Privacy and cookies policy

1. Data controller

This policy is adapted to Regulation (EU) 2016/679 (GDPR), Spain's Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD), and the Spanish Information Society Services Act (LSSI-CE).

WAKANDA MARKETING SL, Tax ID (NIF) B55286579, registered at Calle Santiago Ramón y Cajal, nº 32, L4, 17190 Salt (Girona), Spain. Contact: info@siriolead.com.

2. What data we collect

• Account data: your email and password (encrypted) when you sign up.
• Order data: niche, drawn geographic area, quantity requested, the result generated and, if you set up “My brand”, your logo, company name and website. Also the email address where you want to receive the order notifications, if you give one other than your account email (if it belongs to someone else, you must be entitled to give it to us), and your billing details, which we keep in your account to pre-fill your next order.
• Payment data: the payment processor charges you directly; SirioLead never sees or stores your card number. To issue the invoice, the order form asks for your name or company name, your tax ID and your billing address.
• Technical data: the IP address and browser you use (to alert you if your account is accessed from a new device); the date, time and IP of your acceptance of the terms before paying, together with the exact wording of the withdrawal waiver checkbox you ticked; a record of every download of your batches with date, time, IP and browser (proof of the contract and of delivery); and the server's technical logs (including IP) needed for its security and operation.
• Contact data: your name, email and message if you write to us through the contact form.
• If you're an affiliate or come through one: if you join the affiliate programme, your full or company name, email, country, tax ID, payout details (IBAN or another method), your website and channels, the date, time, IP and version of the Programme Terms you accepted, and your commissions and payouts. If you arrive at SirioLead through an affiliate's link, we store in your account which affiliate brought you and since when; the affiliate only sees figures and the amounts of their commissions, never your data.

3. Why we process it

Managing your account, processing and delivering your orders, collecting payment and issuing the invoice, sending you transactional notices about your order (confirmation, delivery, incidents), alerting you to sign-ins from new devices, recording your acceptance of the terms and your downloads as proof of contract and delivery, and complying with our legal obligations (invoicing, fraud prevention). If you take part in the affiliate programme, managing your participation, calculating and paying your commissions and preventing fraud; and, if you arrive through an affiliate's link, attributing your purchases to them to calculate their commission.

4. Legal basis

Performance of the service contract (art. 6.1.b GDPR) for managing your account and orders; compliance with legal obligations (art. 6.1.c GDPR) for invoicing; and legitimate interest (art. 6.1.f GDPR) in the security of your account (new-device alerts) and in being able to prove the contract and the delivery (acceptance and download logs). The affiliate programme is based on the contract with the affiliate (art. 6.1.b GDPR) and on tax obligations (art. 6.1.c GDPR); attributing a customer to an affiliate, on our legitimate interest in paying commissions correctly (art. 6.1.f GDPR); and storing the affiliate link in your browser, on your consent (art. 6.1.a GDPR and art. 22.2 of the Spanish LSSI).

5. Who we share your data with

Only with the providers needed to deliver the service, acting as data processors:

• Hosting: hosting provider (USA), on whose servers the website, database, files and their backups are kept.
• Payments: payment provider (EU and USA), which charges the order and issues the invoice. If you choose a third-party payment method (for example, a digital wallet or a pay-later option), that third party also processes your data as a controller, under its own terms.
• Email: email delivery provider (USA) for the service emails, and corporate email and assisted support provider (USA) for the messages you send us and our replies.
• Data sourcing: providers of public data sourcing and automated analysis (AI) (EU and USA) for the business data that makes up your order (they do not receive your account or payment data).

When a provider is outside the European Economic Area, the transfer relies on the GDPR safeguards (an adequacy decision, such as the EU-US Data Privacy Framework, or standard contractual clauses). We do not sell your data to third parties.

6. How long we keep it

For as long as your account is active. You can delete it yourself from “My account” in your dashboard (except while you have an order being prepared): your login data, brand and batches are deleted. We only keep, unlinked from your account, the billing data of paid orders, together with the proof of their acceptance and delivery, for the period required by tax and commercial law (generally 6 years). Contact form messages are kept for as long as needed to handle them; requests to exclude a business, for as long as needed to honour them; and the server's technical logs are automatically overwritten after a short time. In addition, for security and service continuity, we keep restricted-access backups of the information. Affiliate data is kept while the affiliate takes part in the programme and, afterwards, the data linked to commission payouts for the period required by tax and commercial law (generally 6 years).

