Privacy Policy — RegAffairs Hub

1. Data Controller

The data controller responsible for the processing of your personal data through this website is:

Urviproject
Plaça Bartomeu Rebés Duràn, 5, AD500 Andorra la Vella, Andorra
Email: hello@regaffairshub.com

If you have any questions about how we process your personal data, or if you wish to exercise your rights under applicable data protection legislation, please contact us using the details above.

2. What Data We Collect

We collect and process personal data only when necessary to provide our services. The specific data collected depends on how you interact with our website:

2.1 Contact Form

When you submit our contact form, we collect the following information:

Name — to identify you and address your inquiry personally.
Email address — to respond to your inquiry.
Company (optional) — to understand the context of your inquiry.
Subject — to categorize and route your inquiry appropriately.
Message — the content of your inquiry.
Interface language and browser user-agent — recorded automatically with the submission, to help us reply in the right language and to detect abuse of the form.

Contact form submissions are processed on our own hosting, without any third-party form service. When you submit the form, the data is sent to a script on our server, which does two things: it emails the submission to our own address so that we can reply, and it writes the same fields to a log file stored on the server. That log file is not accessible from the web; it can only be read by us through the hosting control panel or SFTP.

2.2 Classification Wizard (Browser-Based Tool)

Our MDR Classification Wizard is a client-side tool that runs entirely in your web browser. No personal data is collected, transmitted, or stored on our servers when you use this tool. All inputs and classification results are processed locally in your browser and are not sent to any external service. When you close or refresh the page, all data is discarded.

2.3 Submission Tracker

The Submission Tracker currently runs entirely in your web browser. The submissions, dates, notes and any other content you enter are saved in your browser’s local storage on your own device. Nothing is sent to our servers, and no account or registration is required. You remain in control of this data: clearing your browser storage deletes it, and the built-in JSON export is the only way it leaves your device — at your initiative.

Cloud synchronisation is not enabled. If we activate it in the future, it will require you to create an account, we will update this policy before doing so, and we will identify the provider and the storage location here. Until then, the following data is not collected by us:

User account information — including your name, email address, and encrypted password.
Submission records — regulatory submission data you enter into the tracker, including submission names, statuses, dates, and notes.
Uploaded documents — any files you upload in connection with your submissions.

None of the above leaves your browser under the current setup.

2.4 Newsletter Subscription

If you subscribe to our newsletter, we collect your email address. Subscription uses a confirmed opt-in process: after submitting the form you receive an email asking you to confirm, and you are only added to the list once you do.

The list is managed by Brevo (see Section 7). We use your address solely to send occasional emails about EU medical device and IVD regulation and about resources published on this website. Every email includes an unsubscribe link, and you can unsubscribe at any time without giving a reason.

2.5 Guide Downloads

When you request a downloadable guide, we collect your email address, and your name and company if you choose to give them. The name and company are optional; the email address is not, because the download link is sent to it rather than shown on screen.

We also record the date, time and IP address of the request, together with which consent boxes you ticked. This is kept as the record that consent was given, which Article 7(1) GDPR requires us to be able to demonstrate. It is not used to profile or to identify you for any other purpose.

Requesting a guide does not subscribe you to the newsletter. The two consents are separate boxes on the form, neither pre-ticked, and the guide is sent whether or not you tick the second one. If you do tick it, your address is added to the newsletter list described in Section 2.4.

The download link is tied to a random one-time token that expires after seven days. The token is stored on our server and is not linked to your email address in that file.

This form is handled entirely by our own server. No third-party marketing or lead-capture service is involved.

2.6 Classification Records

The classification wizard runs entirely in your browser. Your answers are held in your browser's local storage and are not sent to us, and no account or email address is needed to use the tool or to see your result.

There is one exception, and it only happens if you ask for it. After the result is shown, you may request a copy by email. If you do, we receive your email address, the device name if you give one, the answers you selected, the resulting class and the classification rules that applied. We use them to send you that record and to understand which kinds of device the tool is used for.

