Privacy Policy

Last updated: September 3, 2026

1. Identity of the Data Controller

This Privacy Policy applies to the digital services and platform operated by:

Estudio Cactus Media S.L.

Rda. Circunvalación 188, Castellón de la Plana, Spain

CIF: B12962957

Email: support@stowlog.com

Depending on the type of data and activity, Estudio Cactus Media S.L. (Stowlog", "we", "our", or "us") may act as either:

• a Data Controller, for account registration, authentication, security, analytics, marketing, and communication; or
• a Data Processor, on behalf of each Facility that uses the Stowlog Platform to manage its own users and operational data.

2. Scope of Application

This Policy applies to:

• Users of the Stowlog App (mobile, web, or desktop),
• Users of the Stowlog Admin Dashboard,
• Visitors to the Stowlog website (www.stowlog.com),
• Potential customers or contacts who interact with Stowlog through demos, email, or contact forms, and
• Suppliers and service providers with whom Stowlog maintains business relationships.

Each Facility that operates within Stowlog may define its own data collection requirements (e.g., ID photo, driver's license, or passport number). Stowlog processes that data on behalf of the Facility but does not determine its content or purpose.

3. Categories of Data Processed

A. Data Controlled by Stowlog (as Data Controller)

Collected when Users register, authenticate, or interact with the Platform at a general level:

• Identification data (name, email, phone number).
• Account credentials and authentication data.
• Mobile network carrier and message delivery status, where you have provided a mobile number for identity verification by text message.
• Your recorded acceptance of our text-message consent wording, and the record of any request to stop those messages.
• Device and usage data (IP, browser, access logs).
• Technical cookies and analytics data (for service improvement).
• Contact data submitted through forms, demos, or newsletters.
• Supplier data for billing, contracts, and compliance.
• Optional geolocation data (when Facilities enable location-based modules).

B. Data Processed on Behalf of Facilities (as Data Processor)

Collected only when the User selects or interacts with a Facility:

• Custom data fields defined by that Facility (e.g., ID, driver's license, photo, training certificate).
• Activity data within modules (check-ins, safety forms, visit logs, etc.).
• Communication records between Users and Facility Admins.

Each Facility decides:

• which data to collect,
• why it is required, and
• how long it is retained.

Stowlog stores and secures this data but does not use it for any purpose other than providing the contracted service.

4. Purpose and Legal Basis of Processing

5. Data Retention, Deletion, and Pseudonymization

5.1 General Retention

• Stowlog retains account and login data as long as the user maintains an active account.
• Prospect or contact data will be kept while commercial relations remain active or until consent is withdrawn.
• Supplier and administrative data will be stored for the legally required retention period.

5.2 Account Deletion Requests

When a user requests the deletion of their account:

• Stowlog permanently deletes or anonymizes all personal data it directly controls (e.g., name, email, phone, credentials), subject to the exception below.
• The deletion of the Stowlog account does not automatically delete Facility-related operational data, since this information belongs to the Facility that collected it.
• Where you have provided a mobile number for verification text messages, your recorded acceptance of our consent wording and the record of any request to stop those messages are retained after deletion as they stand, and are used only to demonstrate that the acceptance was given and to ensure that no further message is sent to that number, as described in section 11.

5.3 Dual Retention Model for Facility Records

• Each Facility is the Data Controller for data collected during user interactions (e.g., safety courses, visitor check-ins, contractor validations).
• These records may be retained by the Facility under legal or compliance obligations, even after a users account is deleted.
• Upon deletion, Stowlog will pseudonymizethe user identifiers within Facility records — replacing the user's name, email, or ID with an anonymized internal reference (e.g., "Deleted User" or "User #A12F").
• The Facility can still view the operational record (e.g., "Safety Induction completed by Deleted User on March 10, 2025"), but the personal identity is no longer visible or recoverable within Stowlog.
• Stowlog does not control the retention or deletion of data collected by Facilities. Each Facility defines its own data retention policy as an independent Data Controller.

5.4 Facility Notification and Autonomy

• When a user deletion request is processed, Stowlog notifies all Facilities associated with that user's account.
Facilities may then choose to:
• retain the pseudonymized records for legal or audit purposes, or
• further anonymize or delete them according to their own data policies.
• Stowlog never shares deleted user data; this notification is purely operational, ensuring Facilities are aware that user identifiers have been removed.

5.5 Legal Basis for Retention

This process complies with Article 17(3) GDPR, which permits retention or pseudonymization when:

• Data is required for compliance with a legal obligation; or
• Retention is necessary for the establishment, exercise, or defense of legal claims; or
• The Facility has a legitimate interest in maintaining audit or safety compliance records.

All deletion and pseudonymization actions are logged for audit and accountability purposes.

