VES Platform Privacy Policy | VES de RKL Integral

This policy is about VES, the critical procedure activation platform, in any of the ways you may use it: web application and mobile apps for iOS and Android. If you are only visiting our website or have requested a demo, what applies to you is the website Privacy policy.

Who decides about your data

This is the first thing to understand, because it determines who you should turn to.

When your organisation — a hospital, a port, a university, a public authority — subscribes to VES, it is that organisation that decides what data is processed and for what purpose. It is the controller.

RKL Integral acts as a processor: we process that data only on your organisation’s instructions and in accordance with the data processing agreement we signed with it, on the terms of Article 28 GDPR.

In practice, this means that:

If you want to exercise your rights over the data VES processes about you, you must contact your organisation, not us. We will assist it so that it can respond to you.
We do not use your data for our own purposes. We do not sell it, we do not disclose it and we do not use it to profile you or to train models.
It is your organisation that decides how long the data is kept and who can access it within the platform.

There is one narrow exception: RKL Integral acts as the controller for billing, contract management and the contact details of the people we deal with at the client organisation, because we are the ones who decide on that processing. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and compliance with our tax and accounting obligations (Art. 6(1)(c) GDPR); the data is kept for as long as the contractual relationship lasts and, after that, for the applicable tax and commercial limitation periods.

The limit is worth spelling out: technical support does not fall within that exception. When we access data about people who use the platform in order to resolve an incident, we do so on your organisation’s instructions and we remain the processor.

What data VES processes

It depends on how each organisation configures the platform. As a general rule:

Identification and contact: first name, surname, position or role within the plan, phone number, email address and the channels through which you are to receive alerts.
Operational activity: procedures activated, tasks assigned, statuses, response times, acknowledgements of receipt and any notes or evidence attached during an activation or a drill.
Audit log: who did what and when. This is the core of the product: traceability is precisely what VES delivers, which is why these records are unalterable.
Technical data: device identifier, app version and access logs, needed to deliver notifications and for security.

The audit log and your rights

The fact that these records are unalterable has to sit alongside your right to rectification and erasure, and it deserves an explanation rather than a footnote.

An audit log documents what actually happened during an activation or a drill. If it could be rewritten, it would stop serving the purpose it exists for: proving to an authority, an inspection or a court how the response was handled. That is why Article 17(3) GDPR accepts that the right to erasure gives way where the processing is necessary to comply with a legal obligation or to establish or defend legal claims.

In practice: a correction does not delete the earlier entry, it adds a new one that reflects the correction, so that the full sequence remains readable. If you ask for erasure, the decision rests with your organisation as the controller; where data cannot be erased, the usual alternative is to block access to it or to pseudonymise it, keeping traceability without exposing your identity. We carry out whatever your organisation decides.

The mobile apps

Push notifications: the app uses the notification services of Apple (APNs) and Google (FCM). To do so, a device identifier is sent to those services, never the sensitive content of the alert.
Location: the app only accesses your location if your organisation has enabled that feature and you grant permission on your device. You can revoke it at any time from your system settings.
Camera and files: these are used only when you attach evidence to a task, and always with your express permission.
No advertising, no tracking: the VES apps contain no advertising networks and no tracking identifiers for commercial purposes.

About your account: VES accounts are not self-created — your organisation sets them up, and it is your organisation that suspends or deletes them. If you want yours gone, ask your organisation: it is the one that can do it, and we will assist it. Uninstalling the app does not delete your account.

International transfers

Platform data is hosted and processed within the European Union.

There is one exception worth stating plainly: the delivery of push notifications. For an alert to reach your phone it has to go through Apple’s (APNs) and Google’s (FCM) services, which may process the device identifier outside the European Economic Area. Those transfers rely on the standard contractual clauses approved by the European Commission. What travels is the device identifier and the minimum alert needed to make your phone ring; the sensitive content of the procedure does not leave the platform: you read it inside the app, once you are authenticated.

If your organisation needs to avoid that transfer altogether, there is the option of operating only through channels that do not require it. That is a configuration decision, agreed in the contract.

Sub-processors

To provide the service we rely on suppliers that process data on our behalf, all of them under a signed contract and subject to the same obligations we take on ourselves. The current list of sub-processors, with their location and their role, is given to each client organisation together with the data processing agreement.

When we want to add or replace a sub-processor, we will tell the client organisation at least 30 days in advance. During that period it may object on reasonable grounds; if we cannot reach an agreement, it may terminate the contract without penalty as regards the services affected.

Security

RKL Integral is certified under the Esquema Nacional de Seguridad (Spain’s National Security Framework), medium category. The measures we apply include role-based access control, activity logging, encryption in transit, backups and vulnerability management. The details that apply to each client are set out in the data processing agreement.

Retention and return of data

Data is kept for as long as the contract with your organisation lasts. When it ends, and according to what your organisation instructs, the data is returned or securely deleted, unless a legal obligation requires us to keep it for a further period.

Personal data breaches

If a security breach affecting personal data occurs, we will notify the controller organisation without undue delay, with the information it needs to meet its obligations towards the supervisory authority and, where applicable, towards the people affected.