Privacy Policy

Last updated: 6/10/2026

This policy explains how personal data is processed in connection with https://spectral-discovery.com/ and enquiries about the Spectral Discovery research project. It applies to website visitors and people who contact the project team.

1. Who is responsible for your personal data?

Data controller: Spectral Discovery
Contact address: C/ Nicolás Cabrera 1, First Floor, Lab 122, 28049 Madrid, Spain
Privacy contact email:

In this policy, “we”, “us” and “our” refer to the data controller identified above, acting in connection with the Spectral Discovery project.

2. What data do we process, and why?

Enquiries and correspondence. When you contact us, we process the contact details you provide, such as your name and email address, together with the content of your message and subsequent correspondence. We use this information to respond to you and manage the enquiry. The legal basis is our legitimate interest in responding to communications and maintaining contact about the project (Article 6(1)(f) GDPR). Please provide only information relevant to your enquiry and avoid sending sensitive personal information or confidential research data through general contact channels.

Information needed to reply will be identified in any contact form. If you do not provide sufficient contact information or details about your enquiry, we may be unable to respond. Other information is voluntary.

Technical and security data. We use these data to operate the website, detect incidents and protect it against misuse. The legal basis is our legitimate interest in maintaining a secure and functioning website (Article 6(1)(f) GDPR).

Cookies, analytics and embedded services. See COOKIES POLICY for information about cookies and similar technologies and how to manage any available preferences.

3. How long do we keep your data?

Enquiries and correspondence: .

Technical and security logs: Records related to an incident may be retained as necessary to investigate it or establish, exercise or defend legal claims.

Where a legal obligation or claim requires longer retention, only the relevant information will be retained, with access restricted as appropriate, for the applicable period. Cookie and other tracking retention periods are described in [LINK TO THE COMPLETED COOKIES POLICY].

4. Who receives your data?

Access is limited to authorised people who need the data for the purposes described above. Service providers may process data on our behalf to provide website hosting, email, technical maintenance or other verified services, subject to applicable data protection obligations.

Relevant providers or categories of recipients:

We may also disclose information to competent authorities where required by law, or where necessary and lawful to establish, exercise or defend legal claims.

5. International transfers

State whether data are transferred outside the EEA. For each relevant transfer, identify the destination and the applicable adequacy decision or safeguards, such as European Commission Standard Contractual Clauses, and explain how to obtain a copy of those safeguards. If there are no transfers, replace this field with an accurate statement to that effect.

6. Your rights

Subject to the conditions established by law, you may request access to your personal data, correction of inaccurate data, erasure or restriction of processing. You may object to processing based on legitimate interests and request data portability where applicable. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

To exercise your rights, contact or write to the address in section 1. Specify your request and provide enough information to identify the relevant data. We may request additional information if reasonably needed to verify your identity. We will respond within the statutory time limits, normally one month; any lawful extension will be explained to you.

You may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), at https://www.aepd.es/, or with another competent supervisory authority. You do not have to contact us first.

7. Automated decision-making

If none occur, use: “We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.” If such processing occurs, explain it and provide the information and safeguards required by the GDPR.

8. Changes to this policy

We may update this policy to reflect changes to the website or the way data are processed. The date above indicates the latest revision. Where required, we will provide additional information about material changes before the new processing takes place.