Privacy

Privacy policy

Your right to privacy is fundamental. Here we explain how we process your personal data in a transparent and responsible manner.

1. Who is the data controller

Opengea SCCL is the data controller for personal data collected through the Intrabase platform.

2. What data we collect

Account data

When you create an account on Intrabase, we collect the data necessary to provide you with the service:

  • First and last name
  • Email address
  • Password (stored in encrypted form)
  • Organisation information (if applicable)

Usage data

We collect basic information about platform usage to ensure the proper functioning of the service:

  • Access logs (IP address, date and time)
  • Configuration preferences (language, theme)
  • Device and browser information

Cookies

We only use strictly necessary cookies for the operation of the platform. See our cookie policy for more details.

3. Legal basis for processing

We process your personal data on the following legal bases:

  • Contract performance: Processing is necessary to provide you with the contracted service (Article 6.1.b GDPR).
  • Legitimate interest: To ensure platform security and prevent fraud (Article 6.1.f GDPR).
  • Consent: For sending commercial communications, where applicable (Article 6.1.a GDPR).

4. How long we keep your data

We retain your personal data as long as you maintain an active account on Intrabase. Once you request account cancellation:

  • Account data will be deleted within a maximum of 30 days.
  • Backups will be purged within a maximum of 90 days.
  • We may retain certain data for legally established periods to comply with tax or legal obligations.

5. International data transfers

Your data always remains within the European Union. Our infrastructure is hosted on Intergrid servers located in Barcelona, Germany and Finland, ensuring GDPR compliance without the need for international data transfers.

We do not share your data with third parties located outside the European Economic Area. The only exception is the optional third-party integrations you enable yourself; see section 7.

6. User rights

As a data subject, you have the right to:

  • Access: Obtain confirmation of whether we process your data and access it.
  • Rectification: Request the correction of inaccurate or incomplete data.
  • Erasure: Request the deletion of your data when it is no longer necessary.
  • Portability: Receive your data in a structured, commonly used format.
  • Objection: Object to the processing of your data in certain circumstances.
  • Restriction: Request the restriction of processing of your data.

To exercise any of these rights, contact us at oficina@opengea.org. We will respond to your request within a maximum of 30 days.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe your rights have not been properly addressed.

7. Third-party integrations

Intrabase lets you voluntarily connect your Google account to synchronise your calendar and contacts. The connection requires your explicit consent on Google's authorisation screen and you can revoke it at any time, either from Intrabase (Preferences → Connectors) or from your Google account settings.

While the integration is active, we process:

  • The email address and name of the connected Google account, to identify it on the connectors screen.
  • The events of the calendars you have selected, to keep them in sync with your Intrabase agenda.
  • Contact records, if you enable the Google Contacts connector.

This data is stored solely in your organisation's database and is used exclusively to provide the synchronisation feature.

When you disconnect the integration, the access token and the working copy of your Google data are deleted, and the permission is revoked on your Google account. Contacts already imported into your address book remain there as your own records; you can delete them at any time from Contacts, where they are tagged "Google".

Because synchronisation is bidirectional, data you create or modify in Intrabase is also sent to Google and becomes subject to your own relationship with Google. This is the only exception to section 5, and it occurs only if you expressly enable the integration.

Intrabase's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not transfer this data to third parties except as necessary to provide the service or to comply with a legal obligation, we do not use it for advertising, we do not sell it, and we do not allow humans to read it except with your express consent, for security purposes, to comply with applicable law, or in aggregated and anonymised form for internal operations.

8. Contact

For any enquiry related to the privacy of your data, you can contact us at:

Last updated: March 2026