Notice under the Digital Personal Data Protection Act, 2023

This notice is given by SOLUCIONEC, the operator of stinotice.com and of the STI notice app, to individuals in India whose personal data we process, in accordance with the Digital Personal Data Protection Act, 2023. It supplements our Privacy Policy and prevails over it for the matters described here. In this notice, "you" means the Data Principal and "we" means the Data Fiduciary.

1. THE PERSONAL DATA WE PROCESS, ITEMISED
We ask for your consent to process each of the following items, and only these:
- Your email address. To create and operate your account and to answer you if you write to us.
- The infection you select. To draft the text of the notification, to allow the person you notify to view it for 30 days through the link they receive, and to avoid sending them a duplicate alert in that period. This is data about your health.
- The phone number or email address of the person you wish to notify. To deliver the notification to them.
- Your payment reference. To process the purchase of notification packs and to keep the accounting records required by Spanish law. We never see your full card number.
- Technical data (IP address, device identifiers, browser, operating system, date and time). To keep the service secure and to prevent fraud and abuse.
If you have received a notification from us, we process only the phone number or email address it was sent to, the infection stated in it, and the delivery result. We do not know your name.

2. THE PURPOSE, STATED PLAINLY
The service exists so that a person can tell a sexual partner, anonymously, that they may have been exposed to a sexually transmitted infection, and so that the partner can decide whether to get tested. Every item in section 1 exists to make that single message happen. We do not use any of it to build commercial profiles, to target advertising, or to train automated systems, and we do not sell it.

3. HOW YOU GIVE CONSENT, AND HOW YOU WITHDRAW IT
Before each notification is sent we ask you to tick a separate box confirming that you are over 18, that you had sexual contact with the person you are about to notify, and that you consent to us processing the infection you select for the sole purpose of sending that notification. Nothing is pre-ticked and the service does not proceed without it.
You may withdraw your consent at any time, and it is as easy to withdraw it as it was to give it: write to info@stinotice.com and we will stop the processing and delete the data. Withdrawal does not make unlawful what we did before you withdrew, and it does not recall a notification already delivered. If you withdraw, we will also instruct our processors to stop and to delete.

4. YOUR RIGHTS
- To access: a summary of the personal data we process about you, what we do with it, and the identities of the other Data Fiduciaries and Data Processors with whom we have shared it.
- To correct, complete, update and erase: we will erase your personal data on request unless we are required by law to keep it.
- To nominate: you may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
- To grievance redressal: see section 5.
You also have duties under the Act: not to impersonate anyone else, not to suppress material information, and not to file a false or frivolous complaint.

5. GRIEVANCE REDRESSAL
If you are unhappy with how we handle your personal data, write to info@stinotice.com with the word GRIEVANCE in the subject line. The person responsible for answering questions about this processing is David Rodríguez Sánchez, reachable at that address.
We acknowledge every grievance within 7 days and answer it within 30 days. If you are not satisfied with our answer, or if we do not answer, you may complain to the Data Protection Board of India.

6. SHARING
We share the notification and the contact details of the person notified with our SMS delivery provider (Bird, Netherlands) and store them with our hosting provider (IONOS CLOUD, S.L.U., Spain). Payments are handled by Stripe Payments Europe Ltd. (Ireland) and Google Commerce Limited (Irland). We share nothing with advertisers. The full list is in section 9 of our Privacy Policy.

7. WHERE YOUR DATA IS PROCESSED
We are established in Spain and your personal data is stored and processed in the European Economic Area, under the European Union General Data Protection Regulation, which applies to it in addition to the Digital Personal Data Protection Act, 2023.

8. HOW LONG WE KEEP IT
The infection selected and the contact details of the person notified are erased 30 days after the notification is sent, after which the viewing link stops working. Account records are kept while the account is active and erased on request. Accounting records are kept for the periods required by Spanish law.

9. CHILDREN
The service is for people aged 18 and over. We do not knowingly process the personal data of a child or of a person with a disability who has a lawful guardian, we do not track them, and we do not direct advertising at them. If we learn that an account belongs to someone under 18 we block it and erase the data.

10. BREACHES
If your personal data is affected by a breach we will inform you and the Data Protection Board of India in the manner and within the time the Act and its rules require.

11. LANGUAGE
This notice is published in English. If you would prefer to receive it in any language listed in the Eighth Schedule to the Constitution of India, write to info@stinotice.com naming the language and we will provide it to you.

12. CONTACT
SOLUCIONEC
Data Fiduciary, represented by David Rodríguez Sánchez
Spanish tax ID (NIF): 45774319H
Avenida Touroperador Air Marin, 2. 35100 San Bartolomé de Tirajana (Las Palmas – Spain)
info@stinotice.com

Last updated: 29/08/2026