Privacy policy

1. Data controller

Controller

Raupar Solution S.L.U.

Tax ID (CIF)

B26744714

Registered office

Calle Enric Prat de la Riba, 78 · 08790 Gelida (Barcelona) · Spain

Privacy contact

privacy@raupar.com

2. Scope of this policy

This policy applies primarily to the marketing website at incentia.app. Personal data processed inside the IncentIA platform itself (app.incentia.app) is governed by the data processing agreement signed with each enterprise customer, whose essential terms are summarised in section 10 below.

3. What data we process on this site

This website is a static marketing page. It does not contain forms, login areas, account systems or comment sections. The data processed on this site is therefore minimal:

• Email correspondence. When you click an email link (such as "Request demo" or "Talk to sales") your email client opens with a pre-filled message addressed to hello@raupar.com or sales@raupar.com. If you choose to send the message, we will receive your email address and any content you include, and we will process it for the purpose of responding to your enquiry.
• Server access logs. Our hosting provider records standard technical data when your browser requests pages — for example IP address, user agent, requested URL and timestamp. These logs are kept for security and operational purposes for a limited period, as defined by the hosting provider's policy.

4. Cookies

This website does not set first-party cookies and does not use analytics, tracking pixels or marketing cookies. Because no non-essential cookies are used, no cookie consent banner is presented.

If this changes in the future (for example when analytics is introduced), this policy will be updated and an appropriate consent mechanism will be added.

5. Third-party services

Loading this website establishes no connections to third-party origins. The typeface is served from this domain, and the site uses no external stylesheets, script CDNs, third-party embedded media or social widgets.

The only third party involved is therefore our infrastructure provider:

• Hosting provider. Pages and assets are served by our hosting provider, which processes connection metadata as described in section 3.

6. Legal basis for processing

• Contractual / pre-contractual measures (Art. 6.1.b GDPR) for processing email enquiries you send to us, in order to respond to your request.
• Legitimate interest (Art. 6.1.f GDPR) for server logs, for the security and operational integrity of the site.

7. Data retention

We retain email correspondence for as long as it is operationally relevant to our commercial relationship with you, plus any periods required by tax or commercial law. Server logs are kept for the period defined by the hosting provider, typically not exceeding 90 days for raw access logs.

8. International transfers

Loading this website involves no transfer of your personal data to any third party, inside or outside the European Economic Area: the page requests no resources from third-party origins, so no data about you is sent anywhere but to our own hosting infrastructure.

Where our hosting provider processes the connection metadata described in section 3 on infrastructure located outside the European Economic Area, it does so under the safeguards required by Chapter V of the GDPR. Transfers relating to the IncentIA platform, where applicable, are governed by the data processing agreement referred to in section 10.

9. Your rights

Under the GDPR you have the right to: access your data, rectify inaccurate data, erase your data ("right to be forgotten"), restrict or object to processing, request data portability, and withdraw consent (where applicable). To exercise any of these rights, contact us at privacy@raupar.com, attaching a copy of an identifying document.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that the processing of your personal data does not comply with applicable law.

10. Personal data on the IncentIA platform

IncentIA is a multi-tenant platform. Each enterprise customer runs its own loyalty or brand-activation programme, and the roles under the GDPR are allocated as follows:

• The customer brand is the controller of the personal data of the participants in its programme. It determines the purposes and means of the processing, defines the programme mechanics and holds the legal basis for them.
• Raupar Solution S.L.U. acts as processor under Article 28 GDPR, processing that data solely on the customer's documented instructions in order to provide the platform.
• A data processing agreement is signed with every customer. It sets out the subject matter and duration of the processing, the categories of data and data subjects, the technical and organisational security measures, the use of sub-processors, and the return or deletion of data on termination.
• Sub-processors are notified to the customer, who may object on the terms set out in that agreement.
• Platform data is hosted in data centres located in the European Union.

Participants exercise their data protection rights against the customer brand acting as controller. Where a request reaches us directly, we forward it to the relevant controller without undue delay and assist them in responding, as required by our processor obligations.

The contractual framework governing use of the platform is set out in our terms of service.

11. Changes to this policy

We may update this policy to reflect changes in the website's functionality or in applicable law. Material changes will be flagged by updating the "Last updated" date at the top of this page. We recommend reviewing this policy periodically.