Legal

Privacy policy

Last updated: September 2026

At Iristrace we are committed to ensuring that your personal data is protected and is not used for purposes other than those set out in this Privacy Policy.

Table of contents

Who is the controller of your personal data?
What requirements must you meet in order to provide us with your personal data?
What data processing do we carry out through the Website?
Who do we disclose your personal information to?
Is your personal data transferred to third countries outside the European Economic Area?
What rights can you exercise as a data subject?
How do we guarantee the confidentiality of your information?
Changes to this Policy

At Iristrace we are committed to ensuring that your personal data is protected and is not used for purposes other than those set out in this Privacy Policy. For this reason, in this section we inform users and data subjects of everything concerning the processing of their personal data, thereby complying with the applicable data protection legislation: Regulation (EU) 2016/679, of 27 April 2016 ("GDPR") and, where applicable, Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales ("LOPDGDD", Spanish data protection law).

This Privacy Policy applies to the data processing carried out through the website www.iristrace.com (the "Website") and/or through the channels indicated. We recommend that you read it carefully before using the Website or providing your data through it. You can send us any questions about it by email to contracts@iristrace.com.

1. Who is the controller of your personal data?

The controller of your personal data depends on the version of the Website through which you provide us with your data:

Spanish version of the Website: your data will be processed by IRISTRACE IBERIA, S.L. ("Iristrace"), with NIF B54951488 and registered office at Avenida Juan Carlos I, 22-24, 03440 Ibi, Alicante (Spain). Contact email: contracts@iristrace.com.
English version of the Website: your data will be processed by IRISTRACE B.V. ("Iristrace"), with NIF 854122564B01 and registered office at The Hague Security Delta, Wilhelmina van Pruisenweg 104, 2595 AN, The Hague (Netherlands). Contact email: contracts@iristrace.com.

This correspondence applies equally to the processing of personal data arising from the contractual relationship entered into with each of these entities, in line with the provisions of the Iristrace Terms and Conditions for the Provision of Services.

2. What requirements must you meet in order to provide us with your personal data?

2.1. Minimum age. In order to provide us with your personal data, you must be at least 14 years old and/or, where applicable, have sufficient legal capacity to use the Website.
2.2. Accuracy. When you provide us with your data, you warrant that the information supplied is real, truthful, up to date and belongs to you and not to third parties. You must notify us of any change in the data provided.
2.3. Age and accuracy checks. Iristrace reserves the right to verify your age and identification information at any time and, if fraud is detected or suspected, to delete, temporarily deactivate and/or cancel your account.

3. What data processing do we carry out through the Website?

3.1. When you contact us (chat, contact form, meeting form or email)

Collection channels: chat, contact form, form to schedule a meeting or request a demo, and emails sent to contracts@iristrace.com or other Iristrace addresses.
Data collected: identification data (first name and surname), telephone number, email address, company name or website, country or region, job title, and any other information you voluntarily include. Chat support may use automated software (chatbots) to categorise your enquiry.
Purposes: to answer your requests and follow up on them; to manage the meeting or demo requested; to improve our customer support service; and, once anonymised, to analyse the most frequent enquiries in order to prepare FAQs.
Legal basis: your consent, given when you voluntarily contact us. The information will be mandatory where it is marked as such; without it we will not be able to deal with your request.
Retention period: for as long as your request is being handled and, once that period has ended, blocked for the legal limitation periods for liability.
Disclosure of data: no disclosure takes place beyond that indicated generally in section 4, without prejudice to the fact that some contact channels are managed by service providers acting as Data Processors.

3.2. When you sign up to receive our communications (newsletter)

We collect your email address and, where applicable, your name, for the purpose of sending you commercial information about our products and services by electronic means, on the basis of your consent. You can unsubscribe at any time through the link included in each communication or by writing to contracts@iristrace.com.

3.3. When you apply for a job opening

We collect the data included in your CV and associated communications in order to manage the selection process, on the basis of your consent. We will keep the information for the duration of the selection process or until you request its deletion, and thereafter blocked for the legal limitation periods.

3.4. Browsing the Website (cookies)

We use cookies or other tracking tools to collect information about how you use the Website. For more information, see our Cookies Policy.

3.5. Use of social plug-ins or add-ons

When you share information on social networks (Facebook, X/Twitter, LinkedIn) through a social plug-in, data such as the date and time of the visit, the URL, your IP address, the browser and operating system used and, where applicable, your username is transferred to the relevant social network. Iristrace has no influence over the information the social network collects through these plug-ins.

