Privacy Policy

Last updated: July 20, 2026

Last updated: 15 June 2026

This Data Privacy Policy ("Policy") explains how Hisperion Aerospace S.L. ("Hisperion Aerospace S.L.", "we", "us" or "our") collects, uses, stores, and protects personal data in connection with the trial version of Orbita, a space simulation software product (the "Software" or "Trial").

This Policy should be read together with the Orbita Trial Terms and Conditions, of which it forms part. Hisperion Aerospace S.L. is committed to protecting your personal data and processing it in accordance with Regulation (EU) 2016/679 (the "GDPR") and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

1. Data Controller

The data controller responsible for your personal data is:

Hisperion Aerospace S.L. C/ Ramón y Cajal 19, 41920, San Juan de Aznalfarache, Seville, Spain VAT / CIF: B21839485 Commercial Registry: Registro Mercantil de Sevilla, Tomo y Folio electrónicos, Hoja SE-148705, IRUS 1000447692281 Email: info@hisperion.com

2. Personal Data We Collect

Hisperion Aerospace S.L. collects a limited amount of personal data at two points: (a) data you voluntarily provide when you request a licence key or download of the Trial; and (b) data transmitted automatically when the Software validates your licence and checks the Trial Period:

Data category	Examples	When collected
Name	Your first and last name	When you request a licence/download
Email address	The email address you provide to receive the licence or download	When you request a licence/download
Company / organisation	The name of the organisation you represent (if any)	When you request a licence/download
Hashed device fingerprint	A device fingerprint derived from your device's characteristics, converted into an irreversible, one-way SHA-256 hash on your own device before it is transmitted, used to bind the Trial to your device and prevent the same licence key being reused on other devices. The hash cannot be reverse-engineered to recover your device's characteristics, but because it is a persistent unique identifier that can be linked to you via your licence key it remains pseudonymous personal data	Automatically, when the Software contacts the licensing server
Licence-use metadata	The date and time of each licence-check request associated with your hashed device fingerprint (a "licence-use timeline"), used to detect and prevent unauthorised, expired, or concurrent use of a licence key	Automatically, on each licence check
Licence key & connection data	Your licence key and the technical data needed to establish the connection, including your IP address	When you request/activate a licence and on each licence check

We do not collect any other categories of personal data. In particular, we do not collect special categories of personal data (such as data revealing health, ethnicity, political opinions, or biometric data), and we do not track or transmit your User Content (see Section 3).

3. Data We Do Not Collect — Local-Only User Content

The Software operates locally on your own device. All content you create or generate while using the Software — including save files, simulation scenarios, configurations, simulation results, and any other output ("User Content") — remains strictly on your device.

Hisperion Aerospace S.L. does not receive, access, transmit, collect, or store any User Content, and has no visibility into the content you create with the Software. The only data the Software transmits to us is the licence-validation data described in Section 2 (an irreversible hashed device fingerprint, the licence key, and connection data such as your IP address). We do not access your User Content or record what you do within the Software. For licence-enforcement purposes only, the date and time of each licence-check request is recorded against your hashed device fingerprint (a "licence-use timeline"), which we use solely to detect and prevent unauthorised, expired, or concurrent use of a licence key. You retain full ownership of and responsibility for your User Content, including its security and backup.

4. Purposes and Legal Bases for Processing

We process the limited personal data described in Section 2 for the following purposes:

Purpose	Legal basis (GDPR)
Issuing and delivering your Trial licence key or download in response to your request	Performance of a contract / pre-contractual steps taken at your request (Art. 6(1)(b))
Communicating with you about the Trial (delivering the licence/download, responding to support queries)	Performance of a contract (Art. 6(1)(b))
Validating your licence key, binding the Trial to your device via a hashed device fingerprint, verifying the Trial Period, and recording the date and time of licence checks (the "licence-use timeline") to detect unauthorised, expired, or concurrent use	Performance of a contract (Art. 6(1)(b)); and our legitimate interests (Art. 6(1)(f)) in preventing unauthorised use and licence-key reuse and in protecting our intellectual property
Maintaining basic records and ensuring the security and integrity of the licensing process	Legitimate interests (Art. 6(1)(f)) in the secure operation of our licensing
Complying with legal obligations where applicable	Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests, we have assessed that these interests are not overridden by your rights and freedoms. You have the right to object to processing based on legitimate interests (see Section 9).

We do not use your personal data for automated decision-making or profiling, and we do not sell your personal data.

5. How We Collect Personal Data

We collect your personal data directly from you, at the point you submit a request for a licence key or download (for example, via a request form or by contacting us by email). We do not obtain your personal data from third-party sources.

6. Data Sharing and Recipients

We do not share, sell, or rent your personal data to third parties for their own purposes.

We may share your personal data only with:

Service providers (processors) who help us operate the licensing or communication process (for example, email-delivery providers, cloud-hosting providers, and our licensing-server provider), strictly on our instructions and under a written data processing agreement; and
Public authorities or regulators, where we are required to do so by law.

7. International Data Transfers

Hisperion Aerospace S.L. is based in the European Union and processes most of your personal data within the European Economic Area (EEA).

