Service provider and data controller
In Situ 360 is a service provided by INSITU360, S.L., Spanish tax identification number B70687991, with its registered address at Carrer Pujades, 158 bis, 3rd floor, 08005 Barcelona, Spain.
The company is registered with the Barcelona Commercial Registry under company sheet B 612317. Its initial registration details are volume 49226, page 1, section 8, entry 1, recorded on 9 April 2024.
Contact email: support@in-situ360.com. Telephone: +34 666 445 481.
In these documents, “In Situ 360”, “we”, “us” and “the company” refer to INSITU360, S.L.
Purposes and legal bases
We manage registration, access, profiles and the functions you request to provide the service and perform the relevant contractual relationship. This also applies to a paid plan you purchase. Information about an organisation's representatives or contact people is processed, where appropriate, on the basis of the legitimate interest in managing that professional relationship, limited to what is necessary for it.
We handle general enquiries and support requests on the basis of the legitimate interest in responding to people who contact us and maintaining the service. Where an enquiry concerns pre-contractual steps you request, the necessary processing is based on those steps. Where it concerns a statutory right, processing is based on the corresponding legal obligation.
We handle invoicing and other statutory duties on the basis of compliance with legal obligations. Data necessary to prevent abuse, protect accounts and address incidents is processed on the basis of our legitimate interest in maintaining a secure service, taking into account the rights and reasonable expectations of the people concerned. Compliance with legal orders and duties relies on the legal basis applicable to each case.
Newsletters and other marketing communications rely on consent where required. An existing contractual relationship will be used as a basis only for communications permitted by applicable law, with the corresponding opportunity to object. Optional website analytics relies on consent. General acceptance of the Privacy Policy is not used as an undifferentiated authorisation for these purposes.
Information identified as necessary for an activity must be provided for that activity to be carried out. Optional fields are not mandatory. Failure to provide necessary information may prevent the requested function from being delivered, but does not authorise demands for unrelated information.
Recipients and visibility of information
Content published in a public profile or space may be viewed by its intended audience. Messages and files sent to other people are disclosed to their recipients. Sharing content with other users means they may process it in the context of the communication; it does not authorise uses that infringe your rights.
Providers involved in delivering the service may support hosting and storage, communications, support, security or payment management, within the functions actually used. Their access must be limited to what is necessary for their involvement and subject to the relevant contractual and legal duties. Providers acting for their own purposes are responsible for their own processing as explained when their services are used.
The Cookies Policy identifies Supabase for receiving website analytics events and ipapi.co for obtaining approximate location from an IP address, subject to the consent described there. This does not make those services an exhaustive list of all platform providers or attribute purposes beyond those disclosed.
Necessary information may also be disclosed to authorities, courts or advisers where there is a legal obligation or lawful basis to handle a claim, investigate an incident or establish, exercise or defend rights. No more information than necessary for that purpose will be disclosed.
Your rights and how to exercise them
You may email support@in-situ360.com, preferably with the subject “Privacy”, or write to the controller's address in this policy. Explain your request and identify the account or information concerned. An active account is not required to contact us.
Subject to applicable law, you may request access, correction, deletion, restriction of processing and portability of your data, and object to certain processing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. An objection to direct marketing means your data will no longer be processed for that purpose, including related profiling.
Where applicable, you may also exercise rights concerning decisions based solely on automated processing that produce legal effects or similarly significantly affect you, subject to statutory conditions and exceptions. Mentioning this right does not mean every automated platform function is such a decision.
To protect your information, we will verify requests proportionately. We do not generally require a copy of an identity document. Where there are reasonable doubts, we may request only the additional information needed to resolve them through an appropriate channel. Do not volunteer complete documents or information unrelated to your request. Opt-out requests that legally require no verification will not be made conditional on providing an identity document.
Requests will be handled free of charge except where the law expressly permits otherwise. Where the GDPR applies, we will provide information about the action taken without undue delay and generally within one month of receipt. If the complexity or number of requests justifies an extension, we will notify you within that first month, explain why, and not exceed the two additional months permitted by law. If a request cannot be fulfilled, the reasons and complaint options will be explained.
You may complain to the Spanish Data Protection Agency through its electronic office or the information available at www.aepd.es, and to the competent authority relevant to your situation. You do not have to give up those options to use our contact channel.
Security and international processing
Protecting data requires technical and organisational measures proportionate to the risk. No transmission or storage offers absolute security; this limitation does not reduce our statutory duties concerning protection, incident management and information.
Access to data from another country and processing by a foreign provider may constitute an international transfer. Worldwide availability of the service is not, by itself, a safeguard or authorisation for that transfer.
