Privacy policy
Last updated: 19 October 2026
This policy explains which personal data we process when you use the arkivion.com website, the Arkivion portal and the backup agent, what we use it for and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). In case of discrepancy, the Spanish version prevails.
Arkivion does not store or receive the content of your backups: backups are kept in the repository you choose (local disk, NAS or S3-compatible storage) and only you control access to it.
1. Data controller
- Controller: Ignacio Molina (trade name Arkivion Tech Company), self-employed professional.
- Tax ID (NIF): 74820595P.
- Address: C/ Castelao 8, 29004 Málaga (Spain).
- Privacy contact: info@arkivion.com.
2. Controller or processor
We are the controller for portal account data, the contact form, the emails we send and the technical logs of the service.
When a company or other organisation uses Arkivion to protect its devices, the information about those devices (for example, the device name or its inventory) is processed on behalf of that organisation, which is the controller, and Arkivion acts as a processor under the data processing annex of the Terms and conditions. If you are an employee or user of a device managed by a customer organisation, please contact that organisation first to exercise your rights over that data; if you write to us, we will forward your request.
3. Data we process
Portal account:
- email address and password (we only store a hash, never the plain-text password);
- the organisation the account belongs to, email verification status, preferred language and sign-up and access dates.
Information sent by the agent installed on devices:
- device name (hostname) and technical installation and machine identifiers;
- agent version and time of last connection;
- status and result of backup jobs: dates, size in bytes and error messages;
- basic device inventory: operating system, hardware characteristics and similar technical data;
- display name and group assigned to the device by the organisation in the portal.
The agent does not send the content of your files or backups. The device name may be personal data if it identifies a person (for example, "MARIA-LAPTOP").
Contact form:
- name, email, subject, message and language;
- minimal technical data, such as the IP address, which may be used to limit abusive submissions.
Transactional emails:
- recipient address and content of the service emails we send you (account verification, password reset, service notices), as well as delivery data provided by the email provider (delivered, bounced, etc.).
Technical browsing and service usage data:
- IP address, browser type, date and time of requests and errors, logged by our hosting providers for security and to operate the service.
We do not use analytics or advertising tools, we do not build profiles and we do not take automated decisions with legal effects on you.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account and providing the service (portal, backup monitoring, remote commands). | Performance of the contract or pre-contractual steps at your request (Art. 6(1)(b) GDPR). |
| Receiving and displaying the information sent by the agent, as processor for the customer organisation. | Instructions of the customer organisation under the data processing agreement (Art. 28 GDPR). |
| Managing licences, counting protected devices and, where applicable, invoicing. | Performance of the contract (Art. 6(1)(b)) and compliance with accounting and tax obligations (Art. 6(1)(c)). |
| Sending service emails (verification, password, notices). | Performance of the contract (Art. 6(1)(b)). |
| Answering enquiries made through the contact form or by email. | Your consent, given when you send the enquiry (Art. 6(1)(a)), and, if the enquiry relates to purchasing, pre-contractual steps (Art. 6(1)(b)). |
| Ensuring the security of the service, preventing abuse and fraud and resolving technical incidents. | Legitimate interest in protecting the service and its users (Art. 6(1)(f)). |
| Responding to requests from authorities and defending our rights. | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)). |
We do not send marketing communications without your prior consent. You may withdraw any consent you have given at any time, without affecting the lawfulness of prior processing.
5. Retention periods
- Account data: while the account is active. After closure, it is deleted or anonymised within a reasonable period.
- Device information sent by the agent: while the organisation keeps the service. Afterwards, it is deleted or returned as set out in the data processing annex.
- Contact enquiries: for as long as needed to handle them and any follow-up.
- Technical logs: for the limited periods applied by our hosting providers.
- Where there is a legal obligation (for example, keeping invoices for the periods required by commercial and tax law) or liabilities may arise, the necessary data will be kept blocked for those periods and made available only to courts and competent authorities.
6. Recipients and processors
We do not sell or disclose your data to third parties, unless required by law. To provide the service we rely on the following providers, which process data on our behalf as processors:
| Provider | Service | Location |
|---|---|---|
| Vercel Inc. | Hosting of the website, portal and API. | USA (infrastructure in several regions) |
| Supabase Inc. | Service database. | US company; database hosted in the EU region (Ireland) |
| Resend | Sending transactional emails. | USA |
| Upstash, Inc. | Licence data store. | USA |
| GitHub, Inc. | Distribution of the agent installer. | USA |
When you download the installer, the download is served by GitHub, which receives your IP address and the technical data of the request under its own privacy policy.
We do not currently process online payments. When we activate a payment provider, we will update this policy before we start using it.
7. International transfers
The providers listed are companies established in the United States, so some data may be processed in or accessed from outside the European Economic Area. These transfers are based on the EU-US Data Privacy Framework, where the provider is certified, and/or on the standard contractual clauses approved by the European Commission. You can request more information by writing to info@arkivion.com.
8. Your rights
You may exercise the following rights at any time:
- access: find out which of your data we process;
- rectification: correct inaccurate or incomplete data;
- erasure: ask us to delete your data when it is no longer needed, among other cases;
- objection: object to processing based on our legitimate interest;
- restriction: ask us to suspend processing in certain cases;
- portability: receive the data you have provided to us in a structured, commonly used format;
- withdraw any consent you have given.
To exercise them, write to info@arkivion.com stating the right you are exercising. If necessary to verify your identity, we may ask for additional information. We will reply within one month, which may be extended in the cases provided for in the GDPR.
If you consider that we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, https://www.aepd.es
9. Security
We apply technical and organisational measures appropriate to the risk, including encryption of communications via HTTPS, storing passwords as hashes and restricted access to data. No system is completely invulnerable; if a security breach affecting your data were to occur, we would act as required by the GDPR.
10. Minors
Arkivion is a service aimed at professionals and organisations. It is not intended for children under 14 and we do not knowingly process their data.
11. Changes to this policy
We may update this policy to reflect changes in the service or in the law. We will publish the new version on this page with its update date and, if the changes are significant, we will notify you by email or through the portal.