Zetein
ZETEIN / CLEAR FROM THE START

Privacy policy

Last updated: August 2026

1. Controller of the site and role in the processing

The owner of Zetein is Hefiris SW Sociedad Limitada, Tax ID B93857498, with registered office at Calle Hernández Lázaro 34, 6.º B — 46015 Valencia, and contact e-mail contacto@zetein.es.

Dual capacity depending on the type of data:

  • With regard to the data of persons who contract or register with Zetein (account, billing and contact details of the customer), Hefiris acts as CONTROLLER of the processing.
  • With regard to the personal data that the contracting company enters into the platform about its own personnel, its works and third parties (workers, supervisors, photographs, work reports, etc.), Hefiris acts as PROCESSOR, processing them on behalf of and according to the instructions of the contracting company, which is the CONTROLLER of such data.

This Policy mainly governs the first capacity. The relationship as Processor is governed by the Data Processing Agreement entered into with each contracting company (see Annex).

2. Data we process as controller

In relation to the customer’s account, we may process:

  • Identification and contact details: name and surname, company name, tax ID, address, telephone and e-mail address.
  • Access data: e-mail address and credentials (the password is stored encrypted and is not accessible in clear text by the Owner).
  • Billing and subscription data: plan contracted, subscription status and payment identifiers managed by the payment provider.
  • Technical usage data necessary for the provision and security of the Service.

3. Purposes and legal bases

  • To provide and manage the contracted Service and the relationship with the customer — legal basis: performance of the contract.
  • To manage the collection of subscriptions — legal basis: performance of the contract and legal obligation in tax matters.
  • To ensure the security, integrity and correct functioning of the Service — legal basis: legitimate interest of the Owner.
  • To handle communications and support — legal basis: performance of the contract and legitimate interest.
  • To comply with legal obligations (tax, accounting) — legal basis: legal obligation.

4. End-to-end encryption

Zetein incorporates end-to-end encryption over site data. Sensitive data are encrypted on users’ devices with a company encryption key that resides only on those devices and that the Owner neither stores nor can know. As a result:

  • The Owner holds the encrypted information but cannot access its content in clear text, with the sole exception set out in section 4.1.
  • Recovery of access depends on the contracting company retaining its company encryption key. Its loss, together with that of the credentials, may irreversibly prevent the recovery of the data.
  • This architecture reinforces the confidentiality of the customer’s site data, over which it retains effective control at all times.

4.1. Sole exception: sending the work order to the end client

When a user chooses to email a work order to the end client who signed it, the PDF document is transmitted to the Owner’s server unencrypted. This is technically unavoidable in order to attach it to the message, since the recipient is a third party outside the Service who holds no encryption key. This operation is carried out solely at the user’s express instruction, document by document, and never automatically, and is subject to the following safeguards:

  • The document is processed in memory only for the duration of the send: it is not written to disk, not stored in the database, and no copy is retained once the message has been sent.
  • The recipient’s email address is used solely for that particular send and is not stored.
  • Neither the document nor the recipient’s address is recorded in activity logs.
  • All other site information remains end-to-end encrypted, without exception.

The contracting company, as data controller, decides whether to send the document and must ensure it has a legal basis for disclosing it to its client.

5. Recipients and processors

In order to provide the Service, the Owner may use providers acting as data processors, such as the server hosting provider, the payment gateway provider and the e-mail delivery provider, which in the case described in section 4.1 also processes the attached document. Those providers process the data in accordance with the Owner’s instructions and with the safeguards required by law. Data are not transferred to third parties except where legally required.

6. Retention

Work orders sent to the end client under section 4.1 are not retained: they are discarded once the message has been sent.

Other data shall be retained for as long as the contractual relationship is maintained and, thereafter, for the periods legally required to address potential liabilities (in particular, tax and commercial periods). Once those periods have elapsed, the data shall be deleted or anonymised.

7. Rights of data subjects

Data subjects may exercise their rights of access, rectification, erasure, objection, restriction of processing and portability by writing to contacto@zetein.es, proving their identity. They may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they consider that their rights have not been properly addressed.

