Privacy at Silurian

Who is responsible for your data

Silurian SL is the data controller for the personal data described in this policy when you visit a Silurian website, contact us, create an account, purchase a service or use Workspace. For services where a customer determines why and how Silurian processes data on its behalf, Silurian may instead act as that customer's processor under the applicable service agreement.

For registrant and contact data used to register and manage a domain through Netim, Silurian and Netim act as joint controllers under Article 26 GDPR. Silurian selects the customer and domain operation and manages the customer relationship; Netim determines the technical and regulatory processing required as the official registrar, including identity verification, registration-data publication and transmission to the responsible registry.

The AEPD number is retained for historical transparency. The former Spanish obligation to register personal-data files was abolished when the GDPR became applicable and was replaced by the controller's internal record of processing activities; it is not a current certification or approval.

We apply data minimisation: service, account and security data are used only where needed to deliver the requested relationship, comply with law, protect the platform or support a choice you have made.

Data we use

Where the data comes from

Most data comes directly from you. It may also come from an authorised administrator of your organisation, identity providers when you choose a social sign-in, payment and service providers involved in your transaction, public company or tax registers used for verification, and technical events generated when you use or secure the platform.

Sensitive data and children

Our services are not designed to collect special-category data. Please do not include health, biometric, political, religious or similarly sensitive information in tickets unless it is strictly necessary for your request. Silurian's commercial services are not directed to children, and we do not knowingly create customer accounts for children acting on their own behalf.

Purposes and legal bases

Required information

Fields marked as required are necessary to create the requested account, ticket, order or service, or to meet billing and legal requirements. If you do not provide them, we may be unable to complete that request. Optional fields can be left blank without losing access to unrelated services.

If you provide personal data for another domain contact, you must be authorised to do so and must give that person the same domain-registration privacy information available to you. Silurian records and transmits only the contact roles and data required for the selected registration and extension.

Automated processing and AI

Silurian does not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Automated security and fraud signals may flag activity for restriction or human review. Helpdesk AI may classify, summarise, translate or suggest a draft, but a Silurian agent remains responsible for customer-facing decisions and replies.

Sharing and international transfers

We disclose only the data necessary to the following categories of recipients:

• hosting, network delivery, security, backup and operational infrastructure providers;
• communications and support providers used to deliver requested email, SMS or ticket services;
• payment processors, banks, accounting providers and fraud-prevention services involved in a transaction;
• Netim as official registrar, the registry responsible for the selected extension, and other suppliers needed to perform a domain operation;
• professional advisers, auditors and insurers subject to appropriate duties of confidentiality; and
• courts, regulators, tax authorities, law-enforcement bodies or other recipients where disclosure is legally required or necessary to establish, exercise or defend legal claims.

Providers processing data for Silurian are limited by contract and may process it only for documented purposes. Some selected services, identity providers or infrastructure providers may process data outside the European Economic Area. Where no European Commission adequacy decision applies, Silurian relies on an applicable safeguard such as the European Commission's Standard Contractual Clauses and supplementary technical or organisational measures. You may request information about the relevant mechanism and how to obtain a copy through the privacy contact route.

Buying a third-party service from Silurian does not by itself authorise that provider to track your visits to this website.

Services and providers

This register names the principal external services that may receive personal data in a current Silurian journey. A provider is not given every category of data listed in this policy: it receives only what is needed for the stated journey. Its role may vary between processor, independent controller or separate service supplier according to the service and applicable agreement.

Retention and security

We apply the following retention criteria unless a longer or shorter period is required by law, an active dispute, a security investigation or the service contract:

When data is no longer needed, it is deleted, securely isolated until backup rotation completes, or anonymised where practical.

Access controls, encryption in transit, audit evidence, provider boundaries and operational review help protect Silurian services. No internet service can promise absolute security; we investigate and respond to suspected incidents according to their risk.

Your rights

Subject to the conditions in applicable law, you may:

• request access to your personal data and information about its processing;
• correct inaccurate data and complete incomplete data;
• request deletion or restriction of processing;
• object to processing based on legitimate interests or to direct marketing at any time;
• receive portable data where processing is automated and based on consent or contract;
• withdraw consent at any time without affecting processing already carried out lawfully; and
• request human intervention where a legally significant decision would be based solely on automated processing.

We may need to verify your identity and authority before acting, and we will explain if a legal exception prevents all or part of a request. Account controls can handle ordinary profile changes; use the Privacy & data protection ticket route for a formal request.

For domain holder or contact data, you may submit your request to Silurian. We will coordinate the request with Netim and, where necessary, the responsible registry. We answer without undue delay and normally within one month, subject to the extensions and exceptions allowed by applicable law.

You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority, particularly where you habitually live or work or where you believe an infringement occurred. Contacting Silurian first is optional.

Website and cookies

Silurian uses essential browser storage for security, sessions, country and language routing, carts and the record of your cookie choice. Optional categories are disabled unless you enable them. Changing the choice stops future loading; a third party may require you to remove data it already stored through your browser settings.

When you save a choice, Silurian records the exact optional categories, the applicable cookie-text version, time and a pseudonymous browser identifier in signed integrity evidence. If you are signed in, the event may also be associated with your verified account so that it can later be shown and managed in Workspace. Rejecting or withdrawing optional categories is recorded as a choice too; it never creates marketing permission.

Campaign and affiliate attribution

If you reach a supported Silurian V2 page through a tagged link, Silurian may read bounded values from utm_source, utm_medium, utm_campaign, utm_content, utm_term, partner and click_id. Standard Google Ads (gclid, gbraid and wbraid), Microsoft Ads (msclkid) and Meta (fbclid) click identifiers are also recognised. Partners must use opaque identifiers and must not place names, email addresses, payment information or other directly identifying data in these parameters.

A qualifying arrival is held temporarily in the server-side PHP session while your choice is pending. Only after Silurian has valid signed marketing-consent evidence is it persisted as a first or last campaign touch, associated with the cart and copied as a tamper-evident snapshot into an order. The snapshot may contain the bounded campaign fields, partner and click identifiers, the landing path, external referrer host and observation time. It helps authorised Silurian staff identify the source, campaign or affiliate responsible for a sale, measure conversions and review any commission. It is visible in the restricted Operations Center order detail; it is not added to the public invoice.

Silurian does not retain a raw referrer query string and normally cannot determine the exact words used in an organic search. Rejecting or withdrawing marketing consent clears pending/session attribution and detaches it from carts so that a later order does not freeze it. Withdrawal does not rewrite an immutable order snapshot created while valid consent applied; that evidence follows the relevant order, affiliate-settlement, audit, dispute and legal retention criteria.

Cookies and browser storage currently used

This register is deliberately limited to cookies, local storage and similar browser-side technology. The separate Services and providers section explains external recipients and product suppliers. “Control” describes whether browser storage is essential, initiated by your action or governed by optional settings; “When it appears” describes the technical condition that causes it to be used.

Blocking necessary storage may prevent sign-in, security checks, carts, regional continuity or payments from working. You can remove stored data in your browser, and you can change Silurian's optional categories at any time.

Contact and policy changes

Send privacy questions, objections, withdrawal requests or requests to exercise your rights through our secure contact route. The Privacy & data protection category is selected automatically.