Start for Free

Legal

Privacy Policy

How INTERNET OF THINGER S.L. collects and processes personal data on thinger.io and related websites, products, services and documentation.

  • Last updated
  • 8 min read
  • 15 sections
On this page
  1. Data Controller
  2. Data Protection Officer (DPO)
  3. Personal Data We Process
  4. Where Personal Data Comes From
  5. Purposes and Legal Bases
  6. Data We Process on Behalf of Our Customers
  7. Recipients and Data Sharing (Disclosures)
  8. Data Retention
  9. International Data Transfers
  10. Your Rights (GDPR)
  11. Right to Lodge a Complaint (Supervisory Authority)
  12. Security Measures
  13. Children
  14. Changes to this Privacy Policy
  15. Contact

This Privacy Policy explains how INTERNET OF THINGER S.L. (“Thinger.io”, “we”, “us”, “our”) collects and processes personal data when you visit or use https://thinger.io and related websites, products, services, and documentation (collectively, the “Services”).

This Policy is intended to provide the information required by the EU General Data Protection Regulation (“GDPR”) and applicable Spanish data protection laws.

1Data Controller

Controller: INTERNET OF THINGER S.L.
VAT/Tax ID: ESB88230602
Registered with the Commercial Registry of Madrid, Volume 38329, Folio 61, Section 8, Sheet M-681979.
Registered office: C/Jacinto Benavente, 2A. Planta 1ª. Edificio Tripark. 28232 – Las Rozas de Madrid. Spain
Contact email: info@thinger.io

If you contact us, please include enough information for us to verify your identity.

2Data Protection Officer (DPO)

Data Protection Officer (DPO): We have not appointed a DPO, as we are not legally required to do so. For privacy-related questions, please contact us at info@thinger.io

3Personal Data We Process

Depending on how you interact with the Services, we may process:

  • Identification and contact data: name, surname, email address, phone number (if provided).
  • Professional data: company name, role/department, country (if provided).
  • Content you provide: messages, inquiries, support requests, and attachments you submit.
  • Meeting booking data: name, email address, company, topic, message, time zone, and the date and time you choose for the meeting.
  • Account and service data (if you create/use an account): username, authentication data, API keys/tokens, settings, subscription details, billing contact details.
  • Checkout and billing data (if you purchase Services): name or company name, administrator and billing email addresses, tax ID, billing address, the server name and AWS region you choose, and transaction, payment status and invoice data. Card details are entered directly in the payment fields of our payment provider (Stripe); we do not store them.
  • Technical and usage data: IP address, device identifiers, browser type, operating system, pages viewed, timestamps, and similar usage logs.
  • Cookie and tracker data: as described in our Cookie Policy.

We do not intentionally collect special categories of data (e.g., health data, political opinions). Please avoid including such data in free-text fields unless strictly necessary.

4Where Personal Data Comes From

We collect personal data:

  • Directly from you (forms, meeting bookings, emails, account creation, checkout, support tickets).
  • Automatically (cookies, logs, analytics when you browse).
  • From the customer that invited you to use its Thinger.io instance or account, when you are one of its users.
  • From service providers acting on our behalf (e.g., hosting, email delivery, analytics, payment status from our payment provider), only as needed to provide the Services.

We process personal data for the following purposes and under the following legal bases:

A) Responding to inquiries (Contact forms / email)

  • Purpose: handle your request and communicate with you.
  • Data: identification/contact data; message content; company/department (if provided).
  • Legal basis: consent (Art. 6(1)(a) GDPR) and/or pre-contractual measures (Art. 6(1)(b)) when your request relates to a potential contract.
  • Retention: see Section 8.

B) Providing and operating the Services (accounts, authentication, platform features)

  • Purpose: create and manage accounts, provide functionality, deliver the service, customer support, and send the service and transactional emails needed for it (for example, account, subscription and deployment notices).
  • Data: account and service data; technical data; support communications.
  • Legal basis: performance of a contract (Art. 6(1)(b)).
  • Retention: see Section 8.

C) Security, fraud prevention, and abuse detection

  • Purpose: protect the Services, prevent abuse, investigate incidents, ensure integrity and availability. Our forms use Cloudflare Turnstile to tell people from automated abuse, and we limit the number of submissions per IP address. The IP addresses used for these limits are stored only in hashed form and deleted after a few hours.
  • Data: technical and usage data (including IP address); logs; account identifiers.
  • Legal basis: legitimate interests (Art. 6(1)(f)) in keeping our systems secure.
  • Retention: see Section 8.

D) Analytics and service improvement

  • Purpose: understand how users interact with the website to improve content and performance.
  • Data: technical/usage data; cookie identifiers.
  • Legal basis: consent (Art. 6(1)(a)) for non-essential cookies/trackers, as applicable.
  • Retention: see Section 8 and Cookie Policy.

E) Marketing communications (optional)

  • Purpose: send newsletters, product updates, and marketing communications.
  • Data: contact data; preferences (subscription status).
  • Legal basis:
    • Newsletter sign-ups on our website (the newsletter form, or the marketing checkbox of the contact form): consent (Art. 6(1)(a)). We ask you to confirm your subscription from an email we send you (double opt-in).
    • Account holders: if you create a Thinger.io Cloud account, we may send you news about similar Thinger.io products and services, based on our legitimate interests (Art. 6(1)(f)) and Article 21.2 of Spanish Law 34/2002 (LSSI). You can stop these emails at any time, free of charge, from the link included in every email.
  • You can withdraw your consent or object at any time (see Section 10).
  • Retention: until you withdraw consent, object or unsubscribe, plus limited time to record suppression (see Section 8).

