Last updated: 11 August 2026

1. Who is responsible for your data

The data controller depends on where you are located when you use this website:

• European Economic Area: Speedyrails Inc. Establecimiento Permanente, NIF W0294844F — Calle Isabel la Católica 19, Planta 1, Puerta 1, 46004 Valencia, Spain.
• Canada: Speedyrails Inc. — 403 Bank St, Ottawa, ON K2P 1Y6, Canada.
• Rest of the world: Speedyrails Inc. — 400 N Tampa St, Suite 1550, Tampa, FL 33602, USA.

For any privacy matter you can contact us at privacy@speedyrails.com.

2. What data we collect

The data we collect is identifying data you provide or that is generated by your use of the site. We do not collect special categories of data (such as health, beliefs, or biometric data) or data relating to criminal offences.

• Contact form: the name, company, email address, and message you submit.
• Usage data (analytics): if you consent, Google Analytics collects pseudonymous information about how you use the site (pages viewed, approximate location, device and browser). See our Cookie Policy.
• Technical data: server and CDN logs (such as IP address and pages requested), used to operate and secure the site.

3. Why we use it, and the legal basis

• To answer your enquiry and provide what you ask for — legal basis: steps taken at your request before any contract, and our legitimate interest in responding.
• To operate, secure, and improve the website — legal basis: legitimate interest.
• To run analytics and load functional tools such as scheduling — legal basis: your consent, which you can withdraw at any time.

4. Service providers

We rely on a small number of providers who process data on our behalf under appropriate agreements:

• Amazon Web Services — website hosting and delivery, and email delivery of your contact message (Amazon SES).
• Google (Google Analytics) — website usage analytics, only if you consent.
• Calendly — appointment scheduling, only if you consent and choose to book.

5. International transfers

Depending on the entity responsible for you and the providers involved, data may be stored in the European Union, the United States, or Canada. Some of these providers are based in the United States and may process data there. Where personal data is transferred outside the European Economic Area, it is protected by the European Commission's Standard Contractual Clauses together with the providers' supplementary measures.

6. How long we keep it

We keep your personal data only for as long as it is needed for the purpose it was collected, and afterwards for the legal limitation periods during which liabilities could arise — in particular up to 6 years for accounting and invoicing records (Commercial Code), 5 years for personal actions (Civil Code), and 4 years for tax matters (General Tax Act). During those periods the data is kept blocked, available only to attend to the authorities or to defend against claims, and is then securely deleted. Analytics data is kept for the period configured in Google Analytics. You can ask us to erase your data at any time — see your rights below. When data is erased, the related backup copies are removed in the following backup cycles, generally within 15 days.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and to data portability. To exercise these rights, write to privacy@speedyrails.com. If you are in the EEA, you may also lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority.

To protect your data, we may ask you to verify your identity before acting on a request.

Universal opt-out signals: where applicable law requires it, we honour universal opt-out mechanisms such as Global Privacy Control (GPC) sent by your browser. Note that on this site nothing non-essential loads without your prior consent, so the default state is already opted out.

8. What happens if you don't provide your data

The fields marked as required in our contact form are the minimum we need to handle your enquiry. If you don't provide them, or provide them incompletely, we may not be able to respond to you.

9. Security

We apply technical and organisational measures appropriate to the risk — including encryption in transit and at rest, access control with multi-factor authentication, backups, and network protection — and our subcontractors are bound to equivalent obligations. As an organisation, Speedyrails holds an ENS certification of conformity (Categoría Media, RD 311/2022) covering its information security management.

10. Children's privacy

This website is aimed at businesses. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

11. Changes

We may update this policy. The version published on this page, with its "last updated" date, is always the current one.

12. Contact

For any question about this policy or our privacy practices: privacy@speedyrails.com.