As with guide downloads, we record the date, time and IP address of the request together with which consent boxes you ticked, as the record that consent was given under Article 7(1) GDPR. Requesting the record does not subscribe you to the newsletter: that is a separate box, not pre-ticked, and the record is sent whether or not you tick it. If you do tick it, your address is added to the newsletter list described in Section 2.4.

This form is handled entirely by our own server. No third-party marketing or lead-capture service is involved.

2.7 Analytics

If — and only if — you accept analytics cookies, we use Google Analytics 4 to understand how the website is used: which pages are visited, how visitors arrive, how far they scroll, which tools they open and which language they select. This data is pseudonymous and is not used to identify you personally. IP addresses are truncated by Google before storage and we do not have access to full IP addresses through this tool.

If you reject analytics cookies, Google Analytics is never loaded and none of this data is collected. The website works identically either way.

2.8 Automatically Collected Data

When you visit our website, our web server may automatically collect certain technical information, including your IP address, browser type, operating system, referring URL, and pages visited. This data is used solely for ensuring the security and proper functioning of the website. This collection happens at server level and is independent of cookies and of your analytics choice.

3. Cookies and Similar Technologies

Essential cookies and local storage. These are strictly necessary for the website to work and are used without consent, as permitted by law:

Session cookies — to maintain your session state when using the Submission Tracker application.
Language preference — to remember your selected language across pages.
Cookie choice — to remember whether you accepted or rejected analytics cookies, so that you are not asked again on every page.

Analytics cookies. Google Analytics 4 sets cookies (_ga and _ga_<container-id>) to distinguish visitors and sessions. These are not loaded until you give your consent. When you first visit the site, a banner lets you accept or reject them; refusing is as easy as accepting, and the site is fully usable either way.

Changing your mind. You can withdraw or change your choice at any time using the button below. Withdrawing consent also deletes the Google Analytics cookies already stored in your browser.

We do not use advertising cookies, and we do not share analytics data with advertising networks.

4. Legal Basis for Processing

We process your personal data under the following legal bases as defined in Article 6(1) of the General Data Protection Regulation (GDPR):

Consent (Article 6(1)(a)) — When you voluntarily submit the contact form, you consent to us processing the data you provide for the purpose of responding to your inquiry. Newsletter subscription, guide downloads and analytics cookies are each based on your separate, specific consent: subscribing to the newsletter is not a condition for using the website or for downloading any resource, and accepting analytics is not a condition for either. Where you request a guide, your consent covers sending you that guide and nothing further unless you tick the separate newsletter box. You may withdraw any of these consents at any time — by contacting us, by using the unsubscribe link in any newsletter email, or through the cookie button in Section 3.
Contract performance (Article 6(1)(b)) — If we introduce accounts for the Submission Tracker, we will process the data necessary to provide the service you register for. No such processing takes place today, as the tool runs entirely in your browser.
Legitimate interest (Article 6(1)(f)) — We process certain technical data (such as IP addresses and server logs) for the purposes of ensuring the security of our website, preventing abuse, and maintaining the proper functioning of our services. Our legitimate interest in maintaining a secure platform does not override your fundamental rights and freedoms.

5. How We Use Your Data

We use the personal data we collect for the following purposes:

To respond to your inquiries submitted through the contact form.
To send you our newsletter, where you have subscribed and confirmed your subscription.
To send you a downloadable guide you have requested, and to keep the record that you consented to receiving it.
To measure how the website is used and improve its content, where you have accepted analytics cookies.
To provide and maintain the Submission Tracker service, including account management and data storage.
To ensure the security, integrity, and proper operation of our website and services.
To comply with applicable legal obligations.

We do not use your personal data for automated decision-making or profiling. We do not sell your personal data to third parties.

