GDPR and data protection at Skeyon
Skeyon Lab S.L. — VerifyEmails, Pop-ups and Automation
Version 1.1 — Last updated: August 24, 2026
At Skeyon, we process the personal data entrusted to us by our customers to provide the services they contract and following their instructions. We apply technical and organizational measures to protect this information and establish specific conditions for use, storage, and deletion.
This page explains how we approach data protection in the verification of emails, telephone numbers, names and postal addresses, and in the Pop-ups and Automation platforms, within the framework of the General Data Protection Regulation (GDPR) and the applicable Spanish regulations.
Our role in data processing
When a customer uses our services to verify or manage their contacts, they usually act as a data controller: they determine the purpose and must have the necessary legal basis. Skeyon acts as a data processor, processing the data on behalf of the customer and in accordance with their documented instructions.
If the client is an agency that processes data on behalf of another organization, Skeyon may act as a sub-processor. The agency must have the necessary authorizations to use the service on behalf of that organization.
For data that we use for the purposes of account management, invoicing or compliance with legal obligations, we act as a data controller. These uses are explained in our Privacy Policy.
The conditions of processing on behalf of our clients are set out in the Personal Data Processing Agreement (DPA).
Two services for different purposes
Verification of contact data
We process emails, telephone numbers, names or postal addresses to carry out the requested checks and return their results. Depending on the product contracted, the operations may include validation, normalization or correction of the data.
The files and results kept for the service are deleted within a maximum of 30 days from the date of verification. The customer must download the results they need before that period expires.
Pop-ups and Automation
These platforms allow data to be captured and managed, contacts to be maintained and the actions or communications configured by the customer through the contracted functionalities.
In this case, the data remains on the platform for as long as the service is active and the customer does not request its deletion. Continued storage is part of the service and is different from the temporary retention of verification results. The customer must establish and implement retention periods appropriate to their purposes: maintaining an active account does not in itself justify keeping all contacts indefinitely.
Limited use and minimization
We use the data processed on behalf of the customer for the purposes of the service and its instructions. We do not reuse contacts or the results of verifications for other customers, to create our own contact databases or to train artificial intelligence models.
The customer must provide only the necessary information: for example, delete columns outside the verification before uploading a file and limit the fields of the forms to their purpose.
The verification of a contact data does not accredit the consent of its owner nor does it authorise the sending of commercial communications by itself. The customer must comply with the information obligations and the rules applicable to the actions they configure.
We do not systematically review all the content that customers upload. This does not remove our obligations as a processor in respect of the personal data that we actually process. These services are not intended to process special categories of data or data relating to criminal convictions and offences under standard conditions. Any such processing requires specific prior assessment and agreement, in accordance with the DPA; the signing of an agreement is not a substitute for the legal basis and any safeguards that may be enforceable.
Security and confidentiality measures
The measures implemented include:
- HTTPS/TLS in communications for access to services.
- File encryption and backups.
- Role-based access, limited to authorized functions.
- Multi-factor authentication for administrators.
- Confidentiality commitments of personnel who can access data.
- Incident management procedure and support channels for their communication.
- Procedures for deletion through the panel and, when necessary, selective deletion by authorized personnel.
Skeyon personnel access the data from Spain. Access is limited to the necessary tasks of support, maintenance, security and recovery of the service, in accordance with the DPA. The locations and conditions of our suppliers are different from those of Skeyon personnel.
Retention and deletion
| Information or status | Retention and disposal |
|---|---|
| Files and verification results | Maximum of 30 days from the date of verification. |
| Pop-ups and Automation data | As long as the service is active and the customer does not order its deletion. |
| Service logs | Maximum of 30 days from generation; this period does not make it lawful to keep unnecessary data in the logs. |
| Account deletion using the Active | Data pane; residual backup copies are deleted within 30 days of deletion. |
| Effective termination of the service | Complete deletion of data processed on behalf of the customer within a maximum of 30 days, including backups. |
A failed receipt or a temporary suspension does not in itself equate to the termination of the service. In the event of non-payment, the termination procedure provided for in the contractual conditions will be applied and the corresponding effective date will be communicated.
