Privacy policy

This policy explains what personal data the Power Metal Packaging 3D portal processes, why, and what you can do about it. It is written in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Power Metal Packaging is a trading name currently being incorporated. Until the company is registered, the controller of data collected through this portal is:

For any data protection matter, write to empresa@powerdrinks.com.

2. What data we process

We process only the data you give us and the strictly technical data generated by using the portal:

• Account data. Name, email address, company or brand, and phone number if you provide one. Your password is not stored: we keep only an irreversible cryptographic hash (Argon2id or bcrypt).
• Artwork you upload. The design files you load into the configurator and the images generated from them (render and template) when you attach them to a quote request. If you do not send a request, your artwork stays in your browser and never reaches our servers.
• Requests and messages. The format chosen, estimated units and whatever you write to us.
• Technical data. Date and time of access, chosen language and a pseudonymised digest of your IP address. We store an irreversible HMAC of the IP, not the address itself, and use it only to rate-limit failed sign-in attempts and detect abuse.
• Cookie consent record. Which categories you accepted, against which policy version, and when — the GDPR requires us to be able to demonstrate it.

We process no special categories of data and build no profiles. We make no automated decisions producing legal effects concerning you.

3. Why we use it and on what legal basis

Creating and maintaining your account

Legal basis: performance of the relationship you request by registering (Art. 6(1)(b) GDPR). Without this data we cannot give you access.

Verifying your email address

Legal basis: the same relationship, plus our legitimate interest in accounts corresponding to real people (Art. 6(1)(b) and 6(1)(f) GDPR).

Answering your quote request or contact message

Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).

Portal security

Rate limiting, form protection and activity logging. Legal basis: legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).

Meeting legal obligations

Retention of certain information where the law requires it (Art. 6(1)(c) GDPR).

We do not send marketing you have not asked for, and we do not share your data for advertising purposes.

4. How long we keep it

• Account: for as long as you keep it open. If you delete it from "My account", it is removed immediately and permanently, together with your requests, messages, artwork and activity records.
• Quote requests and messages from registered users: for as long as the account stays open. They are deleted with it, immediately.
• Messages sent without an account: two years from sending, then deleted automatically.
• Sign-in attempts: seven days.
• Activity log: deleted with the account. Entries that belong to no account — a sign-in attempt with an address that does not exist, for instance — are deleted automatically after one year.
• Cookie consent: six months from the moment you give it, or until the policy version changes, whichever comes first. After that the record is deleted automatically.
• Web server logs: the server records the requests it receives, including the IP address, for at most fourteen days. They are needed to detect faults and attacks.

5. Who we share it with

Your data is not disclosed to third parties except where legally required. Only the providers necessary to run the service are involved; they act as processors under an Article 28 GDPR contract:

• Hosting and email provider: IONOS, which supplies the web server, database and mailbox services within the European Union.

This portal loads no third-party services in your browser: typefaces, the 3D visualisation libraries and every other resource are served from our own domain. There are no advertising networks, no external analytics and no social buttons sending your IP address to other companies.

6. International transfers

We make no international data transfers. All information is processed and stored on servers located in the European Union.

7. Security measures

We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS with HSTS), passwords stored with Argon2id, cross-site request forgery protection, sign-in rate limiting, parameterised queries against injection, a content security policy that blocks external resources, and pseudonymisation of IP addresses. Artwork files you send us are stored in a directory outside the web server's public folder, so there is no address from which they could be downloaded.

8. Your rights

You may exercise the following rights at any time:

• Access and portability: obtain a copy of your data. You can download it yourself as structured JSON from My account → Privacy → Download my data.
• Rectification: correct your details in My account.
• Erasure: delete your account and everything attached to it from My account → Privacy → Delete my account.
• Restriction and objection: by writing to the contact address.
• Withdrawing cookie consent at any time, as easily as you gave it, through the "Cookie preferences" link in the footer.

To exercise any right you cannot handle yourself in the portal, write to empresa@powerdrinks.com or to the address above, identifying yourself appropriately. We will reply within one month.

If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.

9. Minors

This portal is aimed at professionals and is not offered to children under 14. We do not knowingly collect data from minors. If we identify a minor's account, we will delete it.

10. Changes to this policy

If we change this policy we will publish the new version at this same address and update the date in the header. Where the change affects cookie use, you will be asked for consent again.