6. Data Retention

Contact form data: Submissions are kept in our email inbox and in the log file on our server for as long as necessary to deal with your inquiry and for a reasonable period thereafter for record-keeping. You can ask us to delete a submission at any time (see Section 9).
Submission Tracker data: Held only in your own browser, for as long as you keep it there. We hold no copy and therefore cannot delete it for you; clearing your browser’s site data removes it.
Newsletter data: Your email address is retained for as long as you remain subscribed. If you unsubscribe, it is removed from the active mailing list; a minimal suppression record may be kept to make sure you are not contacted again by mistake.
Guide download data: Your email address, the optional name and company, and the consent record are kept until you ask us to delete them, or until we stop offering the guide. The one-time download token is deleted automatically once it expires, seven days after it is issued.
Analytics data: Where you have consented, Google Analytics data is retained for no longer than 14 months, after which it is deleted automatically. Analytics cookies stored in your browser expire within 2 years, or immediately if you withdraw your consent.
Server logs: Technical server log data is retained for a maximum of 90 days and then automatically deleted.

7. Third-Party Services

We use the following third-party services to process personal data:

Hosting

This website, the contact form handler and the contact log file are hosted by Hostinger International Ltd., which acts as a data processor under GDPR and stores the data on servers located within the European Union.

Brevo

Brevo (Brevo SAS, formerly Sendinblue, based in Paris, France) hosts our newsletter list and sends our newsletter emails. When you submit the subscription form, your email address is transmitted to and stored by Brevo on our behalf. Brevo acts as a data processor under GDPR and stores this data on servers located within the European Union. You can review Brevo’s privacy policy at https://www.brevo.com/legal/privacypolicy/.

Google Analytics

Google Analytics 4 is provided to users in the European Economic Area by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It is only loaded if you accept analytics cookies. Google acts as a data processor for this measurement data. You can review Google’s privacy policy at https://policies.google.com/privacy.

We do not share your personal data with any other third parties unless required by law.

8. International Data Transfers

Contact form data stays within the European Economic Area (EEA): it is processed on our own hosting inside the EU and sent to our own email address. No third-party form service outside the EEA is involved.

We are established in Andorra, so accessing the data we hold involves a transfer outside the EEA. Andorra is recognised by the European Commission as providing an adequate level of data protection (Commission Decision 2010/625/EU, confirmed in the Commission’s 2024 review of existing adequacy decisions), which means such transfers require no additional safeguards.

Where you have accepted analytics cookies, Google may transfer measurement data to servers in the United States. Those transfers are covered by the EU–U.S. Data Privacy Framework, under which Google LLC is certified, and by Standard Contractual Clauses. If you reject analytics cookies, no such transfer takes place.

Newsletter data held by Brevo is stored within the European Union and is not transferred outside the EEA under normal operation.

Submission Tracker data never leaves your browser, so no transfer of any kind takes place.

9. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

Right of access (Article 15) — You have the right to request a copy of the personal data we hold about you and information about how it is processed.
Right to rectification (Article 16) — You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
Right to erasure (Article 17) — You have the right to request deletion of your personal data where there is no compelling reason for its continued processing (“right to be forgotten”).
Right to restriction of processing (Article 18) — You have the right to request that we restrict the processing of your personal data under certain circumstances.
Right to data portability (Article 20) — You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to object (Article 21) — You have the right to object to the processing of your personal data where we rely on legitimate interest as the legal basis, including any profiling based on those provisions.
Right to withdraw consent — Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint — You have the right to lodge a complaint with a supervisory authority. If you are in the EU/EEA, you may contact your local Data Protection Authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

To exercise any of these rights, please contact us at hello@regaffairshub.com. We will respond to your request within 30 days, as required by GDPR.

10. Children’s Privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete such data as soon as possible. If you believe that a child under 16 has provided us with personal data, please contact us at hello@regaffairshub.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable legislation. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this page periodically to stay informed about how we protect your data.

If we make significant changes that materially affect your rights or the way we process your personal data, we will provide a prominent notice on our website prior to the changes taking effect.

12. Contact for Privacy Matters

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us: