This page provides the information that Recrea Systems, S.L. (“Quaderno”) makes available under Article 28 of Regulation (EU) 2023/2854 (the Data Act). It is referenced in our Terms of Service.

1. Where your data is hosted

Quaderno is hosted on infrastructure operated by Amazon Web Services in Ireland, within the EU. The production database, file storage, backups and logs are all located there. The Amazon Web Services account is owned by Visma Group, of which Recrea Systems, S.L. is part.

Some of our subprocessors, such as providers of error monitoring, support, email delivery and analytics tools, may process customer data outside the EU. All of them are listed in the Visma Trust Centre, and each transfer is covered by a valid legal mechanism, such as the EU Standard Contractual Clauses.

Our current list of subprocessors is available at the Visma Trust Centre.

2. Jurisdiction

The infrastructure used to provide Quaderno is located in Ireland and is subject to EU law and the laws of that Member State.

3. Measures to prevent unlawful international governmental access or transfer

Contractual

  • Our subprocessors must accept data protection obligations corresponding to those in our Data Processing Agreement.
  • Where a subprocessor is outside the EU/EEA, we ensure a legal basis for the transfer, including by entering into the EU Standard Contractual Clauses.
  • We and our staff must keep personal data confidential, and this obligation continues after our agreement ends.
  • We do not disclose information about our customers’ agreements to authorities except where obligated by law, such as through a court order or similar warrant.

Organisational

  • Everyone who works with customer data, including our freelancers, is bound by confidentiality obligations.
  • All access to production data is from within the EU.

Technical

  • Customer data is encrypted in transit and at rest. Encryption at rest uses keys managed by Amazon Web Services.
  • Access to production systems requires multi-factor authentication or single sign-on, and that access is logged.
  • Payment card details go directly to our payment processor and never reach Quaderno’s servers.

4. Requests from non-EU authorities

If a court or authority of a non-EU country orders us to transfer or give access to non-personal data held in the EU, we will use all reasonable efforts to make sure the order complies with applicable law, and we will comply with it only where one of the following applies:

  • The order is based on an international agreement in force between that country and the EU or the relevant Member State, such as a mutual legal assistance treaty.
  • In the absence of such an agreement, the conditions of Article 32(3) of the Data Act are met. That is, the legal system of that country requires the order to be reasoned, proportionate and specific, our objection to the order can be reviewed by a competent court in that country, and that court is empowered to take into account the legal interests protected by EU law or the law of the relevant Member State.

Where we are unsure whether those conditions are met, we may ask for the opinion of the competent national authority for international cooperation in legal matters. If that authority does not reply within one month, or concludes that the conditions are not met, we may reject the request.

Where we do comply, we will provide only the minimum amount of data permissible, based on a reasonable interpretation of the request.

We will inform the affected customer about the request before complying with it, except where the request serves law enforcement purposes and only for as long as necessary to preserve the effectiveness of the law enforcement activity.

Updated at · Effective as of