Our licence-validation, activation, and key-management functions are operated on our behalf by Keygen LLC ("Keygen"), our licence-management provider, which acts as our data processor (Hisperion Aerospace S.L. remains the data controller) under a written data processing agreement incorporating the European Commission's Standard Contractual Clauses. Keygen LLC is a United States company (registered in Austin, Texas) that hosts and processes the relevant data on infrastructure located in the United States (Amazon Web Services), with encrypted backups elsewhere in the United States and a number of US-based sub-processors; members of its team may access the data from Canada.

The personal data processed by Keygen consists of your licence key, the irreversible hashed (SHA-256) device fingerprint, activation records, and the date and time of each licence check (the licence-use timeline), together with the connection metadata (such as your IP address) inherent in contacting its servers. We do not share your name, email, or organisation with Keygen.

Because this involves transfers of personal data outside the EEA, we ensure those transfers are protected under Chapter V of the GDPR as follows:

Transfers to the United States (where the data is hosted) — the principal transfer — are protected by the European Commission's Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914) entered into with Keygen, together with supplementary measures (including the irreversible hashing and data-minimisation measures described below); and
Any access from Canada by Keygen's team is additionally supported by the European Commission's adequacy decision for Canada (Commission Decision 2002/2/EC) for organisations subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

As an additional safeguard, the device fingerprint leaves your device only as an irreversible one-way hash that cannot be reverse-engineered to recover your device's characteristics, and no directly identifying data (name, email, organisation) is shared with the provider. You may request a copy of the relevant transfer safeguard using the contact details in Section 13.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this Policy. Specifically:

Personal data associated with a licence request (name, email, organisation) is retained for the duration of your Trial and for 12 months after the end of the Trial Period, to handle any follow-up queries and to maintain basic records of the licensing process.
Licence key and technical connection data (including IP address) used for licence validation is retained only for as long as needed to operate and secure the licensing process, and in any event no longer than 12 months from collection.
At the end of the applicable period, your personal data is securely deleted or irreversibly anonymised.
Where a longer retention period is required to comply with a legal obligation, or to establish, exercise, or defend legal claims, we will retain only the relevant data and only for that purpose and period.

9. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

Right of access — to obtain confirmation of, and a copy of, the personal data we hold about you.
Right to rectification — to have inaccurate or incomplete data corrected.
Right to erasure ("right to be forgotten") — to have your data deleted in certain circumstances.
Right to restriction of processing — to limit how we use your data in certain circumstances.
Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
Right to object — to object to processing based on our legitimate interests.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time (without affecting the lawfulness of prior processing).

To exercise any of these rights, please contact us using the details in Section 13. We will respond within the timeframes required by the GDPR (generally within one month). Exercising these rights is free of charge unless your request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or the place of an alleged infringement. Our lead supervisory authority is the Spanish Data Protection Agency:

Agencia Española de Protección de Datos (AEPD) C/ Jorge Juan 6, 28001 Madrid, Spain — www.aepd.es

We would, however, appreciate the opportunity to address your concerns before you approach the AEPD, so please consider contacting us first using the details in Section 13.

10. Cookies and Device Access

Website cookies. Our licence-request form is hosted on our website. This website uses only strictly necessary (technical) cookies required for the page and the form to function and to be kept secure. Under Article 22.2 of Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), strictly necessary cookies do not require your prior consent. We do not use analytics, advertising, or other non-essential cookies that would require a consent banner. If we introduce any non-essential cookies in the future, we will implement a cookie-consent mechanism and publish a separate Cookies Policy before doing so.

Device access by the Software (licence binding). Separately from our website, the Orbita Trial Software reads certain characteristics of your device in order to generate a device fingerprint, which is converted into an irreversible, one-way SHA-256 hash on your own device before anything is transmitted. This hash is used only to bind your Trial licence to your device, to prevent the same licence key from being reused on other devices, and to record licence-check times for the purpose of detecting unauthorised, expired, or concurrent use. Because this access to your terminal equipment is strictly necessary to provide the licensed Trial you have explicitly requested, it relies on the exemption in Article 22.2 LSSI-CE and does not require separate consent. The device fingerprint is not used for advertising, audience analytics, behavioural profiling, or any purpose other than licence enforcement.

11. Children

The Trial is offered exclusively to businesses and professionals and is not directed to children. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a minor has provided us with personal data, please contact us using the details in Section 13 and we will delete it.

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, loss, or destruction. These measures are proportionate to the limited nature of the data we hold (name, email address, company, licence key, hashed device fingerprint, IP address, and licence-use timeline).

No method of transmission or storage is completely secure; however, we take reasonable steps to safeguard the data we hold and to limit access to it to those who need it for the purposes described above.

13. Contact Us

If you have any questions about this Policy, or wish to exercise your data protection rights, please contact:

14. Changes to This Policy

We may update this Policy from time to time. Where changes are material, we will take reasonable steps to notify you. The "Last updated" date at the top of this Policy indicates when it was last revised. We encourage you to review this Policy periodically.