6. Data Sharing and Recipients

Stowlog does not sell or rent personal data. Data may be shared only with:

• Facilities that users interact with,
• Technical service providers (hosting, infrastructure, email, analytics, support),
• Authorities or courts if legally required,
• Financial institutions and tax authorities when required for accounting or compliance, and
• Suppliers or subcontractors performing activities on behalf of Stowlog under data processing agreements.

All data is hosted in MongoDB Atlas (AWS) data centers located within the European Union or in countries with adequate data protection guarantees under GDPR. Where a sub-processor necessarily processes data outside the European Economic Area in order to perform its service — for example, transmitting a verification message to a mobile number — that transfer is governed by the mechanism stated for that sub-processor in the list below.

The current list of sub-processors involved in providing the Stowlog platform, together with their location and applicable transfer mechanisms, is available at https://www.stowlog.com/legal/sub-processors.

6.1 Mobile Numbers and SMS Consent Data

We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, except the communications provider that transmits the messages on our behalf and where disclosure is required by law.

Your mobile number is disclosed only to processors acting on our documented instructions — our hosting and database providers, and Twilio Inc. as our SMS delivery provider — and to your mobile network operator, which necessarily processes the message in order to deliver it. Twilio processes your mobile number and the message content for the sole purpose of transmitting the verification messages you have requested, under a written data processing agreement. Twilio may not use your mobile number for its own purposes and may not sell or rent it; it may engage its own sub-processors and route the message through mobile network operators, solely in order to deliver it and under equivalent contractual obligations.

Your mobile number and the content of the verification message are transferred to Twilio Inc. in the United Statesunder the European Commission's Standard Contractual Clauses (Decision 2021/914) together with Twilio's EU-US Data Privacy Framework certification. A copy of these safeguards is available on request from support@stowlog.com. Where a verification code is sent to a number outside the European Economic Area, the message necessarily transits the network of the destination operator in that country. The details of this engagement are listed at https://www.stowlog.com/legal/sub-processors.

The record of your acceptance of the text-message consent wording we publish, described in section 11, is held by Stowlog and is disclosed to no recipient other than the hosting and database providers named above. It is not disclosed to Twilio Inc., which receives only your mobile number and the content of the message it has to deliver, and it is used for no purpose other than demonstrating that the acceptance was given. Where an acceptance has been recorded, it records which wording that person was shown, in which language, and when they accepted it.

7. Processor Obligations (Article 28 GDPR)

When acting as a Data Processor, Stowlog shall:

• Process personal data only under documented instructions from the Facility.
• Ensure that persons authorized to process data are bound by confidentiality.
• Implement technical and organizational measures required under Article 32 GDPR.
• Keep records of processing activities and assist the Facility in fulfilling GDPR obligations.
• Notify the Facility of any personal data breach without undue delay.
• Not engage any sub-processors without prior authorization from the Facility.
• Upon termination of services, delete or return all personal data as instructed by the Facility.
• Pseudonymize or anonymize personal data when deletion is requested but legal or compliance grounds require retention.

8. Rights of Data Subjects

Users may exercise the following rights under GDPR:

• Access to their personal data.
• Rectification of inaccurate data.
• Deletion (“"right to be forgotten").
• Limitation or objection to processing.
• Portability of their data.
• Withdrawal of consent at any time (without affecting prior lawful processing).

How to exercise your rights:

• If your data was provided directly to Stowlog (e.g., for your account, contact form, or marketing communications): contact support@stowlog.com.
• If your data was collected by a Facility (e.g., license, passport, photo): contact that Facility directly, as it is the Data Controller for that information.

Stowlog will assist Facilities in responding to such requests when necessary.

9. Data Security

Stowlog applies security measures consistent with ISO 27001 certification and industry standards, including:

• Encrypted data transmission (HTTPS / TLS 1.2+).
• Role-based access controls.
• Redundant cloud hosting and continuous backups.
• Logging and monitoring for unauthorized access.
• Regular audits and employee confidentiality obligations.

In the event of a data breach, Stowlog will notify affected parties and relevant authorities in compliance with GDPR Articles 33–34.

10. Cookies and Analytics

Stowlog uses necessary and analytical cookies to ensure functionality and improve user experience.

Details about cookie types and preferences are available in the Cookies Policy at https://www.stowlog.com/legal/cookies.

11. SMS and Text Message Communications

Purpose. Stowlog operates a single text messaging program, Stowlog Account Verification: the delivery of one-time security codes used to verify your identity when you sign in to your Stowlog account or confirm a security-sensitive action. We do not send marketing, promotional, or operational text messages under this program.

