Privacy Policy

1. Identity and processing roles

MockdatScreen is a service operated from Spain. Privacy contact: info@mockdatscreen.com.

User account (direct use): when an individual registers directly on the platform, MockdatScreen acts as Data Controller of their account data (name, email address, password, security and usage data), as it determines the purposes and means of that processing.

Project content (B2B use): when a client company uses the platform to manage projects, videos and documents that may contain third-party data, that company acts as Data Controller of such content and MockdatScreen as Data Processor, processing it under its documented instructions (Art. 28 GDPR).

2. Data we process

• Account data: name, email address, password protected with bcrypt hashing, role and creation date.
• Security data: anonymised IP address, user agent, timestamps and technical logs required for authentication and audit.
• Project data: video files, images, 3D models, documents, file metadata, project name and description.
• Data in videos and documents: may include image, voice or other personal data of third parties included by the client company.

3. Purposes and legal bases

4. Specific clause for video, image and voice

Videos uploaded by the client company may contain the image or voice of natural persons. The client company is responsible for informing those persons and obtaining the appropriate legal basis for that processing, including consent where required.

MockdatScreen does not use videos for its own purposes, advertising, model training or unsolicited analysis. Processing is limited to storage, transmission, display and the technical support required to provide the service.

5. Retention and lifecycle

• Project files are retained while the service remains active and are deleted when the contract ends or when erasure is exercised.
• Consent records are retained for 5 years as compliance evidence under Art. 7 GDPR.
• Audit and security logs are retained only for the strictly necessary period, normally 12 months unless a longer legal obligation applies.

6. Data subject rights

Data subjects may exercise access, rectification, erasure, objection, restriction and portability rights. The platform provides JSON data export and account deletion from the user panel, in line with Arts. 15, 17 and 20 GDPR.

For user account data, requests are addressed to MockdatScreen as Data Controller at info@mockdatscreen.com. For project content provided by a client company, requests are addressed to that company as Data Controller, and MockdatScreen will assist as Data Processor within the statutory deadlines.

Data subjects may also lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if they consider the processing does not comply with the applicable rules.

7. Sub-processors and international transfers

File storage and the database are hosted in the European Union. Transactional email delivery and Google sign-in involve an international transfer to the USA, covered by the Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework (DPF).

8. Security

• HTTPS/TLS 1.2 or higher and HSTS in production.
• httpOnly, Secure and SameSite cookies for sessions.
• Passwords protected with bcrypt and rotating refresh tokens.
• RBAC controls and company/project isolation.
• Short-lived signed URLs for private files.