Legal & Data Governance

CodeCanvasSystems, registered at C. de Muñoz Seca, 8, 02002 Albacete, Spain, is the data controller for personal data processed through this website and our cybersecurity services. Under Regulation (EU) 2016/679 (GDPR) and the California Consumer Privacy Act (CCPA), we process contact details, project briefs, and billing records solely for contract performance (Art. 6(1)(b)), legitimate interests in service delivery (Art. 6(1)(f)), and legal obligations such as tax retention (Art. 6(1)(c)).

Data handling lifecycle: intake → encrypted storage in EU-hosted systems → processing for proposal and delivery → retention for the statutory period → secure deletion or anonymization. Access is limited to authorized personnel under strict confidentiality and least-privilege controls aligned with ISO/IEC 27001 practices.

Retention periods: contact and proposal inquiries are retained for up to 24 months after last interaction; contract, invoice, and accounting records for 6 years as required by Spanish commercial law; security audit artifacts for the engagement duration plus 12 months unless a longer contractual retention applies. Upon expiry, data is irreversibly deleted or anonymized.

Your rights: you may request access, rectification, erasure, restriction, data portability, and object to processing under GDPR Articles 15–21. California residents may request disclosure, deletion, and opt-out of the “sale” or “sharing” of personal information — we do not sell personal data. Exercise rights by emailing [email protected]; we respond within 30 days. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

Sub-processors (cloud hosting, payment processing) are bound by data processing agreements. International transfers, where required, use Standard Contractual Clauses approved by the European Commission.

These Terms govern engagements between the Client and CodeCanvasSystems, C. de Muñoz Seca, 8, 02002 Albacete, Spain, for vulnerability assessments, penetration tests, cloud perimeter defense, continuous monitoring, and related cybersecurity services. By commissioning a service or paying an invoice, the Client accepts these Terms together with any signed Statement of Work (SOW), which prevails in case of conflict.

Scope & authorization: all testing is performed only against assets the Client is authorized to assess. The Client warrants written ownership or authorization for every target in scope. Out-of-scope testing, social engineering of third parties without prior written notice, or denial-of-service activity is prohibited unless explicitly contracted.

Fees & payment: prices are quoted in the proposal or displayed on the services timeline. Invoices are due within 14 days unless otherwise agreed. Payment links are processed via our payment provider; late payments may pause active work after written notice. Deliverables and intellectual property in Client-specific reports transfer upon full payment.

Confidentiality & findings: penetration test findings, vulnerability details, and security posture information are Confidential Information. Reports are for the Client’s internal use and must not be published without written consent, except when required by law or regulators. We commit to coordinated disclosure: critical findings are communicated to the Client before any public reference.

Warranties & liability: services are performed with professional diligence. Security testing cannot guarantee the absence of all vulnerabilities; the Client remains responsible for remediation and final risk acceptance. To the maximum extent permitted by law, aggregate liability is limited to the fees paid for the engagement giving rise to the claim. Neither party is liable for indirect or consequential damages. Spanish law governs; courts of Albacete have exclusive jurisdiction, without prejudice to mandatory consumer protections.

Termination: either party may terminate for material breach uncured within 15 days of written notice. Retainers may be cancelled with 30 days’ notice; fees for work already performed remain due.

CodeCanvasSystems uses cookies and similar technologies on this website. Under the ePrivacy Directive and GDPR, strictly necessary cookies run without consent; all other categories require your choice, which our banner records in localStorage so your preference persists on this device.

Strictly necessary: session integrity, security, and load balancing. These cannot be disabled without breaking core functionality.

Preferences: remember choices such as cookie banner dismissal (stored locally as cookie_accepted).

Analytics (if enabled): aggregated, pseudonymized usage statistics to improve page structure and performance — never sold or combined with marketing profiles.

Third-party embeds: the contact page loads a Google Maps iframe which may set cookies under Google’s policies. Maps are loaded lazily; interacting with the map is understood as interaction with Google’s content.

You can clear or block cookies in your browser settings at any time. Blocking strictly necessary cookies may impair site functions. Questions: [email protected].

Fixed-scope engagements (assessments, audits, training) may be cancelled without charge up to 48 hours before the scheduled start; after mobilization — once scanning, access setup, or analyst time has begun — fees are non-refundable because work product and capacity are committed.

If CodeCanvasSystems cancels an engagement before work begins, you receive a 100% refund of prepaid fees. If we cancel after partial delivery, you receive a pro-rata refund for undelivered milestones. Deliverables already produced remain subject to the confidentiality and IP terms in the Terms of Service.

Monthly retainers (continuous monitoring, incident response) can be cancelled for the next billing cycle with 30 days’ written notice; the current period is non-refundable once it has started. Duplicate or erroneous charges are corrected in full within 10 business days of verified notice to [email protected].

Approved refunds are issued to the original payment method within 5–10 business days. Statutory withdrawal rights for EU consumers, where applicable, are honored in accordance with Directive 2011/83/EU — note that once a digital service has begun with the consumer’s express prior consent, the right of withdrawal may be lost for services fully performed.

CodeCanvasSystems subjects its own tooling and delivery environments to periodic vulnerability scanning and configuration reviews. Client-facing audit artifacts (scan outputs, remediation tickets, retest evidence) follow the retention lifecycle defined in the Privacy Policy.

Upon request — and where an engagement includes compliance support — we provide summary attestations of control implementation relevant to GDPR Article 32 and ISO/IEC 27001 control families. Findings that could affect multiple clients are handled under coordinated disclosure and never disclosed without prior notice to the impacted Client.