Where processing involves a transfer subject to data protection law, its requirements must be met through an adequacy decision, appropriate safeguards or another mechanism legally valid for the particular case. You may request information about transfers affecting your data and, where applicable, a copy or description of the relevant safeguards, while protecting confidential information and third-party rights.
Information we process and its sources
We process information you provide when creating and using an account, completing a profile, publishing a portfolio or review, communicating with other users, contacting support, subscribing to communications or purchasing a service. Depending on the function used, this includes identifying and contact information, access and authentication data, professional activity and experience, the location entered in a profile, submitted content and files, communications and information needed to manage a purchase.
We may also process information about you supplied by other people when communicating with you, publishing a review or adding content in which you appear. Anyone providing information about others must have a lawful basis and respect their rights. Where required, we will provide the relevant information about the source and processing of data not obtained directly from you.
Use of the service generates technical information necessary for its operation, such as connection data and records relating to access and security. Optional website analytics and approximate location derived from an IP address are described separately in the Cookies Policy and require the choice explained there. Pseudonymous identifiers and approximate location are not automatically anonymous information.
Do not enter passwords, complete identity documents, banking information or unnecessary sensitive information in public fields. Publishing a profile does not authorise the use of its data for any purpose or turn private communications into public content.
Information shown when data is collected
Forms identify required fields and provide or link to the information relevant to that collection. A consent box is used only where consent is the appropriate legal basis, is not preselected and is separate from acceptance needed to perform a contract. Refusing optional consent does not prevent an unrelated requested service.
Contact and support
INSITU360, S.L. will process the information in your enquiry to respond and handle your request on the legal basis appropriate to its purpose. Do not send unnecessary sensitive information. You may exercise your rights at support@in-situ360.com. Further information is available in the Privacy Policy.
Email communications
Support, security, connection, chat, billing or other service emails are processed to deliver the requested service and protect the account. Messages and delivery records are retained while needed to handle the matter and for applicable legal, security or dispute periods. Recipients can exercise the rights described in this policy at support@in-situ360.com. A message sent to the wrong recipient should be deleted and reported without using or sharing its contents.
Publishing reviews, profiles and portfolios
Content you publish may be seen by its intended audience. Do not include confidential information or data about others without a lawful basis. You retain your rights in your content subject to the limited licence described in the service terms. Consult the Privacy Policy for information about personal data processing.
Registration and account
INSITU360, S.L. will process the information necessary to create and manage your account and provide the requested functions. Accepting the service terms does not, by itself, authorise marketing or optional analytics. Review the Privacy Policy and provide only information that is necessary or that you wish to include in your profile.
Advertisement or profile promotion request form
INSITU360, S.L. is the controller for the collection and processing of your data in order to manage the publication or placement of your advertisement, as well as the promotion of your profile. The legal basis for this processing is the consent of the data subject. There are no plans to pass on your data to third parties. We remind you that, in any case, you have the right to access, rectify and delete your personal data, as well as other rights, as explained in our privacy policy.
Product-specific privacy information
This section supplements the general information above with the processing observed in the current In Situ 360 website and mobile application. It must be read together with the Legal Notice, Terms and Cookie Policy. Where a feature is not available in the installed or deployed version, the related data is not collected through that feature.
Information processed by the service
- Account and identity data: email, account identifiers, authentication information, account type and, for business accounts, company and representative details.
- Profile data: name or company name, image, description, birth date, gender or pronouns where provided, profession, categories, tags, languages, locations, pricing indicator and visibility choice.
- User content: profile media, external links, PDF Works, professional advertisements and promotion requests, reviews, connection requests, chat messages and permitted chat attachments.
- Relationship and moderation data: Favorites/follows, connections, chat participants and read status, reports, the reason selected and actions taken.
- Subscription and billing data: plan and subscription status, Stripe customer/subscription references, billing details, invoice references and transaction status. In Situ 360 does not need to receive full card credentials handled by Stripe.
- Device and technical data: push token, installation identifier, platform, app version, language/locale, IP address, security logs and technical diagnostics generated by the service.
- Website analytics data, only after analytics consent: visitor and session identifiers, pages, interactions, referrer/UTM data, device/browser information, performance data and approximate IP-derived location.
Sources, purposes and legal bases
Most data comes directly from the user. The app also creates technical and relationship records when the user uses a feature, receives subscription status from Stripe, receives push-delivery data from Apple or Google, and may derive approximate web location from an IP address after analytics consent.
- Performing the user agreement: creating and securing the account, publishing the chosen profile and advertisements, providing promotion options, search, Favorites, connections, chat, reviews, subscriptions and support.
- Legitimate interests, subject to the required balancing: service security, abuse and fraud prevention, troubleshooting, enforcing the Terms, handling reports, defending claims and improving essential reliability.
