Last updated: 16 July 2026

At RemoteWorking we take privacy seriously. This policy explains what personal data we process, for what purpose, and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

2. What data we process

We process only the data strictly necessary to provide the service:

2.1 When you register or purchase

• Full name: to identify you in communications and in the client area.
• Email address: to send you confirmations, subscription communications and access credentials.
• Company and tax details: legal name, tax ID and address, needed for invoicing.
• Password (hashed): stored using a hash function (bcrypt), never in plain text.

2.2 During payment

Payment is processed entirely through Stripe. RemoteWorking does not store credit or debit card data; we only receive payment confirmation and the amount from Stripe.

2.3 Device and session data

• Registered device identifier, computer name (Windows hostname) and connection status.
• Remote session logs (date, duration, user and computer) for security and traceability for the client company.

Important: the remote screen content is not recorded or stored. The relay server merely forwards session traffic between the Controller and the Agent.

2.4 Technical data (logs)

For system security, we log the IP address, date/time and result of calls to the API and the relay server. This data is retained for a limited period and used solely to detect and prevent fraudulent use.

2.5 The desktop applications

The Agent and Controller only communicate to our servers the data needed to authenticate and establish the connection (device identity, session token and status). The remote session traffic flows between the Controller and the Agent through the relay, which does not inspect it.

3. Purpose of processing

• Service delivery: onboarding the company and its users, activating licences, managing devices and sessions.
• Purchase management: processing the subscription, issuing invoices and handling renewals.
• Customer service and technical support: responding to your enquiries or issues.
• Legal obligations: retention of invoices and accounting records under Spanish law.
• Security: detection and prevention of fraudulent use.

We do not send marketing communications without your explicit consent.

4. Legal basis

• Contract performance (Art. 6(1)(b) GDPR): to provide the contracted service and manage your subscription.
• Legal obligation (Art. 6(1)(c) GDPR): retention of invoices and tax records.
• Legitimate interests (Art. 6(1)(f) GDPR): system security and fraud prevention.
• Consent (Art. 6(1)(a) GDPR): where applicable, for marketing communications.

5. Retention periods

• Account data: while the account is active; after closure, anonymised or deleted within a reasonable period.
• Billing data: for the periods required by law (Commercial Code and tax regulations).
• Technical logs: for a limited period, for security purposes.

6. Recipients and transfers

We share data with the following third parties, only to the extent necessary:

• Stripe, Inc. — payment processor. See its privacy policy.
• Hosting provider — servers hosting the web application and the relay, located in the European Union.

We do not sell, rent or pass your data to third parties for commercial or advertising purposes.

7. Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection by emailing privacy@remoteworking.tech, describing your request and proving your identity. We will respond within the legally established period.

If you believe the processing does not comply with the regulations, you may lodge a complaint with the competent supervisory authority. In Spain: Spanish Data Protection Agency (AEPD) — www.aepd.es.

8. Security

• All connections encrypted with TLS/HTTPS.
• Passwords stored with bcrypt (never in plain text).
• Authentication via signed tokens (JWT) with a strong secret.
• Rate limiting against brute-force attacks.
• Database access restricted to the application.

9. Contact

For any data protection matter:

← Back to home