Security Statement

This Statement summarises how Eduard Varariu Diaconu, acting under the trade name DEL Studio, approaches information security on his websites and in the services he provides. The identification details of the owner are set out in the Legal Notice.

It is a general overview. It does not constitute a security certification, an audit report, or a guarantee that systems are free from vulnerabilities, incidents, or interruptions. Security obligations regarding a specific client are those established in the contract and, where applicable, in the data processing agreement, which prevail over this Statement.

We apply technical and organisational measures proportionate to the risk, taking into account the nature of the information processed, the service in question, and the applicable legal obligations, including Article 32 of the RGPD (General Data Protection Regulation).

• //Encrypted communications. The Websites are served via encrypted connections (HTTPS).
• //Payment data. Card payments are processed by Stripe. We do not receive or store full card details.
• //Limited access. Access to information and systems is limited to persons who need it to provide the service.
• //Suppliers. We use technology providers that offer security guarantees and, when they process personal data on our behalf, we formalise the contractual guarantees required by the RGPD with them.
• //Client data. Information entrusted to us by a client for a project is treated in accordance with the contract, the client's instructions, and the duty of confidentiality.

The specific measures for each project (for example, backups, environments, access controls, and availability requirements) are defined in the corresponding contract.

The security of a service also depends on the systems, accounts, devices, and decisions of the client and the third-party platforms they use. Each party is responsible for the environments it manages and the obligations it assumes by contract. Clients must, among other things, safeguard their credentials, grant only necessary access, apply the security measures corresponding to them, and promptly inform us of any incident that may affect the service.

If you believe you have found a vulnerability on the Websites or in a system we manage, please write to us at security@delstudio.site. So that we can evaluate it, please include a description, steps to reproduce it, the affected system, and the estimated impact. Do not include passwords, keys, or personal data in the message.

When disclosing it, we ask that you:

• //Act in good faith and limit your testing to what is essential to demonstrate the problem.
• //Do not access, copy, modify, or delete data that is not yours, nor interrupt the service.
• //Do not use social engineering, denial-of-service attacks, or physical testing.
• //Do not disclose the vulnerability until we have had a reasonable period to analyse and correct it.

We will acknowledge receipt, evaluate the report, and keep you informed where reasonable. We will not take legal action against those who act in good faith in accordance with this section, without prejudice to what is established by law. This section does not authorise testing on systems of our clients or third parties, and does not establish a reward programme.

If we detect an incident affecting personal data, we will evaluate it and act in accordance with the RGPD:

• //When acting as a data processor, we will communicate it to the responsible client without undue delay.
• //When acting as a data controller, we will notify the Spanish Data Protection Agency (AEPD) within the legal timeframe where applicable, and the affected parties when there is a high risk to their rights and freedoms.

If you are a client and detect an incident that may affect one of our services, please report it to security@delstudio.site indicating the affected system, the approximate date, the known impact, and the measures adopted. Receipt of a communication does not imply recognition of the incident nor assumption of responsibility for systems outside our control.

No system is completely secure. This Statement does not establish guaranteed correction, response, or recovery timeframes; any such commitment must be expressly stated in the contract or applicable support agreement. Nothing in this Statement excludes or limits liabilities that cannot be legally excluded or limited.

We may update this Statement when our practices, services, or regulations change; the current version indicates its date. For any security queries, write to security@delstudio.site; for personal data matters, to privacy@delstudio.site. This Statement is provided in Spanish, which shall prevail if published in other languages.