Where the data have been entered into the platform by a contracting company (Controller), the Owner, in its capacity as Processor, shall forward to that company any requests to exercise rights it receives, so that the company may handle them.

8. Security

The Owner applies appropriate technical and organisational measures to protect the data, including encryption, access control, activity logging and backups, aimed at ensuring the confidentiality, integrity and availability of the information.

9. Changes to the Policy

The Owner may update this Policy to adapt it to regulatory or Service changes, informing of this through the usual means of communication with customers.

Annex — Data Processing Agreement

This Annex forms an inseparable part of the Privacy Policy and of the Terms and Conditions of Zetein, and is accepted at the time of contracting the Service.

1. Parties

Of the one part, the CONTRACTING COMPANY identified in its registration with Zetein, hereinafter the «Controller».

Of the other part, Hefiris SW Sociedad Limitada, hereinafter the «Processor».

Both parties acknowledge that they have sufficient capacity and agree to enter into this Data Processing Agreement (hereinafter, «the Agreement»), which forms an inseparable part of the Terms and Conditions of Zetein.

2. Purpose

This Agreement governs the processing of personal data carried out by the Processor on behalf of the Controller as a result of the provision of the Zetein service, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

3. Description of the processing

  • Nature and purpose: hosting, management, storage (in encrypted form) and making available of the site data entered by the Controller into the Zetein platform.
  • Type of data: identification and contact details of the Controller’s personnel and collaborators, content of work reports and site communications, and images in which people may appear.
  • Categories of data subjects: the Controller’s personnel, personnel of invited subcontracted companies and other parties involved in the works managed.
  • Duration: that of the contracted service, until the end of the relationship and the subsequent return or deletion of the data.

4. Obligations of the Processor

The Processor undertakes to:

  • Process the data only in accordance with the documented instructions of the Controller, including as regards international transfers; use of the platform in accordance with its purpose constitutes such instructions.
  • Not use the data for any purpose other than the provision of the Service, nor transfer them to third parties except where legally required.
  • Ensure that persons authorised to process the data undertake to respect confidentiality.
  • Apply appropriate technical and organisational security measures, including the end-to-end encryption described in the Privacy Policy.
  • Assist the Controller, as far as possible, in responding to data subjects’ rights and in complying with its security and notification obligations.
  • Notify the Controller, without undue delay, of any personal data breaches of which it becomes aware.
  • Obtain the Controller’s authorisation before engaging sub-processors, maintaining with them the same obligations set out herein.
  • At the Controller’s choice, return or delete the data once the provision has ended, unless they must be retained by legal obligation, and without prejudice to clause 13 of the Terms and Conditions regarding total cessation of activity.

5. Obligations of the Controller

  • Have an adequate legal basis for the processing of the data it enters into the platform and duly inform data subjects.
  • Give the Processor lawful and documented instructions.
  • Diligently safeguard the company encryption key and the access credentials, assuming the consequences of their loss in accordance with the encrypted architecture of the Service.
  • Ensure the proper use of the platform by its authorised users.

6. Sub-processors

The Controller generally authorises the Processor to use the providers necessary for the provision of the Service (hosting, payment gateway and e-mail delivery, among others), which shall act as sub-processors with the safeguards required by the GDPR. The Processor shall report any change affecting such sub-processors, allowing the Controller to object on justified grounds.

7. Security measures

The Processor shall apply the appropriate measures in accordance with Article 32 GDPR, taking into account the state of the art and the risks of the processing, including: encryption of site data, role-based access control, activity logging, backups and restoration procedures.

8. Liability

Each party shall be liable for the damages it causes through breach of its respective obligations under the GDPR and applicable law. The Processor’s liability shall be without prejudice to the limits agreed in the Terms and Conditions of the Service, to the extent that they are compatible with data protection legislation.

9. Duration and applicable law

This Agreement shall remain in force for as long as the Service is provided. It is governed by Spanish and European Union data protection law. For any dispute, the parties submit to the Courts and Tribunals of Valencia.

In witness whereof, the parties accept this Agreement at the time of contracting the Service.

Language. This is an English translation provided for convenience. The Spanish version published at zetein.es/politica-de-privacidad is the binding text; in the event of any discrepancy, the Spanish version prevails.