Privacy Policy.
Last updated · 20 October 2026
Raphion ('we') respects your privacy. This Policy describes what personal data we process when you use raphion.com (the 'Site'), why we process it, and the rights you have under the EU General Data Protection Regulation 2016/679 ('GDPR') and the Spanish Organic Law 3/2018 on Data Protection ('LOPDGDD').
1. Controller
Registered controller details are being verified and will be published before personal data collection begins.
2. What data we process
Waitlist: name, email, country/city, phone (optional).
Dealer interest: name, company, email, city/region, phone (optional), message.
Distributor and retail-partner interest: name, company, email, country, phone (optional), message.
Contact: name, company (optional), email, country, phone (optional), message.
For both forms, we record the submission time, selected site language, source page, and a record of the consent given, including its version and text.
Site analytics (with your consent): IP address truncated to /24, device class, referrer, pages viewed, session duration.
Cookies — see our Cookie Policy.
3. Lawful basis
Consent (Art. 6(1)(a) GDPR) — for waitlist and dealer-interest submissions, marketing communications, and non-essential cookies.
Legitimate interest (Art. 6(1)(f) GDPR) — to defend against fraud and abuse and to measure aggregate Site performance.
4. Retention
Waitlist data: until you withdraw, or 24 months of inactivity, whichever is sooner.
B2B inquiries: 36 months after last contact.
Analytics: 14 months from collection.
5. Recipients & transfers
We share data with vetted processors only: hosting (Vercel, EU/US — Standard Contractual Clauses), CRM (HubSpot — SCCs), email delivery (Resend, EU), and Google (Google Workspace, Google Sheets and Apps Script — EU-US Data Privacy Framework and Standard Contractual Clauses) to store waitlist, dealer-interest, distributor, retail-partner, and contact submissions. All transfers outside the EEA use the Commission's Standard Contractual Clauses 2021 and additional safeguards.
6. Your rights
You may exercise the rights of access, rectification, erasure, restriction, portability, objection, and to withdraw consent at any time, by writing to privacy@raphion.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority.
7. Security
Data is encrypted in transit (TLS 1.3) and at rest. Access is logged and role-restricted. We notify the AEPD and affected users within 72 hours of any qualifying breach, per Art. 33 GDPR.
8. Changes
We may revise this Policy. Material changes will be flagged at the top of this page at least 30 days before they take effect.