Regulatory Framework
Comprehensive legal architecture governing all operations of CinderHarborLabs. This document is structured in accordance with European Union General Data Protection Regulation (GDPR) requirements and applicable Spanish data protection legislation.
Last updated: July 2026 · Effective immediately upon publication
Privacy Protocol
1.1 Data Controller Identification
The data controller responsible for the processing of personal data under this Privacy Protocol is CinderHarborLabs, registered and operating from 35018, C. Marcos Martin Artiles P0E 4 A P04 3D Tamaraceite, Las Palmas de Gran Canaria Las Palmas, Spain. All data protection inquiries, subject access requests, and regulatory correspondence should be directed to [email protected].
1.2 Categories of Personal Data Processed
CinderHarborLabs collects and processes the following categories of personal data in the course of delivering digital engineering services:
- →Identity Data: Full name, professional title, and organizational affiliation provided through contact forms or direct correspondence.
- →Contact Data: Email address, telephone number, and physical mailing address provided for service delivery and communication purposes.
- →Technical Data: Internet Protocol (IP) address, browser type and version, operating system, device identifiers, and page interaction metrics collected automatically through standard web server logging and analytics instrumentation.
- →Project Data: Business requirements, brand assets, strategic documents, and technical specifications provided by clients during the execution of service engagements.
- →Cookie Data: Session identifiers, preference tokens, and consent records stored through browser cookies as described in our Cookie Framework below.
1.3 Legal Basis for Processing
All personal data processing activities conducted by CinderHarborLabs are grounded in one or more of the following legal bases as defined under Article 6 of the GDPR:
- →Consent (Art. 6(1)(a)): Where you have provided explicit, informed, and freely given consent for specific processing purposes — such as subscribing to communications or accepting non-essential cookies.
- →Contractual Necessity (Art. 6(1)(b)): Where processing is necessary for the performance of a contract to which you are a party, or for taking pre-contractual steps at your request — including service scoping, delivery, and project management.
- →Legitimate Interest (Art. 6(1)(f)): Where processing is necessary for the purposes of legitimate interests pursued by CinderHarborLabs, including website security, fraud prevention, service improvement analytics, and direct marketing to existing clients — provided such interests are not overridden by your fundamental rights and freedoms.
- →Legal Obligation (Art. 6(1)(c)): Where processing is necessary for compliance with a legal obligation to which CinderHarborLabs is subject under Spanish or European Union law — including tax record retention and regulatory reporting requirements.
1.4 Data Retention Periods
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected. Specific retention periods are as follows:
- →Contact Inquiry Data: Retained for a maximum of 24 months from the date of last correspondence, unless a contractual relationship is established.
- →Client Project Data: Retained for the duration of the active contractual relationship plus 60 months, in accordance with applicable Spanish commercial record-keeping requirements.
- →Financial Transaction Records: Retained for a minimum of 5 years from the date of the transaction, as required under Spanish tax law (Ley General Tributaria).
- →Technical Server Logs: Automatically purged after 90 days. Aggregated, anonymized analytics data may be retained indefinitely for statistical analysis purposes.
1.5 Your Data Subject Rights
Under the GDPR and applicable Spanish data protection law (Ley Orgánica 3/2018), you exercise the following rights regarding your personal data:
- →Right of Access (Art. 15): You may request a copy of all personal data we hold about you, along with information about how it is processed.
- →Right to Rectification (Art. 16): You may request correction of inaccurate personal data or completion of incomplete data.
- →Right to Erasure (Art. 17): You may request deletion of your personal data where there is no compelling legal or contractual reason for continued processing.
- →Right to Restriction (Art. 18): You may request restriction of processing in specific circumstances, including during the verification of accuracy or where processing is unlawful.
- →Right to Data Portability (Art. 20): You may request your personal data in a structured, commonly used, and machine-readable format for transfer to another controller.
- →Right to Object (Art. 21): You may object to processing based on legitimate interests, including direct marketing. Upon receipt of a valid objection, we will cease processing unless we demonstrate compelling legitimate grounds.
To exercise any of these rights, submit a written request to [email protected]. We will respond to all legitimate requests within 30 calendar days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.
1.6 International Data Transfers
CinderHarborLabs primarily processes personal data within the European Economic Area (EEA). Where data is transferred to countries outside the EEA — for example, through the use of cloud infrastructure providers — we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or verification that the recipient country has been deemed to provide an adequate level of data protection under Article 45 of the GDPR.
1.7 Data Security Measures
CinderHarborLabs implements robust technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include: encryption of data in transit (TLS 1.3) and at rest; access controls with principle of least privilege enforcement; regular security assessments and penetration testing; secure backup and disaster recovery procedures; and mandatory data protection training for all personnel with access to personal data.
Refund Architecture
3.1 General Refund Principles
CinderHarborLabs operates a milestone-based delivery model. All service engagements are structured around clearly defined phases, each with specified deliverables and acceptance criteria. Refund eligibility is assessed relative to the completed and accepted milestones at the time of the refund request.
3.2 Pre-Engagement Cancellation
If a client cancels a service engagement before any work has commenced — defined as the period between contract signature and the commencement of Phase 1 (Deep Discovery & Structural Mapping) — a full refund of all advance payments will be issued within 14 business days. Cancellation requests must be submitted in writing to [email protected].
