This policy explains how personal data is processed when you visit Ordexian, contact us, purchase an audit or use the Workspace.
1. Data controller
- Controller
- Maria Ortiz Muñoz (Ordexian)
- NIF/CIF
- 26966156-J
- Address
- Avda. Sierrezuela 1, Esc 6 Bj 63
- Privacy contact
- info@ordexian.com
2. Data we process
- Identity and contact data: name, email and account-related details.
- Company data: name, tax ID, address, industry, size and other information you add to the Workspace.
- Contracting and billing data: order, amount, payment status, billing address, Stripe identifiers and partial payment-method details where provided by Stripe. Ordexian does not store full card numbers.
- Operational content: audit responses, reports, documents and data you choose to provide to the service.
- Technical and security data: IP address where needed for security or abuse prevention, activity logs, device/browser and session data.
- Analytics data: visited pages, traffic source, device, session and usage events, only when you accept Google Analytics.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage the account, provide the audit, generate reports, manage payments, support and Workspace access. | Performance of a contract and pre-contractual steps. |
| Billing, accounting and legal compliance. | Compliance with legal obligations. |
| Security, fraud and abuse prevention, traceability and defence of legal claims. | Legitimate interest in protecting the service and its users, and legal obligations where applicable. |
| Measure visits and the usage funnel through Google Analytics. | Your consent, which you may withdraw at any time. |
4. Providers and recipients
To provide the service we use specialized providers, primarily Supabase (authentication, database and storage), Vercel (application hosting and delivery), Stripe (payments and billing) and, only if you authorize it, Google Analytics (usage measurement). These providers process data according to their role and applicable terms.
5. International transfers
Some providers may process data outside the European Economic Area. Where an international transfer occurs, recognized data-protection mechanisms such as adequacy decisions or Standard Contractual Clauses will be used together with any additional safeguards required.
6. Retention
Account and service data is retained while the relationship remains active and afterwards for as long as needed to address liabilities, security, claims or legal obligations. Accounting and billing documentation is retained for legally required periods. Analytics data is retained according to Google Analytics settings and your consent.
7. Your rights
You may request access, rectification, erasure, objection, restriction and portability where applicable, and withdraw consent without affecting prior lawful processing. To exercise your rights, write to info@ordexian.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).
8. Automated audit
Ordexian calculates scores and generates recommendations from the answers provided. These outputs are indicative and operational; they do not by themselves produce legal effects or replace professional or human judgment where required.
9. Minors
Ordexian is a business and professional service and is not directed to minors.