Privacy at Silurian

Who is responsible for your data

Silurian SL is the data controller for the personal data described in this policy when you visit a Silurian website, contact us, create an account, purchase a service or use Workspace. For services where a customer determines why and how Silurian processes data on its behalf, Silurian may instead act as that customer's processor under the applicable service agreement.

The AEPD number is retained for historical transparency. The former Spanish obligation to register personal-data files was abolished when the GDPR became applicable and was replaced by the controller's internal record of processing activities; it is not a current certification or approval.

We apply data minimisation: service, account and security data are used only where needed to deliver the requested relationship, comply with law, protect the platform or support a choice you have made.

Data we use

Where the data comes from

Most data comes directly from you. It may also come from an authorised administrator of your organisation, identity providers when you choose a social sign-in, payment and service providers involved in your transaction, public company or tax registers used for verification, and technical events generated when you use or secure the platform.

Sensitive data and children

Our services are not designed to collect special-category data. Please do not include health, biometric, political, religious or similarly sensitive information in tickets unless it is strictly necessary for your request. Silurian's commercial services are not directed to children, and we do not knowingly create customer accounts for children acting on their own behalf.

Purposes and legal bases

Required information

Fields marked as required are necessary to create the requested account, ticket, order or service, or to meet billing and legal requirements. If you do not provide them, we may be unable to complete that request. Optional fields can be left blank without losing access to unrelated services.

Automated processing and AI

Silurian does not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Automated security and fraud signals may flag activity for restriction or human review. Helpdesk AI may classify, summarise, translate or suggest a draft, but a Silurian agent remains responsible for customer-facing decisions and replies.

Sharing and international transfers

We disclose only the data necessary to the following categories of recipients:

• hosting, network delivery, security, backup and operational infrastructure providers;
• communications and support providers used to deliver requested email, SMS or ticket services;
• payment processors, banks, accounting providers and fraud-prevention services involved in a transaction;
• domain registries, infrastructure platforms and other suppliers needed to provide the service you selected;
• professional advisers, auditors and insurers subject to appropriate duties of confidentiality; and
• courts, regulators, tax authorities, law-enforcement bodies or other recipients where disclosure is legally required or necessary to establish, exercise or defend legal claims.

Providers processing data for Silurian are limited by contract and may process it only for documented purposes. Some selected services, identity providers or infrastructure providers may process data outside the European Economic Area. Where no European Commission adequacy decision applies, Silurian relies on an applicable safeguard such as the European Commission's Standard Contractual Clauses and supplementary technical or organisational measures. You may request information about the relevant mechanism and how to obtain a copy through the privacy contact route.

Buying a third-party service from Silurian does not by itself authorise that provider to track your visits to this website.

Services and providers

This register names the principal external services that may receive personal data in a current Silurian journey. A provider is not given every category of data listed in this policy: it receives only what is needed for the stated journey. Its role may vary between processor, independent controller or separate service supplier according to the service and applicable agreement.

Retention and security

We apply the following retention criteria unless a longer or shorter period is required by law, an active dispute, a security investigation or the service contract:

When data is no longer needed, it is deleted, securely isolated until backup rotation completes, or anonymised where practical.

Access controls, encryption in transit, audit evidence, provider boundaries and operational review help protect Silurian services. No internet service can promise absolute security; we investigate and respond to suspected incidents according to their risk.

Your rights

Subject to the conditions in applicable law, you may:

• request access to your personal data and information about its processing;
• correct inaccurate data and complete incomplete data;
• request deletion or restriction of processing;
• object to processing based on legitimate interests or to direct marketing at any time;
• receive portable data where processing is automated and based on consent or contract;
• withdraw consent at any time without affecting processing already carried out lawfully; and
• request human intervention where a legally significant decision would be based solely on automated processing.

We may need to verify your identity and authority before acting, and we will explain if a legal exception prevents all or part of a request. Account controls can handle ordinary profile changes; use the Privacy & data protection ticket route for a formal request.

You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority, particularly where you habitually live or work or where you believe an infringement occurred. Contacting Silurian first is optional.

Website and cookies

Silurian uses essential browser storage for security, sessions, country and language routing, carts and the record of your cookie choice. Optional categories are disabled unless you enable them. Changing the choice stops future loading; a third party may require you to remove data it already stored through your browser settings.

When you save a choice, Silurian records the exact optional categories, the applicable cookie-text version, time and a pseudonymous browser identifier in signed integrity evidence. If you are signed in, the event may also be associated with your verified account so that it can later be shown and managed in Workspace. Rejecting or withdrawing optional categories is recorded as a choice too; it never creates marketing permission.

Cookies and browser storage currently used

This register is deliberately limited to cookies, local storage and similar browser-side technology. The separate Services and providers section explains external recipients and product suppliers. “Control” describes whether browser storage is essential, initiated by your action or governed by optional settings; “When it appears” describes the technical condition that causes it to be used.

Blocking necessary storage may prevent sign-in, security checks, carts, regional continuity or payments from working. You can remove stored data in your browser, and you can change Silurian's optional categories at any time.

Contact and policy changes

Send privacy questions, objections, withdrawal requests or requests to exercise your rights through our secure contact route. The Privacy & data protection category is selected automatically.