Statutory Terms & Legal Notices

1.1 Controller. CodeBloomSystems, with registered premises at 17180, C. Vinya, 19B, Girona, Vilablareix, Spain, is the data controller for personal data processed through this website, our order slips, and our service engagements. You may reach our data desk at [email protected] or by telephone on +34 649 81 35 26.

1.2 Data we collect. We collect the identifiers you type into our customer order slip: name, work email, telephone number, company name, selected service, budget band, and the free-text notes you provide. We additionally collect billing identifiers required for invoicing, and technical logs (IP address, user agent, timestamp) generated when you load our pages.

1.3 Purposes and legal bases. Order slip data is processed under Article 6(1)(b) GDPR to take steps at your request prior to entering a contract. Contract and invoice records are processed under Article 6(1)(c) to comply with Spanish tax and commercial bookkeeping obligations. Technical logs and non-essential cookies are processed under Article 6(1)(a) consent, which you may withdraw at any time through the cookie notice.

1.4 Recipients. Data is shared only with processors who assist us in running the business: our hosting provider, our email provider, our accounting platform, and our payment processor. Each processor acts under a written agreement under Article 28 GDPR. We do not sell, rent, or broker personal data to advertising networks.

1.5 Transfers. Our systems operate within the European Economic Area. Should a processor require a transfer outside the EEA, we rely on Standard Contractual Clauses adopted by the European Commission together with supplementary technical measures.

1.6 Retention. Enquiry correspondence is retained for 24 months from the last contact. Contract, invoice, and tax records are retained for 6 years as required by the Spanish Commercial Code, and for 4 years under the General Tax Registry obligation. Server logs are purged after 12 months.

1.7 Your rights. You may request access, rectification, erasure, restriction, portability, and objection under Articles 15 to 21 GDPR, and you may withdraw consent without affecting prior processing. Write to [email protected] and we will respond within one month. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es) or your local supervisory authority.

1.8 Security. We apply access control, encryption in transit, least-privilege review, and logged administrative access appropriate to a security services provider. Any personal data breach will be assessed within 72 hours and notified to the AEPP where Article 33 GDPR requires it.

2.1 Scope. These terms govern every service ordered from CodeBloomSystems, including vulnerability assessments, cloud perimeter defense reviews, penetration testing, security monitoring, compliance analysis, code review, training, and incident response retainers. A countersigned statement of work or order confirmation prevails where it expressly varies these terms.

2.2 Engagement and rules of engagement. Testing and assessment work begins only after written scope confirmation. You warrant that you are authorised to test the assets listed in the scope and that you will provide timely access, contacts, and change notices. Work outside the agreed scope is quoted separately before it is performed.

2.3 Fees and payment. Prices are stated in US dollars or euros as shown on the order confirmation and exclude VAT and any withholding. Invoices are payable within 14 calendar days of issue through our payment counter. Late amounts accrue statutory interest under Spanish law plus a compensation fee of 3% of the outstanding balance. Retainer services are billed monthly in advance.

2.4 Delivery and turnaround. Turnaround periods quoted in our service register begin on the date all required access, credentials, and scoping answers are received. Where you suspend cooperation, delivery dates extend by the length of the delay. We will notify you promptly if any milestone is at risk.

2.5 Intellectual property. On payment in full, you receive worldwide ownership of the client-specific deliverables prepared for you, including report text, findings, and remediation artefacts. We retain ownership of our pre-existing tools, scanners, checklists, and methodologies, and you receive a perpetual licence to use embedded tooling solely for your internal purposes.

2.6 Confidentiality. Each party will keep the other's non-public information confidential and will disclose it only to personnel with a need to know. Findings, vulnerabilities, and internal security posture details are treated as confidential for 3 years after disclosure, and neither party will publicise the engagement without written consent.

2.7 Warranties and liability. Services are performed with the skill and care of a competent security practitioner. No engagement guarantees that systems will be free of all vulnerabilities or that incidents will not occur. To the maximum extent permitted by law, our aggregate liability for any engagement is limited to the fees paid for that engagement, and neither party is liable for indirect or consequential loss. Nothing in these terms limits liability for fraud, wilful misconduct, or any liability that cannot be excluded under Spanish law.

2.8 Term and termination. Either party may terminate an engagement for material breach that remains uncured 15 days after written notice. Retainers may be cancelled with 30 days' written notice at the end of the current billing period. On termination you pay for work performed up to the effective date.

2.9 Governing law. These terms are governed by the laws of Spain, and the courts of Girona have exclusive jurisdiction over any dispute, without prejudice to mandatory consumer protections available to you under the law of your country of residence.

3.1 What cookies are. Cookies and similar local storage entries are small records a website writes to your browser so it can remember information between page loads. This policy explains which records CodeBloomSystems writes and why.

3.2 Strictly necessary records. We store one local storage key, cookie_accepted, which records that you have answered the cookie notice so we do not ask you again on every visit. Because these records are required to operate the consent mechanism, they do not require prior consent under Article 5(3) of the ePrivacy Directive.

3.3 Optional records. We do not run third-party advertising or cross-site tracking cookies. If analytics or embedded media is enabled in the future, it will remain disabled until you accept it through the cookie notice, and this policy will be updated with the exact identifiers and retention periods before it activates.

3.4 Third-party content. The contact page embeds a Google Map. Google may set its own technical cookies when that frame loads; Google acts as an independent controller for those records, and its practices are described in Google's own privacy documentation. You can avoid this by contacting us by telephone or email instead of using the map.

3.5 Duration. The consent record persists until you clear your browser data for this site. Session cookies, if required by our hosting layer for security or load balancing, expire when you close the browser.

3.6 Managing cookies. You can delete or block cookies through your browser settings at any time. Blocking strictly necessary records will cause the consent notice to reappear on each visit but will not affect access to our content. Questions can be directed to [email protected].

4.1 Cooling-off period. If you are a consumer ordering at a distance, you may withdraw from a service contract within 14 days of confirmation under Directive 2011/83/EU. Where a service begins with your express request before the period ends, you remain responsible for the proportion of the work performed up to the moment of withdrawal.

4.2 Fixed-scope engagements. For assessments, penetration tests, and readiness analyses, deposits become non-refundable once the scope statement is countersigned, because analyst time is reserved for your dates. If we cannot start work for reasons attributable to CodeBloomSystems, you receive a full refund of any amount paid.

4.3 Cancellation schedule. Engagements cancelled more than 10 business days before the start date are refunded in full less any payment processing fees. Cancelled 3 to 10 business days before the start date, 50% of the fee is retained. Cancelled inside 3 business days, the full fee is due, because the analyst slot cannot be resold at short notice.

4.4 Monitoring retainers. Monthly monitoring and incident response retainers are billed in advance and may be cancelled with 30 days' written notice. Unused calendar days remaining at cancellation are refunded on a pro-rata basis. The first month is non-refundable after onboarding and log-source configuration have been completed.

4.5 Non-conforming deliverables. If a deliverable materially deviates from the agreed scope, notify us within 10 business days of delivery and we will rework the affected section at no charge. If we cannot cure the deviation within a reasonable time, you may terminate the engagement and receive a refund of the fees paid for the uncorrected portion.

4.6 How to request a refund. Email [email protected] from the address used on your order slip, quoting your slip reference. Approved refunds are issued to the original payment method within 14 calendar days of approval. Statutory rights of consumers under Spanish and EU law are unaffected by anything written above.