1. Data Controller Identification
This Privacy Policy explains how STACK OVERFOOD S.L. (operating under the brand name "Stack Overflight", hereinafter referred to as "Stack Overflight", "we", "us", or "our") collects, uses, and protects your personal data when you visit our website at flybip.com (the "Website").
We act as the Data Controller for the personal data processed through this Website. Our company details are:
- Brand Name: Stack Overflight
- Registered Legal Name: STACK OVERFOOD S.L.
- Registered Address: C/ Via Laietana 46, 5-3, 08003 Barcelona, Spain
- Tax Identification Number (NIF): B01833243
- Email: founders@flybip.com
- Telephone: +34 661 653 556
2. Scope and Applicability
This Privacy Policy applies exclusively to the processing of personal data carried out through this Website, including data submitted via the contact form and data collected automatically during your visit.
This Privacy Policy does not apply to personal data processed within the context of our software-as-a-service (SaaS) products or custom software solutions provided to clients. Such processing is governed by separate Data Processing Agreements (DPAs) executed between Stack Overflight and the respective client, in accordance with Article 28 of the GDPR.
By using this Website, you acknowledge that you have read and understood this Privacy Policy.
3. Personal Data We Collect
We collect personal data in the following ways:
Data You Provide Voluntarily: When you submit a contact form, we collect your name, email address, subject line, and message content. This information is necessary to respond to your inquiry.
Data Collected Automatically: When you visit our Website, our hosting provider (Vercel, Inc.) may automatically collect certain technical information, including your IP address, browser type and version, device type, operating system, referring URL, pages visited, and timestamps. This data is collected for security, performance monitoring, and legitimate operational purposes.
Data from Third-Party Embeds: Our Contact page includes an embedded Google Maps widget. When you load this page, your IP address and browser information may be transmitted to Google LLC. We use this embed to display our office location for your convenience.
4. Purposes of Processing
We process your personal data for the following purposes:
- Responding to inquiries: To answer questions submitted through our contact form and to communicate with you regarding potential business relationships.
- Website security and performance: To protect the Website against security threats, prevent fraud, monitor performance, and ensure operational stability.
- Legal compliance: To comply with applicable legal obligations, including those arising under Spanish commercial law and EU regulations.
- Displaying location information: To show our office location on an interactive map for your convenience.
5. Legal Bases for Processing
We process your personal data based on the following legal grounds under Article 6(1) of the GDPR:
Pre-contractual measures (Article 6(1)(b)): When you submit a contact form to inquire about our services, we process your data as a step prior to potentially entering into a contract with you or your organisation.
Legitimate interests (Article 6(1)(f)): We rely on our legitimate interest to process server logs and technical data for security purposes, to maintain Website performance, and to display third-party map embeds. We have conducted an assessment to ensure that our interests do not override your fundamental rights and freedoms.
Additionally, under Article 19 of Spanish Organic Law 3/2018 (LOPDGDD), the processing of contact data of individuals acting as representatives of legal persons (e.g., corporate email addresses, professional phone numbers) may be based on legitimate interest, provided such processing relates to the maintenance of a business relationship.
6. Data Retention Periods
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:
- Contact form submissions: Retained for 12 months from the date of last interaction, unless the inquiry leads to a contractual relationship (in which case retention is governed by the applicable contract and Spanish commercial law, typically 5 years).
- Server logs (hosting): Retained according to Vercel's standard retention policies, typically for a limited period necessary for security and performance monitoring.
- B2B client representative data: Retained for the duration of the commercial relationship plus 5 years thereafter, in accordance with Spanish commercial law retention requirements.
7. Data Sharing and Subprocessors
We do not sell your personal data to third parties.
We may share your personal data with the following categories of recipients:
- Hosting provider: Vercel, Inc. — processes server logs and hosts the Website.
- Map service provider: Google LLC (Google Maps) — receives data when you load the Contact page with the embedded map.
- Professional advisors: Lawyers, accountants, and auditors who may require access to data for legal, tax, or audit purposes, bound by professional confidentiality obligations.
- Regulatory authorities: Where required by law, we may disclose data to the Agencia Española de Protección de Datos (AEPD) or other competent authorities.
8. International Data Transfers
Some of our service providers are located outside the European Economic Area (EEA). Specifically, Google LLC is based in the United States.
For transfers to the United States, we rely on the EU-U.S. Data Privacy Framework (DPF), established by the European Commission's adequacy decision of 10 July 2023. Google LLC is a certified participant in the DPF.
Should the DPF be invalidated or should a transfer mechanism become unavailable, we will ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission under Decision 2021/914.
You may request further information about international transfers and the safeguards in place by contacting us at the details provided in Section 14.
9. Your Data Subject Rights
Under the GDPR and Spanish LOPDGDD, you have the following rights regarding your personal data:
- Right of access (Article 15 GDPR): You may request confirmation as to whether we process your personal data and, if so, obtain a copy of such data.
- Right to rectification (Article 16 GDPR): You may request correction of inaccurate personal data or completion of incomplete data.
- Right to erasure (Article 17 GDPR): You may request deletion of your personal data where there is no compelling reason for its continued processing.
- Right to restriction (Article 18 GDPR): You may request that we restrict processing of your data under certain circumstances.
- Right to data portability (Article 20 GDPR): Where processing is based on consent or contract and carried out by automated means, you may request to receive your data in a structured, commonly used format.
- Right to object (Article 21 GDPR): You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
- Right to lodge a complaint: You have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es if you believe your data protection rights have been violated.
10. How to Exercise Your Rights
To exercise any of the rights described above, please contact us at:
Email: founders@flybip.com
Postal Address: STACK OVERFOOD S.L. (Stack Overflight), C/ Via Laietana 46, 5-3, 08003 Barcelona, Spain
We will respond to your request within one month of receipt. If your request is complex or we receive a high volume of requests, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it.
We may request proof of identity to verify your request and ensure we do not disclose data to unauthorised persons.
11. Cookies and Tracking Technologies
Our Website currently does not deploy analytics, advertising, or marketing cookies. We use only essential cookies necessary for basic Website functionality (e.g., storing your cookie preference).
If we implement analytics or other tracking technologies in the future, we will update this Privacy Policy and implement an appropriate consent mechanism in accordance with Article 22.2 of Spain's LSSI-CE and applicable GDPR requirements.
For more detailed information about cookies on this Website, please refer to our Cookie Policy (if published separately) or contact us.
12. Security Measures
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Article 32 of the GDPR.
These measures include, but are not limited to, encrypted data transmission (HTTPS/TLS), secure hosting infrastructure, access controls, and regular security reviews.
While we strive to protect your data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to maintaining industry-standard protections.
13. Children's Data
This Website is not directed at children. We do not knowingly collect personal data from individuals under the age of 14 (the minimum age of consent under Article 7 of Spanish LOPDGDD).
If we become aware that we have collected personal data from a child without appropriate parental consent, we will take steps to delete that information promptly. If you believe we may have collected data from a child, please contact us immediately.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. Any changes will be effective immediately upon publication on this Website, with the "Last updated" date revised accordingly.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Material changes will be communicated through a prominent notice on the Website where appropriate.
15. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us at:
- Email: founders@flybip.com
- Telephone: +34 661 653 556
- Postal Address: STACK OVERFOOD S.L. (Stack Overflight), C/ Via Laietana 46, 5-3, 08003 Barcelona, Spain
16. Supervisory Authority
You have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) if you believe that our processing of your personal data violates applicable data protection law.
- Agencia Española de Protección de Datos (AEPD)
- Website: www.aepd.es
- Address: C/ Jorge Juan 6, 28001 Madrid, Spain