3.6. Iristrace profiles on social networks

When you become a follower of our profiles on social networks, the processing of your data is governed by the terms of that social network. Iristrace will process your data in order to manage its presence on the social network and to inform you about its activities, products or services.

4. Who do we disclose your personal information to?

As a general rule, we do not disclose your data to third parties, except in the following cases:

Providers of services that are essential for the provision of the Website (e.g. IT hosting or communication-sending platforms), which act as Data Processors bound by a confidentiality agreement and by our instructions.
Public authorities, where there is a legal obligation or in order to prevent or prosecute fraudulent activities.
In the event of a corporate transaction (merger, acquisition or sale of assets), to the successor entity.
To third parties, after the data has been aggregated or anonymised.
To third parties, with your consent or on another legitimate basis that will be expressly communicated to you.

This Privacy Policy refers exclusively to the information collected through your interaction with the Website. Third-party pages linked from it have their own privacy policies, over which we have no control.

Note: the processing of personal data that Iristrace may carry out on behalf of its customers as a result of the provision of the Services (Iristrace Checks, Iristrace Docs) is not governed by this Privacy Policy, but by the Data Processing Agreement included in the Iristrace Terms and Conditions for the Provision of Services.

5. Is your personal data transferred to third countries outside the European Economic Area?

Some of our service providers are located outside the European Economic Area ("EEA"), which entails an international transfer of your personal data. Iristrace applies the necessary safeguards so that such transfers do not entail a lower level of protection, by entering into the Standard Contractual Clauses approved by the European Commission or another valid mechanism under Articles 45, 46 or 47 GDPR.

The list of providers outside the EEA and their transfer mechanism is kept up to date and can be requested through contracts@iristrace.com; as at the date of this Policy, it includes, among others, Google Marketing Platform and HubSpot (United States), both with Standard Contractual Clauses in place.

International data transfers based on adequacy decisions in force adopted by the European Commission, for which reason the user's consent is not required, since that Authority guarantees an adequate level of protection (Art. 45.1 GDPR).

6. What rights can you exercise as a data subject?

You can exercise the rights guaranteed to you by law by writing to contracts@iristrace.com. In some cases we may ask you for a copy of your identity document in order to verify your identity. We will resolve your request within the maximum period established by the applicable legislation.

i. Right to withdraw consent: you can withdraw it at any time, without this affecting the lawfulness of the processing carried out before the withdrawal.
ii. Right of access: to know what data we process, its origin, recipients, purposes, the existence of automated decisions, the retention period and your rights.
iii. Right to rectification: to correct or complete your data.
iv. Right to erasure: to request the deletion of your data when it is no longer necessary or there is no legitimate basis for its processing.
v. Right to data portability: where the processing is based on your consent or on the performance of a contract and is carried out by automated means.
vi. Right to restriction of processing: in the cases provided for in Article 18 GDPR.
vii. Right to object: to processing based on our legitimate interest, including profiling, and in particular to receiving commercial communications.
viii. Right to lodge a complaint with the Supervisory Authority: if you consider that we have infringed your right to data protection, you may lodge a complaint with: (i) the Agencia Española de Protección de Datos (AEPD) (www.aepd.es), where the controller is Iristrace Iberia, S.L.; or (ii) the Dutch Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl), where the controller is Iristrace BV — without prejudice to your right to lodge a complaint with the supervisory authority of your country of habitual residence.

7. How do we guarantee the confidentiality of your information?

The security of your personal data is a priority for us. Iristrace has implemented the technical and organisational security measures necessary to safeguard the confidentiality and integrity of your data, in line with the state of the art at any given time. Nevertheless, it is impossible to guarantee its security absolutely, given the very nature of the Internet. We undertake to act swiftly and diligently in the event of any security incident and to inform you where relevant.

Iristrace has entered into confidentiality agreements with employees and data processors in order to maintain the privacy of the information.

8. Changes to this Policy

Iristrace may modify the content of this Privacy Policy at any time, in particular where there are changes in legislation, case law or in the interpretation of the competent supervisory authorities. If the revised version includes a substantial change, we will notify you at least 30 days in advance by means of a notice on the Website or by email.

This Privacy Policy was last amended in September 2026.