- Consent: optional analytics, marketing communications where required, and device permissions when the operating system requests them. A device permission does not authorise unrelated purposes.
- Legal obligations: tax and accounting records, lawful requests, consumer protection, platform-safety duties and the establishment, exercise or defence of legal claims.
Profile visibility and sharing with other users
Profile fields, media, links, Works, professional advertisements, professional locations, pricing indicators and reviews are intended to be visible to other authorised members according to the product's visibility and plan rules. A business representative's identity fields, private email and birth date are not intended to form part of the public profile. Precise location coordinates are processed to support location features and should not be entered unless needed.
Connection requests and chats disclose the sender and the content to the selected recipient or conversation participants. Hiding a profile affects normal discovery; it cannot withdraw content already sent to another person, copied by a recipient or made available through an external link.
Device permissions
- Camera and photo library: choosing or taking profile and portfolio images.
- Microphone: recording audio messages when the user starts that action.
- Location while using the app: suggesting or completing professional locations and map searches. Location can also be entered manually where the interface permits.
- Notifications: registering an APNs or FCM device token and presenting account, connection or chat notifications according to available preferences.
- Files/storage: selecting, uploading, viewing or saving supported documents and chat attachments.
Permissions can be changed in device settings. Refusing a permission may disable the feature that needs it but should not authorise any other processing.
Service providers and international transfers
The current product integrates Supabase for authentication, database, realtime functions and private storage; Stripe for subscriptions, billing and payment processing; Google Maps/Places or geocoding for location features; Apple Push Notification service and Firebase Cloud Messaging for push delivery; and ipapi.co for approximate website analytics location after consent. Transactional email and infrastructure providers may also process the minimum data needed to deliver their service.
Some providers may process data outside the European Economic Area. Where this occurs, the controller must use an applicable transfer mechanism and supplementary measures where required, such as an adequacy decision, the EU Standard Contractual Clauses or another lawful safeguard. Users may request information about the safeguards relevant to their data.
Retention, account deletion and local copies
Account and profile data is generally kept while the account is active. Content and relationship records are kept while needed to provide the relevant feature. Billing, security, moderation and dispute records may be blocked or retained for the periods required by applicable law or while a claim can be pursued. The audited implementation can retain backups, archived profile media and orphaned attachment objects beyond deletion of the active record; the controller must establish, apply and publish verified deletion schedules rather than promise immediate erasure.
The in-app deletion control starts an account-deletion process and signs the user out after confirmed completion. Subscription cancellation is a separate action. The app may have stored messages, pending attachments or media caches locally on the device; users should also remove the app or device data where they need to erase those local copies. Exact retention schedules, backup deletion and legally required holds must be maintained and reviewed internally by the controller.
Rights, security and age
Users may request access, rectification, erasure, restriction, objection and portability where the legal requirements are met, withdraw consent without affecting earlier lawful processing, and complain to the Spanish Data Protection Agency (AEPD). Requests can be sent to support@in-situ360.com; identity may be verified proportionately before acting on a request.
In Situ 360 applies organisational and technical measures intended to reduce risk, including authenticated access and private storage for selected files. No internet service can guarantee absolute security, uninterrupted availability or that recipients will not copy content. Users must protect their credentials and report suspected compromise.
The service is intended for adults aged 18 or over. It does not use automated age or identity verification for every account. If the controller learns that an ineligible minor has registered, it may investigate and delete or restrict the account.
Ranking, automated decisions and communications
Search, ordering and recommendation features may automatically use profile fields, selected filters, visibility, plan capabilities and interaction signals. The audited product does not show a solely automated decision that produces legal or similarly significant effects. If that changes, the policy will describe the logic and safeguards required by law.
Service messages may be sent to operate the account, security, connections, chat or billing. Promotional email or push communications are sent only where there is a valid legal basis and must include a practical way to object or unsubscribe where required.
Retention
Account information is retained while needed to maintain the account and provide the requested services. After closure, information no longer needed will be deleted, except where retention is justified by legal obligations, claims or security. In Spain, where required, data will be blocked for the period during which liability may arise and deleted once that period ends.
Enquiries and complaints are retained while being handled and afterwards only for a period justified by the associated liabilities or obligations. Information used for marketing will stop being used for that purpose when consent is withdrawn or an objection is made. The minimum information necessary to respect that choice and document how it was handled may be retained.
Retention of technical logs, analytics and backups must reflect their purpose and necessity; there is no default indefinite retention. Deleting browser data does not delete records already received by a server. You may request information about the criteria applicable to your data through the privacy contact channel.