3.3 In-Progress Cancellation
Where a client requests cancellation of an engagement that is already in progress, the following refund structure applies:
- →For services with total value up to 5,000€: No refund is available for phases that have been completed and accepted. A pro-rata refund may be issued for the current phase if less than 50% of the phase work has been executed.
- →For services with total value exceeding 5,000€: A detailed invoice reconciliation will be performed. Refunds are calculated based on the proportion of work completed versus total project scope, with a 15% administrative deduction applied to cover project management overhead and resource allocation costs.
3.4 Quality Disputes
If a client raises a legitimate quality concern regarding delivered work, CinderHarborLabs commits to a structured resolution process: (1) the concern is formally documented and reviewed within 5 business days; (2) a remediation plan is proposed within 10 business days; (3) remediation work is executed within the agreed timeline. If the quality concern cannot be resolved to the client's reasonable satisfaction after two remediation cycles, a partial refund proportional to the disputed deliverable will be processed.
3.5 Refund Processing
All approved refunds are processed via the original payment method within 20 business days of refund approval. Refund confirmations are sent to the client's registered email address. CinderHarborLabs reserves the right to offset refund amounts against any outstanding invoices owed by the client.
3.6 Non-Refundable Items
The following are non-refundable: (a) third-party software licenses or subscription fees procured on behalf of the client; (b) domain registration or hosting fees already paid to external providers; (c) completed and accepted deliverables that have been deployed to production environments; (d) consulting hours consumed during scoping, discovery, or advisory sessions.
Service Terms
4.1 Scope of Agreement
These Terms of Service govern all engagements between CinderHarborLabs and its clients for the provision of digital engineering, design, and consulting services. By commissioning any service, the client agrees to be bound by these terms in their entirety. Any modification to these terms requires written agreement signed by both parties.
4.2 Service Delivery & Acceptance
All services are delivered according to the project specifications defined in the signed Statement of Work (SOW). CinderHarborLabs commits to delivering milestones within the agreed timelines, subject to timely client cooperation and feedback. Client acceptance of deliverables is assumed if no written objection is received within 10 business days of delivery. Rejected deliverables trigger the remediation process outlined in Section 3.4.
4.3 Payment Terms
Unless otherwise specified in the SOW, the following payment schedule applies:
- →Entry Tier Services (up to 1,500€): Full payment due upon contract signature. No work commences until payment is received.
- →Core Tier Services (2,500€–6,000€): 50% advance upon contract signature; 50% upon delivery of final phase deliverables. Invoices are due within 14 calendar days.
- →Premium Tier Services (8,500€+): 40% advance upon contract signature; 30% at midpoint milestone; 30% upon final delivery. Invoices are due within 14 calendar days of issue.
Late payments incur a statutory interest charge of 8 percentage points above the ECB base rate, in accordance with Directive 2011/7/EU on late payment in commercial transactions, as transposed into Spanish law.
4.4 Intellectual Property
Upon full payment of all invoiced amounts, all intellectual property rights in the deliverables produced specifically for the client under the engagement are transferred to the client. CinderHarborLabs retains ownership of all pre-existing tools, frameworks, methodologies, design system components, and know-how used in the creation of deliverables. CinderHarborLabs retains the right to display anonymized case studies and portfolio entries related to completed work, unless the client explicitly opts out in writing.
4.5 Confidentiality
Both parties agree to maintain strict confidentiality regarding all proprietary information shared during the course of the engagement. This obligation survives the termination of the contractual relationship for a period of 36 months. Confidential information includes, but is not limited to: business strategies, financial data, technical architectures, unreleased products, customer data, and trade secrets.
4.6 Limitation of Liability
CinderHarborLabs' total aggregate liability under any engagement shall not exceed the total fees paid by the client for the specific service giving rise to the claim. CinderHarborLabs shall not be liable for indirect, consequential, incidental, or punitive damages, including but not limited to loss of revenue, loss of data, or business interruption. This limitation does not apply to liability arising from wilful misconduct or gross negligence.
4.7 Force Majeure
Neither party shall be liable for failure to perform its obligations where such failure results from circumstances beyond the reasonable control of the affected party, including but not limited to: natural disasters, pandemic, war, terrorism, government sanctions, internet infrastructure failures, or third-party service outages. The affected party must notify the other party within 48 hours of becoming aware of the force majeure event.
4.8 Governing Law & Dispute Resolution
These Terms of Service are governed by the laws of the Kingdom of Spain and the applicable regulations of the European Union. Any dispute arising from or related to these terms or any engagement shall first be subject to good-faith mediation. If mediation fails within 30 days, the dispute shall be submitted to the exclusive jurisdiction of the courts of Las Palmas de Gran Canaria, Spain.
4.9 Termination
Either party may terminate an engagement with 30 days' written notice. In the event of termination, the client is obligated to pay for all work completed and accepted up to the termination date. CinderHarborLabs will deliver all completed work product to the client within 10 business days of termination. Termination for cause — including material breach, non-payment for 30+ days, or insolvency — may be effected immediately upon written notice.