The cancellation is understood to have occurred on the date of effective termination of the service, not necessarily when it is requested to cancel its renewal. The deletion of an account and the termination of a specific product have different scopes: the data linked to other services that continue to be contracted maintain the regime that corresponds to them.
Prior to deletion, the customer may download their data using the available features or request its return to support. If access to the dashboard is suspended, the customer may process the request through contactar@verificaremails.com, upon verification of your identity and qualifications. The return must be requested within the applicable retention period. Recovery of already deleted data cannot be guaranteed in accordance with the customer’s instructions or agreed timeframes. The functions of the dashboard and support assistance do not imply that any shared record or backup may be deleted individually and immediately.
Backups pending deletion remain protected and are not used for the ordinary operation of the service. If a legal obligation requires the retention of certain data, its processing is limited to that obligation. Billing data and other data processed by Skeyon for its own purposes follow the terms and conditions of the privacy policy.
Infrastructure and providers
We use the following infrastructure providers for the services described:
| Provider | Function | Location or Scope |
|---|---|---|
| Hostalia — Telefónica Soluciones de Informática y Comunicaciones de España S.A.U. | Hosting, storage and management of Automation data. | Madrid, Spain. |
| Noraina Ltd. | Hosting, storage and management of verification data and Pop-ups. | Equinix DB3 centers, in Dublin, Ireland, and Equinix PA2, in Saint-Denis, France. |
| Cloudflare, Inc. | Cache and proxy services. | Global infrastructure; processing not guaranteed exclusively within the European Economic Area. |
Noraina’s data center addresses are:
- Equinix DB3: Unit 2 Northwest Business Park, Ballycoolen, Dublin 15, Ireland.
- Equinix PA2: 114 Rue Ambroise Croizat, 93200 Saint-Denis, France.
Skeyon must ensure that international transfers made by its suppliers on its behalf have a valid mechanism in accordance with Chapter V of the GDPR, such as an applicable adequacy decision or appropriate safeguards, as the case may be. This page does not attribute to a provider a specific certification or mechanism that is not identified in the applicable documentation. The European hosting of the main data does not in itself mean that all access or processing by the providers takes place in Europe.
The table describes the infrastructure indicated, without by itself extending the authorisation to new providers or functionalities. Annex III of the DPA identifies the entities and their functions. The incorporation or replacement of sub-processors is governed by the information and objection procedure provided for in that agreement.
Rights of individuals and assistance to customers
Where the GDPR is applicable, individuals may exercise, under the conditions provided for by the regulations, their rights of access, rectification, deletion, limitation of processing, portability and opposition, as well as the right not to be subject to certain decisions based solely on automated processing. If the processing is based on consent, they can withdraw it without affecting the lawfulness of the previous processing.
If your request relates to your account data or other processing for which Skeyon is responsible, you can write to contactar@verificaremails.com. The privacy policy explains these rights and the available channels in more detail.
If your data is handled by one of our customers, you should preferably contact that organization, which decides on the processing. If we receive your request directly, we will pass it on to the relevant customer without undue delay when we can identify them and provide assistance in accordance with the DPA. If we need additional information to locate you, we will only request what is necessary, avoiding asking for data outside the request.
You can also file a complaint with the competent data protection authority, including the Spanish Data Protection Agency.
Incident management
We have an incident management procedure in place. The support team receives communications and channels them for investigation and response.
If we become aware of a security breach involving personal data processed on behalf of a customer, we will notify you without undue delay and provide you with the available information and necessary updates. We will work together to enable you to assess the incident and comply with your reporting obligations.
Documentation and contact
This page provides an informative summary. It does not replace the DPA or the privacy policy. The contractual obligations of processing on behalf of the customer are regulated in the DPA incorporated into its contract. The publication of this page does not constitute a certification or guarantee in itself that you will comply with all the obligations of the GDPR, nor does it modify the conditions accepted by the customer.
Skeyon Lab S.L.
NIF: B65911679
Zamora 105, 6.º 3.ª, 08018 Barcelona, Spain
Privacy Contact: contactar@verificaremails.com