Additional information for United States residents
This section supplements the Privacy Policy. Specific rights depend on your residence, the processing involved and whether the relevant law applies to In Situ 360. It does not limit other rights you may have, including rights under European law where it applies to the processing.
California
Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, you may exercise its rights to know and access personal information processed about you, request deletion and correct inaccurate information. As provided by that law, information rights cover categories and specific pieces of information, sources, purposes and categories of recipients, together with disclosures, sales or sharing that must be reported.
You may also opt out of the sale or sharing of personal information and limit certain uses and disclosures of sensitive personal information where the legal conditions for those rights are met. “Sale”, “sharing” and “sensitive personal information” have their statutory meanings, which are not limited to receiving a payment or to medical information.
You will not receive discriminatory treatment for exercising rights protected by law. You may use an authorised agent, subject to the applicable proof of authority and verification requirements. Verification or creation of an account will not be required where the law prohibits it for the choice requested.
Other states
Where an applicable state law provides such rights, you may request confirmation of processing, access, correction, deletion or a portable copy of your information; opt out of data sales, targeted advertising or certain profiling used for decisions with legal or similarly significant effects; and exercise the applicable choices concerning sensitive data.
Where that law provides a right to appeal a decision on your request, you may appeal by emailing support@in-situ360.com with the subject “Privacy appeal” and identifying the decision. You will receive the response, its reasons and, where applicable, information about contacting the competent authority. This channel does not prevent you from using statutory complaint mechanisms.
Requests and time limits
You may use support@in-situ360.com to submit a request or privacy choice. Each type of request will be handled within its applicable statutory deadline. Where CCPA applies, verifiable access, correction and deletion requests will generally be resolved within forty-five calendar days, subject to the reasoned extension permitted by that law. This period does not override a shorter deadline that applies concurrently and does not apply indiscriminately to opt-out requests.
This email channel does not replace automatic opt-out mechanisms that applicable law requires us to recognise. Accepting the service terms is not treated as authorisation for a sale, sharing, targeted advertising or use of sensitive information requiring a specific choice or authorisation.
Other international rights and complaints
United Kingdom
Where processing is subject to UK data protection law, you may exercise the rights it provides and complain to the Information Commissioner's Office. To complain to In Situ 360 about the processing of your data, email support@in-situ360.com with the subject “Data protection complaint — United Kingdom” and explain what happened. Where the UK complaints-handling duty applies, we will acknowledge receipt within thirty days, investigate and communicate the outcome without undue delay. This acknowledgment deadline does not replace the deadline for an access request or another data right.
Canada
Where Canadian privacy law applies, you may request information about the existence, use and disclosure of your data, obtain access and request correction, and withdraw consent as provided by law. Where withdrawal affects a service, its consequences will be explained. Access requests under PIPEDA will generally receive a response within thirty calendar days, subject to permitted and properly notified extensions. You may complain to the Office of the Privacy Commissioner of Canada or the competent provincial authority, as appropriate. Not all Canadian laws provide an identical deletion right.
Brazil
Where the Lei Geral de Proteção de Dados applies, you may exercise its rights, including confirmation and access; correction; anonymisation, blocking or deletion in the statutory circumstances; portability under applicable regulation; information about entities with which data has been shared; information about the possibility and consequences of refusing consent; and withdrawal of consent. You may also request review of automated decisions as provided by that law and contact the Autoridade Nacional de Proteção de Dados. Deadlines and exceptions depend on the specific right exercised.
Australia
Where the Privacy Act and Australian Privacy Principles apply, you may request access to and correction of your information and complain about its processing to support@in-situ360.com. Explain your concern and the outcome you seek; we will acknowledge receipt, examine the facts and communicate the outcome without undue delay. You may also approach the Office of the Australian Information Commissioner under its procedures. This provision does not limit your mandatory consumer guarantees and remedies.
Other jurisdictions
If an applicable law provides additional rights, you may identify them in a request to the same privacy channel. Its requirements, limitations and complaint mechanisms will apply without this policy reducing mandatory rights. Mentioning a jurisdiction does not mean all of its laws apply to every user or that website availability constitutes authorisation to operate in every country.
Scope and changes to this policy
This policy explains processing by INSITU360, S.L. in connection with the In Situ 360 services described in it. It does not replace specific information that must be given in a form, function or particular processing activity. If you use an external service, also review its controller's information.
This wording was last reviewed on 17 September 2026.
When this policy changes, we will publish the updated version and identify its revision. Where a change materially affects the processing of your data, prominent information or an appropriate communication will be provided before it applies where required by law. Any necessary specific consent must be validly obtained; updating the text or keeping an account does not replace it.
An update to this policy will not be used to retrospectively authorise processing that lacked a lawful basis. You may request information about the version relevant to a processing activity by emailing support@in-situ360.com.