How your number reaches us. You provide your mobile number yourself, inside the Stowlog App, either when you create your account or later when you add or verify a number on an existing account. We obtain it from no other source: no number is bought, rented, imported from a list or supplied to us by a third party. Depending on how your account is configured, a mobile number may be required to complete registration. Where a mobile number is on your account, a one-time sign-in code can be sent either to that number or to the email address on the account. Your number is used for the Stowlog verification program only and is not transferable or assignable to any other sender.

Data processed. For this program we process your mobile number, the mobile network carrier and country associated with it, the delivery status of each message, your recorded acceptance of the consent wording described below, and the record of any request you make to stop the messages. Mobile numbers provided for identity verification are not used to send marketing or commercial communications of any kind, under this or any other program. The legal basis for sending these messages is the performance of our contract with you (Article 6(1)(b) GDPR), as they form part of account authentication.

Record of your consent. Where you accept the consent wording we publish for this program, we record that acceptance. The record is held against your mobile number in international E.164 format and states that consent was granted, the version and the SHA-256 hash of the exact wording accepted, the language it was published in, that it was given by ticking a box on screen, whether it was given while registering an account or while verifying or changing the number on an existing account, the account or pre-signup verification it relates to, and the date and time of acceptance taken from our own servers. Where the request carried them it also holds the IP address, the user agent and the app version reported at that moment; those three are optional and are not present on every record. The version is the hash of the wording, and the hash stored on the record is computed by us from our own published copy rather than accepted from the device, so a record cannot cite one wording and carry the hash of another; we keep every version we have published, so that the text behind any record can be retrieved and its hash re-computed. Records are held per mobile number rather than per account and are added to rather than edited: the only value ever rewritten is the link to the account, when an acceptance given before the account existed is attached to the account created from it, and the date of acceptance is preserved. The legal basis for keeping this record is our legitimate interest in being able to demonstrate that the acceptance was given (Article 6(1)(f) GDPR). The wording itself is reproduced in full in our SMS Terms.

Retention. Your mobile number is deleted or anonymized together with your account under section 5.2 of this Policy, with one exception: your recorded acceptance of the consent wording, and the record of any request to stop the messages, are kept afterwards as they stand — including your mobile number, the account or pre-signup verification the acceptance related to, and any IP address, user agent or app version held on it. They are used for no purpose other than demonstrating that the acceptance was given and ensuring that no message is sent after an opt-out. Message delivery logs are retained for the period needed to operate, secure, and troubleshoot the service, on the basis of our legitimate interest (Article 6(1)(f) GDPR). Where you opt out by replying to a message, that opt-out is recorded by Stowlog on a suppression list held separately from the record of your acceptance, and is checked before every message we send, so that no further message is sent to that number; it is also recorded and enforced by Twilio Inc. as our SMS delivery provider. Opting out does not erase an acceptance you previously gave: that record is kept unchanged.

Frequency and cost. Message frequency varies — one message per sign-in or verification request. Standard message and data rates may apply.

Opt-out and help. To stop receiving messages, reply STOP at any time. The following keywords are all honored: STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT, REVOKE. Send the keyword on its own: a reply that carries other words alongside it may not be recognized as an opt-out. You can also write to support@stowlog.com and we will stop the messages. To start receiving messages again after an opt-out, reply START, YES, UNSTOP — these never add a number to the program for the first time; that only happens when you provide it yourself in the Stowlog App. For assistance, reply HELP or INFO to the number from which you received the message, or contact us at support@stowlog.com.

Delivery. Carriers are not liable for delayed or undelivered messages.

The full terms of this messaging program are available at https://www.stowlog.com/legal/sms-terms.

12. Relationship with Facilities

Each Facility operating within Stowlog is an independent organization that controls its own data. When you provide data through Facility forms or modules:

• The Facility acts as Data Controller,
• Stowlog acts as Data Processor,
• Stowlog stores and secures the data but cannot alter or delete it without the Facility's instruction.

Facilities may have their own privacy notices — we recommend reviewing them for more details on their specific use of your data.

13. Source of Data

Personal data may be obtained directly from users, through Facility interactions, or via automated logs and cookies generated by use of the Platform. Optional geolocation data is only collected if the Facility enables it and the user consents.

14. Minors

The Stowlog Platform is intended for professional use only and is not directed at minors under 18 years old. If Stowlog becomes aware of accidental registration by a minor, the account will be deleted.

15. Updates to this Policy

Stowlog may update this Policy periodically to reflect legal, technical, or business changes.All updates will be published at https://www.stowlog.com/legal/privacy. Continued use of the Platform implies acceptance of the revised version.

16. Contact and Supervisory Authority

For questions or complaints regarding data protection, contact: support@stowlog.com

If you are not satisfied with our response, you may file a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es.

Estudio Cactus Media S.L.

Rda. Circunvalación 188, Castellón de la Plana, Spain

www.stowlog.com