Privacy policy | Steinvar

Who is responsible

Pinigas MB is the controller of the personal data described in this policy. You can reach us at hello@steinvar.com.

When an organisation uses the Steinvar platform for its own business, for example to onboard its customers, that organisation is the controller of its customers’ and staff’s data, and we process it only on its instructions under a data processing agreement. That organisation’s own privacy notice applies to that data.

Visiting the website

The website has no forms, accounts, advertising or tracking. It processes:

Data processed when you visit the website
Data	Why	Legal basis	Kept for
Web-server access logs: IP address, time, page requested, referring page, browser type and response status	To deliver the pages, keep the service secure and diagnose faults	Legitimate interest (GDPR Article 6(1)(f)) in running a secure website	About 10 days, then deleted
Page-view statistics: page, referring site, country, browser and device type	To learn which pages are read and improve the site	Legitimate interest (Article 6(1)(f)); counted without cookies or any identifier, so you cannot be followed	Aggregate counts only; no IP address is stored

Registering for the sandbox

Data processed when you register and use the sandbox
Data	Why	Legal basis	Kept for
First and last name, work e-mail, company name, and your password stored only as a one-way Argon2id hash	To create and secure your account and workplace	Contract (Article 6(1)(b)): providing the sandbox you asked for	While the account is open; after that only what the law requires us to keep, then deleted
Sign-in records: time, IP address, device, second-factor use	To keep accounts secure and detect misuse	Legitimate interest (Article 6(1)(f)) in security	As long as needed for security, within the retention above
The audit trail of actions taken in your workplace	To show who did what, as financial and anti-money-laundering rules expect	Legal obligation where it applies (Article 6(1)(c)), otherwise legitimate interest	At least 5 years
E-mails we send you: sign-in codes and service messages	To sign you in and tell you about your account	Contract	Delivery log kept 400 days

We do not use your sandbox data for marketing, and we do not sell it.

Who else processes it

Service providers that process personal data for us
Provider	What for	Where
OVH SAS	Hosting of the website and the platform	Gravelines, France (EU)
Stripe	Card payments when a customer tops up a balance	EU, with transfers under Stripe’s safeguards
DigiCert	Time-stamping signed documents; receives a document fingerprint, not the document	United States, under standard contractual clauses

Fonts, scripts and statistics are served from our own server; your browser does not contact a third party to display the website. We disclose data to authorities only where the law requires it.

How it is protected

Personal data in the platform is encrypted field by field under separate keys, connections are encrypted, staff and customers sign in with a second factor, access is limited to the workplace the data belongs to, and every action is written to a sealed audit trail. The Trust and security page describes these controls.

Your rights

Under the General Data Protection Regulation you can ask us to:

tell you whether we hold personal data about you, and give you a copy (access);
correct data that is wrong (rectification);
delete data we no longer need (erasure), unless the law requires us to keep it;
stop or limit how we use it (restriction and objection);
give you the data in a machine-readable form (portability).

We answer within one month. For website logs we may need the IP address and time concerned. You can also complain to the data protection authority of the EU country where you live or work.

Changes to this policy

If we start collecting anything new, this page will say so before it happens, and the date at the top will change.