F) Billing and payments (if you purchase Services)

  • Purpose: manage checkout, subscriptions, invoicing, payments, accounting. If you start a checkout and do not complete the payment, we send one email to the billing and administrator addresses with a link to complete it.
  • Data: checkout and billing data; transaction and invoice data.
  • Legal basis: pre-contractual measures and performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) for accounting/tax.
  • Retention: see Section 8.
  • Purpose: comply with legal obligations, respond to lawful requests, defend legal claims.
  • Data: as required for the specific obligation/claim.
  • Legal basis: legal obligation (Art. 6(1)(c)) and/or legitimate interests (Art. 6(1)(f)).
  • Retention: for the legally required periods.

H) Meeting bookings

  • Purpose: schedule and hold the meeting you book on our website: create the calendar event and its video call, send you the invitation and confirmation emails, manage any change or cancellation, and follow up on what we discussed.
  • Data: meeting booking data.
  • Legal basis: consent (Art. 6(1)(a)), which you give when you book.
  • Retention: see Section 8.

6Data We Process on Behalf of Our Customers

When a customer uses the Thinger.io platform (for example, a Thinger.io Cloud account or a Private Cloud instance), the device data and the personal data of its end users stored in that account or instance are processed by us on the customer's behalf, as a processor. The customer is the controller of that data and decides how it is used. We process it only to provide the Services, under our Terms & Conditions and, where applicable, a data processing agreement.

If you are an end user of a customer's account or instance and want to exercise your rights over that data, please contact that customer. We will assist the customer as required by law.

7Recipients and Data Sharing (Disclosures)

We do not sell your personal data.

We may share personal data with:

  • Service providers (processors) that help us operate the Services. They process data under our instructions and subject to appropriate contractual safeguards. The main ones are:
    • Hosting, database hosting and email delivery: Amazon Web Services (AWS).
    • Email, calendar and video meetings: Google (Google Workspace, including Google Calendar and Google Meet).
    • Website analytics, only with your consent: Google (Google Analytics).
    • Payments: Stripe.
    • Invoicing and accounting: Holded.
    • Bot protection on our forms: Cloudflare (Turnstile).
    • Customer support: our helpdesk tool (Freshdesk).
    • Newsletters: our self-hosted newsletter tool.
    • Internal communication and management tools used by our team.
  • Professional advisors (legal, accounting) when necessary.
  • Public authorities when required by law or to protect rights and safety.

8Data Retention

We keep personal data only for as long as necessary for the purposes described above:

  • Contact requests: for the time needed to handle your request and follow-up; then stored for a limited period for record-keeping and legal defense (typically up to 2 years depending on limitation periods).
  • Meeting bookings: 12 months after the date of the meeting.
  • Accounts and service data: for as long as your account is active; after deletion, data may be retained for a limited period for security, backups, and legal obligations.
  • Marketing subscriptions: until you unsubscribe/withdraw consent; we may retain minimal data in a suppression list to ensure we respect your choice.
  • Billing and invoices: retained for the periods required by Spanish commercial and tax law (at least 6 years).
  • Security logs: retained for a limited period necessary for security monitoring and incident investigation (about 1 month).
  • Backups: kept for up to 12 months, then deleted.
  • Cookies/trackers: see our Cookie Policy for cookie-specific durations.

9International Data Transfers

Our own systems run on Amazon Web Services in the European Union (Ireland, with backups in Frankfurt, Germany).

Private Cloud instances run in the AWS region the customer selects when purchasing them, which may be outside the European Economic Area (EEA).

Some of our service providers may also store or process data outside the EEA, for example in the United States.

Where international transfers occur, we rely on appropriate safeguards, such as:

  • European Commission adequacy decisions, including the EU-U.S. Data Privacy Framework for providers certified under it, and/or
  • Standard Contractual Clauses (SCCs), and additional measures where necessary.

Details can be requested via info@thinger.io.

10Your Rights (GDPR)

Subject to applicable law, you have the right to:

  • Access your personal data
  • Rectification of inaccurate data
  • Erasure (“right to be forgotten”)
  • Restriction of processing
  • Data portability
  • Objection to processing based on legitimate interests, including marketing communications
  • Withdraw consent at any time (this does not affect processing already carried out)

To exercise your rights, contact us at info@thinger.io. We may request information to verify your identity. For data stored in a customer's account or instance, see Section 6.

11Right to Lodge a Complaint (Supervisory Authority)

If you believe our processing of your personal data infringes data protection law, you have the right to lodge a complaint with your supervisory authority.

For Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD).

12Security Measures

We implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Our information security management system is certified under ISO/IEC 27001.

No method of transmission or storage is 100% secure, but we work to protect your data using industry-standard practices.

13Children

Our Services are not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us at info@thinger.io.

14Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the “Last updated” date.

15Contact

For any privacy-related questions, contact: info@thinger.io