SHŌKEN / PRIVACY
Privacy policy.
How information is handled across the public website, platform accounts and customer-supplied records.
On this page
Who is responsible
Shōken is the public brand of SHOKENKA TECHNOLOGIES, SOCIEDAD LIMITADA, based in Barcelona, Spain. The company identification and privacy contact appear below.
SHOKENKA determines the purposes of its own website, business correspondence and account administration. Customer organisations determine the purposes of processing the portfolio records they provide and the participants authorised to see them. Where SHOKENKA processes those records on a customer’s behalf, its role and instructions follow the applicable service and data-processing arrangements.
If your request concerns a record supplied by a customer, you can contact us or that customer. We will identify the responsible organisation and help route the request. Access to a facility does not make every participant responsible for every record.
- Legal entity
- SHOKENKA TECHNOLOGIES, SOCIEDAD LIMITADA
- Address
- Carrer Novell 65, Bajo 2
08014 Barcelona, Spain - Privacy contact
- jm.novo@shoken.es
Information within this notice
Website visitors: language and audience preferences, and technical request information needed to deliver and protect the site. The current marketing application has no lead-submission form or analytics integration. Guided demonstrations use fictional records; an editable demonstration note is held in memory and is not submitted to the platform.
Platform users: email address, display name, organisation and access roles, authentication and MFA information, session/security metadata and records of actions taken in the service.
Customer-supplied records: borrower names and identifiers, loan and receivable records, contractual and servicing information, dated observations, corrections, source evidence, supporting documents, calculations and review history. Bank-related records and references may be included where supplied through customer files or configured sources.
Data about a natural person can be personal data even when it appears in a business portfolio. The fields used depend on the customer’s sources, facility configuration and permissions. Customer organisations provide these records; the simulated website examples are not customer records.
Purposes and legal grounds
Each activity needs its own lawful basis. The bases below describe the company’s own activities. A customer determines the lawful basis for the portfolio records it provides. Using the platform does not constitute consent to unrelated processing.
| Activity | Purpose | Legal basis or responsibility |
|---|---|---|
| Website preferences | Remember the language and audience context selected by the visitor. | Legitimate interests in providing the requested experience. |
| Accounts and access | Administer authorised users and provide secure access to the service. | Legitimate interests in operating the contracted service for customer organisations; contract where the individual is a party. |
| Enquiries and correspondence | Respond to requests and manage a business relationship. | Legitimate interests in responding to business enquiries; requested pre-contractual steps where applicable. |
| Security and monitoring | Protect access, investigate errors and maintain service availability. | Legitimate interests in service security and reliability. |
| Data-rights requests | Handle a request and keep evidence of its handling. | Applicable legal obligations. |
| Customer portfolio processing | Organise source records, apply facility rules, calculate results and support review/reporting. | The customer establishes its grounds. SHOKENKA processes on documented instructions within the agreed scope. |
How long information is kept
Periods and criteria vary by purpose and record. Backup and log windows are technical settings, not a general period for personal data in the live service.
There is no general automatic deletion schedule for files in Azure Blob. Customer-file return or deletion depends on the relevant instructions, agreements and legal holds. A deletion request is assessed against those conditions; this notice makes no fixed automatic-deletion promise.
| Information or system | Period or retention criterion |
|---|---|
| Database backups | The current Azure PostgreSQL backup window is 7 days. This does not define how long records remain in the live database. |
| Container logs | Container environment logs are configured for 30 days. |
| Application telemetry | Application Insights request, trace, dependency and exception tables are configured for 90 days. |
| Language and audience preferences | Language selection has no application-set expiry in local storage; it remains until cleared. Audience selection uses session storage. |
| Business enquiries | While needed to answer the enquiry and manage an active business relationship, then only while a legal obligation or potential claim justifies keeping the correspondence. A fixed post-contact period has not yet been adopted. |
| Customer records and evidence | The service relationship and the customer’s documented instructions determine the period. Return, deletion and any necessary legal hold at its end must be set out in the customer arrangement. |
| Privacy correspondence | While needed to handle a request and retain evidence required to demonstrate how it was resolved. A separate fixed review period has not yet been adopted. |
Providers, recipients and international processing
Service providers support the platform within their contracted roles. Customer records can also be available to participants authorised under the customer’s facility and access arrangements; access depends on the configured permissions.
The core Azure backend, PostgreSQL database, Blob file storage and monitoring resources are in Spain Central. The website and platform frontend use Azure Static Web Apps resources registered in West Europe. Static Web Apps distributes public static assets globally, so the resource region is not an assurance that all website delivery takes place only in that region.
Resend sends transactional email. Resend states that email content, delivery logs and related service data are stored and processed in the United States, including when a European sending region is selected. Its data-processing addendum incorporates Standard Contractual Clauses for relevant transfers. Its sending region does not determine where its stored data resides.
Company-domain correspondence uses Microsoft 365 and its applicable service and data-protection terms. Azure resource locations do not establish where mailbox data is stored.
Cookies and browser storage
The public website stores shoken.locale in local storage when a language is explicitly selected and shoken-audience in session storage for audience context. These preferences remain on the visitor’s browser. Blocking storage does not prevent the basic navigation from working.
The platform uses an HttpOnly refresh-session cookie, with a configured absolute session lifetime of 14 days, and a trusted-browser cookie for the relevant MFA option. It also stores sidebar state, appearance preferences, selected context and recovery state for particular workflows. Their scope differs from the public website preferences.
The sidebar preference cookie has a 7-day lifetime. Refresh credentials are not stored in local storage; access credentials are held in memory.
The current marketing application has no analytics integration, advertising pixel or embedded booking tool. If a booking destination is enabled later, this notice will be updated to describe any resulting data flow.
Access, calculations and review
The platform uses authenticated sessions and tenant- and role-based permissions. The information and actions available to each participant depend on the configured organisation, facility and role. Source records and review activity provide context for the result being assessed.
Facility rules and calculations produce operational results that can be reviewed with their inputs and evidence. Customers decide how to use those results. Questions about a decision concerning an individual, including any legally significant automated decision, should be raised with the relevant customer or through our contact below.
This notice describes data handling. It is not a claim of a regulatory licence, external audit, legal-title verification, custody or payment execution.
Your rights and how to contact us
Depending on the applicable conditions, you can request access, rectification, erasure, restriction, objection and portability. Where processing relies on consent, you can withdraw it. You may also raise concerns about an applicable solely automated decision.
Send requests to jm.novo@shoken.es or write to the company address. We may need proportionate information to identify the relevant records and verify that the request concerns you. SHOKENKA will handle requests concerning its own processing and assist the relevant customer where it processes records on that customer’s instructions.
Requests are handled without undue delay and normally within one month, subject to the applicable extension rules. You may complain to the Spanish Data Protection Agency (AEPD), or to another competent supervisory authority under the applicable rules.
Contact us about your data.
Explain your request and whether it concerns the website, your platform account or a record supplied by an organisation. Please avoid sending passwords or unnecessary financial documents.
jm.novo@shoken.esStatus and changes
This is a proposed version, without an effective date. It becomes the operative notice only when approved and published with that date. The technical retention settings described above do not establish a general deletion schedule for customer records.
The operative notice will carry its approved effective date. Material changes to purposes, providers, storage or customer arrangements will be reflected here and, where required, communicated to the people affected.