Privacy Policy — RegAffairs Hub

1. Data Controller

The data controller responsible for the processing of your personal data through this website is:

Urviproject
Plaça Bartomeu Rebés Duràn, 5, AD500 Andorra la Vella, Andorra
Email: hello@regaffairshub.com

If you have any questions about how we process your personal data, or if you wish to exercise your rights under applicable data protection legislation, please contact us using the details above.

2. What Data We Collect

We collect and process personal data only when necessary to provide our services. The specific data collected depends on how you interact with our website:

2.1 Contact Form

When you submit our contact form, we collect the following information:

Name — to identify you and address your inquiry personally.
Email address — to respond to your inquiry.
Company (optional) — to understand the context of your inquiry.
Subject — to categorize and route your inquiry appropriately.
Message — the content of your inquiry.

Contact form submissions are processed through Formspree.io, a third-party form handling service. Your data is transmitted directly to Formspree’s servers when you submit the form. Please refer to Section 7 (Third-Party Services) for more details.

2.2 Classification Wizard (Browser-Based Tool)

Our MDR Classification Wizard is a client-side tool that runs entirely in your web browser. No personal data is collected, transmitted, or stored on our servers when you use this tool. All inputs and classification results are processed locally in your browser and are not sent to any external service. When you close or refresh the page, all data is discarded.

2.3 Submission Tracker (Flask Application)

Our Submission Tracker is a web application that requires user registration. When you create an account and use this tool, we collect and store the following data in our database:

User account information — including your name, email address, and encrypted password.
Submission records — regulatory submission data you enter into the tracker, including submission names, statuses, dates, and notes.
Uploaded documents — any files you upload in connection with your submissions.

This data is stored in our application database and is accessible only to you through your authenticated account.

2.4 Automatically Collected Data

When you visit our website, our web server may automatically collect certain technical information, including your IP address, browser type, operating system, referring URL, and pages visited. This data is used solely for ensuring the security and proper functioning of the website.

3. Cookies

Currently, our website uses essential cookies only. These cookies are strictly necessary for the operation of the website and include:

Session cookies — to maintain your session state when using the Submission Tracker application.
Language preference — to remember your selected language across pages.

We do not currently use analytics, advertising, or tracking cookies. Should we introduce analytics cookies in the future (e.g., privacy-respecting analytics), we will update this policy and implement an appropriate cookie consent mechanism before activating them.

4. Legal Basis for Processing

We process your personal data under the following legal bases as defined in Article 6(1) of the General Data Protection Regulation (GDPR):

Consent (Article 6(1)(a)) — When you voluntarily submit the contact form, you consent to us processing the data you provide for the purpose of responding to your inquiry. You may withdraw your consent at any time by contacting us.
Contract performance (Article 6(1)(b)) — When you create an account and use the Submission Tracker, we process your data as necessary to provide the service you have registered for.
Legitimate interest (Article 6(1)(f)) — We process certain technical data (such as IP addresses and server logs) for the purposes of ensuring the security of our website, preventing abuse, and maintaining the proper functioning of our services. Our legitimate interest in maintaining a secure platform does not override your fundamental rights and freedoms.

5. How We Use Your Data

We use the personal data we collect for the following purposes:

To respond to your inquiries submitted through the contact form.
To provide and maintain the Submission Tracker service, including account management and data storage.
To ensure the security, integrity, and proper operation of our website and services.
To comply with applicable legal obligations.

We do not use your personal data for automated decision-making or profiling. We do not sell your personal data to third parties.

6. Data Retention

Contact form data: Data submitted through the contact form is retained by Formspree.io in accordance with their data retention policy. We retain copies of correspondence for as long as necessary to resolve your inquiry and for a reasonable period thereafter for record-keeping purposes.
Submission Tracker data: Your account data, submission records, and uploaded documents are retained for as long as your account remains active. You may request deletion of your account and all associated data at any time (see Section 9).
Server logs: Technical server log data is retained for a maximum of 90 days and then automatically deleted.

7. Third-Party Services

We use the following third-party service to process personal data:

Formspree.io

Formspree, Inc. is a US-based form handling service that processes contact form submissions on our behalf. When you submit our contact form, your data (name, email, company, subject, and message) is transmitted to and processed by Formspree’s servers in the United States.

Formspree acts as a data processor under GDPR. You can review Formspree’s privacy policy at https://formspree.io/legal/privacy-policy.

We do not share your personal data with any other third parties unless required by law.

8. International Data Transfers

Since Formspree.io is based in the United States, submitting the contact form results in the transfer of your personal data outside the European Economic Area (EEA). To ensure adequate protection of your data in compliance with GDPR, these transfers are safeguarded by Standard Contractual Clauses (SCCs) as approved by the European Commission, or other legally recognized transfer mechanisms.

The Submission Tracker application data is stored on servers located within the EEA. No international transfer of Submission Tracker data occurs under normal operation.

9. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

Right of access (Article 15) — You have the right to request a copy of the personal data we hold about you and information about how it is processed.
Right to rectification (Article 16) — You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
Right to erasure (Article 17) — You have the right to request deletion of your personal data where there is no compelling reason for its continued processing (“right to be forgotten”).
Right to restriction of processing (Article 18) — You have the right to request that we restrict the processing of your personal data under certain circumstances.
Right to data portability (Article 20) — You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to object (Article 21) — You have the right to object to the processing of your personal data where we rely on legitimate interest as the legal basis, including any profiling based on those provisions.
Right to withdraw consent — Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint — You have the right to lodge a complaint with a supervisory authority. If you are in the EU/EEA, you may contact your local Data Protection Authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

To exercise any of these rights, please contact us at hello@regaffairshub.com. We will respond to your request within 30 days, as required by GDPR.

10. Children’s Privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete such data as soon as possible. If you believe that a child under 16 has provided us with personal data, please contact us at hello@regaffairshub.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable legislation. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this page periodically to stay informed about how we protect your data.

If we make significant changes that materially affect your rights or the way we process your personal data, we will provide a prominent notice on our website prior to the changes taking effect.

12. Contact for Privacy Matters

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us: