Privacy Policy – PlazaDRM

Version effective as of September 8, 2026 — adapted to Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD)

Identity of the Data Controller

In compliance with Regulation (EU) 2016/679 of April 27, 2016 (GDPR), aººnd Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), we hereby inform you that the data controller responsible for processing your personal data is:

Data Controller: Paradimage Soluciones SL
Tax ID (CIF): B86197357
Registered office: Paseo de la Chopera, 174
Contact email for privacy matters: contacto@paradimage.com

(hereinafter, “Paradimage,” “we,” or “the Data Controller”)

Summary of the Information We Collect

The following is a summary, for informational purposes only, of the personal information we process when you register as a partner store. This summary does not replace the detailed information in the following sections, which form an integral part of this Policy.

Data Collected	Purpose	Legal basis	Retention Period
Name / Business Name	Account identification and management	Performance of the contract	Duration of the relationship + statutory retention periods
Email	Registration, service communications, account recovery	Performance of the contract	Duration of the relationship + statutory retention periods
Password (encrypted)	Authentication and secure account access	Performance of the contract / legitimate interest (security)	Duration of the relationship
Store configuration data (URL, business name, etc.)	Provision of the PlazaDRM distribution service	Performance of the contract	Duration of the relationship
Access keys / integration tokens	Secure technical communication between the store and PlazaDRM	Performance of the contract / legitimate interest (security)	Duration of the relationship
Purchase history and credit usage	Billing and service balance management	Performance of the contract / Legal obligation	Duration of the relationship + 6 years
Billing information	Compliance with tax and commercial obligations	Legal obligation	6 years from the last accounting entry
Shipping address (if applicable)	Logistics management when required by the service	Performance of the contract	Duration of the relationship

What data we collect and for what purpose

If you manage an online store based on WooCommerce, you can use PlazaDRM’s services to distribute your copy-protected content. To do so, you must register at https://plazadrm.com, providing us with your name, email address, and a password—data that we process for the purpose of managing your user registration and granting you secure access to the platform.

Once registered, you’ll need to set up and configure your store. During this process, we’ll ask you for information about your store (for example, the URL and business name). Access keys (integration tokens) will be generated, which you must keep secure, as they enable technical communication between your store and our services. We process this information for the purpose of providing you with the PlazaDRM distribution service.

In order for your store to distribute the audiovisual material your customers have purchased through the Reader, you must pay a fee per customer and per book, in accordance with the financial terms agreed upon in each case. This fee is paid by purchasing credit packages on our website, which are used up as your store’s customers access their purchases. We process the history of credit purchases and usage, as well as any billing information you provide, in order to manage payment for the service and comply with our commercial and tax obligations. If the credit balance becomes negative, new customers of your store will not be able to access their purchases until additional credits are purchased; this circumstance does not involve the processing of additional personal data on our part.

Data Accuracy and User Commitments

Throughout your business relationship with Paradimage, you agree to provide us with accurate information and to keep it up to date, in accordance with the principle of data accuracy (Art. 5.1.d GDPR). In particular, the following is prohibited:

register using someone else’s email address or otherwise impersonate a third party;
use material (trademarks, logos, etc.) for which you do not hold the rights of use; and
distribute, through our services, any content that violates the provisions of the “Age Rating” and “Prohibited Content” sections of our Terms and Conditions.

Failure to comply with these commitments may result in the suspension of your account, without prejudice to any other actions that may be applicable.

Legal Basis for Data Processing

The legal basis for the processing of your data is as follows:

Performance of a contract (Art. 6.1.b GDPR): for managing your registration, accessing the platform, configuring your store, and providing the PlazaDRM service.
Compliance with a legal obligation (Art. 6.1.c GDPR): for issuing invoices and complying with commercial and tax obligations.
Legitimate interests of the data controller (Art. 6.1.f GDPR): to ensure the security of the platform, prevent fraudulent use, and protect our systems against unauthorized access.
Consent of the data subject (Art. 6.1.a GDPR): to send marketing communications that are not strictly necessary for the provision of the service, and to use non-essential cookies, in accordance with our Cookie Policy. This consent may be withdrawn at any time without affecting the lawfulness of the processing carried out prior to the withdrawal.

Retention Period

We will retain your data for as long as the business relationship between you and Paradimage continues. Once that relationship ends (for example, after you close your account), we will retain the data necessary to comply with legal obligations, in particular:

data related to billing, for the period required by commercial and tax regulations (generally, 6 years from the last accounting entry, in accordance with Article 30 of the Commercial Code, without prejudice to longer periods required by tax regulations); and
data strictly necessary for the establishment, exercise, or defense of legal claims, for the applicable statutory limitation period.

Once these periods have elapsed, your data will be deleted or, where appropriate, anonymized.

Recipients of the Data and Data Processors

Your data is not disclosed to third parties unless required by law. However, to ensure the proper provision of the service, certain providers access your data in their capacity as data processors, with whom we have entered into the corresponding data processing agreement in accordance with Article 28 of the GDPR. These include:

the entity that manages the payment gateway (e.g., PayPal), to which the data strictly necessary to complete each transaction is transferred;
our web hosting and email provider;
if you use an avatar as your profile picture, the avatar provider Gravatar (Automattic Inc.), whose privacy policy can be found at https://automattic.com/privacy/.

We do not sell or transfer your data for commercial purposes to third parties unrelated to the provision of the service.

International Data Transfers

Some of the providers mentioned in the previous section (such as Gravatar/Automattic or certain payment gateways) may be located outside the European Economic Area. In such cases, the transfer is carried out under the protection of an adequacy decision by the European Commission or, failing that, on the basis of appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission, in accordance with Articles 45 and 46 of the GDPR. You may request further information about these safeguards using the contact details provided in Section 1.

Your Rights

As a data subject, you may exercise the following rights at any time and free of charge:

Access: to know what data we process about you.
Rectification: to correct inaccurate or incomplete data.
Erasure (“right to be forgotten”): to request the deletion of your data when it is no longer necessary.
Restriction of processing: to request that the processing of your data be restricted in certain circumstances.
Portability: to receive your data in a structured, commonly used format, or to request that it be transmitted directly to another data controller.
Objection: to object to the processing of your data in certain circumstances, particularly in cases where processing is based on legitimate interests.
To withdraw your consent at any time, without this affecting the lawfulness of the processing carried out prior to withdrawal.
Not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Please note that we do not engage in this type of processing.

You may exercise these rights by contacting us via the Contact form on plazadrm.com, specifying the right you wish to exercise and attaching a copy of a document proving your identity. We will respond to your request within one month, extendable by an additional two months in complex cases, in accordance with Article 12 of the GDPR.

Source of the Data

The data we process comes directly from you, provided when you register on our platform, set up your store, and continue to use our services. We do not obtain your data from third-party sources or publicly available sources, unless you yourself have made it public.

Information Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, including, among others, the encryption of passwords and access keys, access controls to our systems, and periodic reviews of our security measures. However, no system is completely foolproof, so we recommend that you diligently safeguard your login credentials and the passwords generated during the setup of your store.

Minors

Our partner store registration services are intended for professionals and businesses of legal age who have the legal capacity to enter into contracts. We do not knowingly collect data from minors through this registration process. If you become aware that a minor has provided us with personal data without the consent of their parents or guardians, please contact us so we can delete it.

This policy does not govern the processing of end-customer data from partner stores carried out through the Lector Plaza app, which is governed by its own privacy notice, available within the app itself.

Cookies

Our website uses first-party cookies and, where applicable, third-party cookies to ensure the proper functioning of the site and, with your consent, for analytical or personalization purposes (for example, to remember your name, email address, and website when leaving comments, or to store your browsing preferences). You can learn more and configure your preferences through the cookie panel available on our website, as well as opt out of non-essential cookies without affecting the basic use of the site.

Changes to This Policy

This Privacy Policy is effective as of the date indicated at the beginning of this document and may be modified by Paradimage in the future to adapt to regulatory, technical, or service-related changes. The updated version will always be published at:

https://plazadrm.com/privacy-policy/

with an indication of the date it will take effect, and will supersede any previous version.

Complaints to the Supervisory Authority

If you believe that the processing of your personal data does not comply with current regulations, you may file a complaint with the Spanish Data Protection Agency (AEPD) through its website (https://sedeagpd.gob.es) or by mail (C/ Jorge Juan, 6, 28001 Madrid), without prejudice to any other applicable administrative or judicial remedies.