Ironchip Identity Platform

GDPR overview

Implementation is concrete and documented. The product privacy policy is written against Regulation (EU) 2016/679 and Spain's Organic Law 3/2018, names IRONCHIP TELCO, S.L. as controller at its Barakaldo registered office with tax ID B95880332, and designates a named Data Protection Officer, Maria Llanas Villa, reachable at dpo@ironchip.com. A record of processing activities is maintained under Article 30, and a Data Processing Agreement is supplied as Annex A to the licence terms rather than negotiated separately. Users are granted access, rectification, erasure, objection, restriction, portability and human review of automated decisions. Processing takes place by default within the European Economic Area. The vendor also holds a nominative ISO/IEC 27701:2019 privacy management certificate. Note that a separate, narrower privacy policy covers the marketing website; the product policy prevails for the platform.

Who owns the data?

Ownership is split by role. When the platform authenticates a client organisation's own users, Ironchip acts strictly as a data processor under Article 28 GDPR: the client remains the controller, decides which data enters the system and on what legal basis, and Ironchip may only follow its documented instructions. Ironchip becomes controller only for the technical data it needs to run and secure the service, such as system logs, usage-derived information, unauthorised-access events and support exchanges. The vendor states it never stores plaintext passwords, never accesses users' private keys, and never receives raw biometric data, only a success or failure signal returned by the device.

Reuse rights

The client keeps full access to its own users' data in order to manage accounts, monitor access and run internal security and audit controls, and it may export access logs and security events over Syslog or the API into its own SIEM. No permission from Ironchip is required for that reuse, since the client is the controller for those records. Ironchip's own reuse is contractually narrow. It processes data to authenticate users and manage access (contract performance), to protect the client's environment and detect anomalies (legitimate interest), to maintain performance and stability, to handle support requests, and to answer lawful requests from authorities. It commits not to use the information for marketing, commercial profiling or anything unrelated to providing the service, not to sell it, and not to disclose it to third parties for unrelated purposes. Optional context features such as location require the client to collect explicit user consent.

Data retention & training

Hosting summary

Processing takes place by default within the European Economic Area, where Ironchip says it keeps its main infrastructure and applies the safeguards required by European law. Transfers outside the EEA are permitted only where genuinely necessary to deliver or maintain the service, and only under adequacy decisions, Standard Contractual Clauses, or additional technical measures such as encryption or pseudonymisation. No individual country is named. The ENS High certificate is more specific about locations in scope, listing the Barakaldo office alongside AWS Europe and Microsoft Azure Europe, both described as external high-level data centres. Third-party providers supplying hosting, messaging for authentication factors, support tooling and log management act as processors under Article 28 contracts, though no named list of them is published. Jurisdiction is Spanish, with the product licence terms pointing disputes to the courts of Bilbao. Note that the marketing website itself runs on a hosted CMS behind a content delivery network, which is a separate matter from where platform data resides.