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to info@siriolead.com. You may also file a complaint with the Spanish Data Protection Agency (AEPD).

8. If your business appears in our leads

SirioLead also processes data about the businesses included in the lists it delivers. If yours is one of them, here is what you should know:

• What data: the professional contact details the business itself makes public: trading name, address, phone, website, contact email if published, average rating and social media profiles.
• Where it comes from: exclusively from publicly accessible sources, which we obtain and analyse with the help of data sourcing providers and automated analysis (AI) tools that review the business's public website. We do not buy databases or use private information.
• Why and on what legal basis: so that our customers can find and contact those businesses in their professional capacity (business prospecting or finding suppliers). The legal basis is legitimate interest (art. 6.1.f GDPR), under art. 19 of the Spanish LOPD-GDD on the contact details of sole traders and professionals.
• Who receives it: only the customer who places the order, who from that moment is responsible for how they use it and must comply with applicable law (GDPR, LOPD-GDD and LSSI) when doing so.
• How long: we don't keep a permanent database of businesses: data is collected for each order and only kept inside the delivered batch, for as long as the customer keeps their account.
• How to exclude your business: you can object and ask for your business not to be included in any future order via Exclude my business or by writing to info@siriolead.com. We add it to our exclusion list and it stops appearing in batches from that moment on. You can also exercise the other rights in section 7.

This information is provided publicly in this policy because informing each business individually before every order would be impossible or involve a disproportionate effort (GDPR art. 14.5.b).

9. Cookies

We only use one first-party technical cookie, strictly necessary to keep you signed in (siriolead_session). This cookie is strictly necessary and does not require your consent. We do not use advertising cookies.

You can disable or delete these cookies from your browser settings, although doing so will prevent you from staying signed in.

Through the cookie notice (“Accept”, “Reject” and “Settings” buttons) you can accept or reject, by category, the optional storage described below. We store your choice in your browser's local storage (siriolead_cookie_prefs, first-party, necessary, up to 12 months; after that we ask you again). You can change or withdraw it at any time from the “Cookie settings” link in the footer.

Source measurement, only if you agree: we store in your browser's local storage (siriolead_origin, first-party, 60 days) which channel your visit came from, as the first and the last channel: the campaign parameters of the link, the affiliate code if any, the domain of the referring website and the landing page (without parameters). The purpose is to know which channel the visit came from, to measure which channels bring results. If you sign up, write to us through the contact form or buy, we keep that source together with that sign-up, message or order. This information contains nothing that identifies you.

If you don't agree or you reject it, nothing lasting is stored: the source of the visit is only kept in the tab's temporary memory (deleted when you close it) and is only used if you sign up, write or buy during that same visit. If you reject or withdraw your consent, we delete whatever we had stored.

Affiliates, only if you agree: if you arrive through an affiliate's link (with “?ref=” in the address), we store their code in your browser's local storage for 60 days (siriolead_ref, first-party), to credit them if you sign up or buy within that period. If you don't agree, the code is only used during that visit and nothing is stored. The visit is added to the affiliate's counter without storing any of your data.

10. Users outside the European Union

SirioLead is operated by a Spanish company, and its processing of personal data is generally governed by the EU General Data Protection Regulation (GDPR), regardless of the user's country of residence. Where any of our processors is located outside the European Economic Area, data transfers are made under the safeguards provided by the GDPR (standard contractual clauses or another valid transfer mechanism).

If you reside in the United States and a state privacy law applies to you (such as California's CCPA/CPRA), you can exercise the same rights of access, deletion and objection described in section 7 by writing to info@siriolead.com. SirioLead does not sell or share your personal data with third parties for advertising purposes.

If you reside in Latin America (for example, under Brazil's LGPD, Mexico's LFPDPPP, or equivalent regulations) or in Asia-Pacific (for example, under Singapore's PDPA or similar laws), we apply the same principles of data minimization, purpose limitation and security described in this policy, and you can exercise your rights the same way by writing to info@siriolead.com. Where this policy conflicts with a mandatory local regulation, that local regulation prevails only to the extent legally required.

11. Minors

You must be over 18 to register and buy on SirioLead: the service is not aimed at minors and we do not knowingly collect data from minors. If we learn that a minor has created an account, we will delete it together with their data.