulations.

• Detect spam, malware, phishing, fraud or abuse.
• Protect accounts and services.
• Limit suspicious sending.
• Identify anomalous activity.
• Improve the security and quality of the service.
• Carry out analytics or remarketing where there is valid consent.

13. Cookies and similar technologies

Bacan.com may use cookies and similar technologies so that the website, Client Area and services operate correctly.

Cookies may be classified as:

Non-necessary cookies will be used only where there is a sufficient legal basis and, where applicable, the user’s consent.

The user may accept, reject, configure or withdraw consent from the cookie preferences panel where available.

For more information about cookie types, providers, purposes, duration and settings, Bacan.com may publish a specific Cookie Policy linked from the banner or footer.

• Technical or necessary cookies: allow browsing, authentication, security, operation of the Client Area, shopping cart, essential preferences or provision of the requested service.
• Preference cookies: allow settings such as language, region or display preferences to be remembered.
• Analytics cookies: allow measuring the use of the website and improving the service.
• Marketing or advertising cookies: allow measuring campaigns, showing personalized content or carrying out remarketing, where used.

14. Embedded content and third-party links

Bacan.com pages may include links or embedded content from third parties, such as videos, maps, images, social buttons, external documentation, support tools, payment gateways or other services.

Embedded third-party content may behave as if the user directly visited that third party’s website. Such third parties may collect data, use cookies, apply tracking technologies or record the user’s interaction in accordance with their own privacy policies.

Bacan.com does not control and assumes no responsibility for the privacy policies, cookies or practices of third parties outside Bacan.com.

15. Commercial communications

Bacan.com may send commercial communications about products, services, promotions, news or content related to its services where there is user consent or where the applicable regulations allow this on the basis of a prior contractual relationship or legitimate interest.

The user may unsubscribe or withdraw consent at any time by means of:

Withdrawal of consent will not affect the lawfulness of processing carried out before such withdrawal.

Operational, technical, contractual, security, billing, renewal or support communications are not considered commercial communications and may be sent while necessary for the provision of the service or legal compliance.

• The unsubscribe link included in commercial communications, where available.
• The Client Area, where this option exists.
• A request sent to [privacidad@bacan.com] or [soporte@bacan.com].

16. Specific information about domains

To register, transfer, renew, restore or manage a domain name, Bacan.com may need to share registrant data and associated contact details with accredited registrars, wholesale providers, TLD Registries, ICANN, validation entities or competent authorities.

Some domain policies may require:

The legal basis for these processing activities will be, depending on the case, performance of the contract, compliance with legal or sector-specific obligations and legitimate interest in preventing fraud, abuse or disputes.

Failure to provide data, data inaccuracy or failure to verify data may prevent the registration, transfer, renewal, restoration or maintenance of the domain.

• Email verification.
• Validation of identity or eligibility.
• Limited publication of data through RDAP/WHOIS.
• Retention of data by the registrar, wholesale provider or Registry.
• Disclosure of data to authorities or dispute resolution entities.
• Application of mandatory sector-specific policies.

17. Resale, affiliates and end customers of resellers

When a reseller contracts Bacan.com services to offer them to its own end customers, the reseller is responsible for adequately informing such customers about the processing of their data and for having the necessary legal bases.

Bacan.com may process data of resellers’ end customers to the extent necessary to provide support, manage services, investigate abuse, process domains, comply with legal obligations or protect the infrastructure.

The reseller must ensure that its end customers know and accept the applicable conditions where appropriate.

18. Indicative list of providers

Bacan.com may use different providers depending on the contracted service. The following list is indicative and not exhaustive:

Bacan.com may maintain an internal record of processing activities and, where appropriate, data processing agreements with its providers.

• Payments: payment gateways, banks, payment processors and anti-fraud systems.
• Infrastructure: data centers, network providers, CDN, security, DDoS mitigation, monitoring and backups.
• Support and communications: ticketing systems, transactional email, chat, telephone, messaging or customer service tools.
• Domains: accredited registrars, wholesale providers, TLD Registries, ICANN and validation entities.
• Certificates: certification authorities and SSL/TLS validation providers.
• Analytics and marketing: web analytics, campaign measurement or remarketing providers, only where there is a sufficient legal basis.
• Professional services: legal, tax and accounting advisers, auditors or consultants.

19. Complaints to a supervisory authority

If the user considers that the processing of their personal data infringes the applicable regulations, they may lodge a complaint with the competent supervisory authority.

In Spain, the supervisory authority is the Spanish Data Protection Agency (AEPD).

Website: https://www.aepd.es

20. Changes to this Privacy Policy

Bacan.com may modify this Privacy Policy to adapt it to legal, technical, operational, commercial, security, case-law or provider changes.

The current version will always be the one published on the Bacan.com website.

Where the change is material and significantly affects purposes, legal bases, recipients, rights or essential conditions of the processing, Bacan.com will attempt to communicate it by reasonable means, such as a notice on the website, email, Client Area or ticketing system.

21. Applicable law and dispute resolution

This Privacy Policy will be governed by the law indicated in the General Terms and Conditions of Bacan.com or in the contract applicable to the Customer.

Where there is no specific provision and unless a mandatory rule provides otherwise, Spanish law will apply and the parties will submit to the courts and tribunals that correspond in accordance with the applicable regulations.

22. How to contact us

For any matter related to privacy, data protection or the exercise of rights, you may contact Bacan.com through:

Before publishing this policy, Bacan.com must confirm that the email addresses and postal address indicated are active and correspond to the actual controller of the processing.

• Privacy email: [privacidad@bacan.com]
• General email: [soporte@bacan.com]
• Web form: https://bacan.com/contacto
• Postal address: [To be completed]