Privacy Policy
In compliance with the provisions of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), the controller responsible for the processing of personal data collected through the Platform is hereby identified as:
1. Identification of the Data Controller
Company name: MV Esquel SL
Tax Identification Number: B72674153
Registered office: Passeig de la Tramuntana 48, Castelldefels, Catalunya, 08860, Spain
Contact email address: mvesquelsl@gmail.com
Hereinafter, the “Platform”.
2. Platform Model and Scope
The Platform operates under a model of Software as a Service (SaaS) aimed at professionals and businesses (hereinafter, "Tenants"), who use the technology infrastructure provided to deliver their own services to their clients.
As part of its activities, the Platform may act in two distinct roles:
As Data Controller, with regard to the data required to manage user accounts, authentication, the contractual relationship, and operation of the service.
As Data Processor, with regard to the personal data that Tenants manage through the Platform in the course of their own professional or business activities.
This Privacy Policy governs the processing activities in which the Platform acts as Data Controller and explains the general framework applicable when it acts as Data Processor.
3. Processing Activities in Which the Platform Acts as Controller
3.1 User registration and authentication
To enable access to and use of the service, the Platform may process:
First and last name.
Email address.
Internal user identifiers.
Data required for authentication through external providers (for example, Google or Apple, when the user uses such systems).
Cookies or technical session identifiers.
The Platform does not store passwords in plain text and applies appropriate technical measures to protect login credentials.
3.2 Management of the contractual relationship
In order to manage the service subscription and contractual relationship with Tenants, the Platform may process:
Identification and contact details.
Information required for billing and administrative management.
Communications related to the provision of the service.
Payment data are managed by external providers specializing in payment services. The Platform does not directly store sensitive financial information.
3.3 Communications and support
The Platform may use contact details to:
Send communications necessary for the proper provision of the service.
Respond to support requests or inquiries.
Send informational or commercial communications where prior consent or a sufficient legal basis exists.
At any time, users may opt out of non-essential communications.
3.4 Security and technical operation
To ensure the security and proper operation of the service, the Platform may process the minimum technical data required to:
Detect and prevent unauthorized access.
Ensure the stability and security of the infrastructure.
Resolve technical incidents.
The Platform does not persistently store IP addresses as part of its ordinary processes. If abuse or fraud prevention mechanisms are implemented, they will be designed in accordance with the principle of data minimization and may use pseudonymization or hashing techniques where appropriate.
4. Processing Activities in Which the Platform Acts as Processor
Tenants using the Platform may manage the personal data of their own clients or end users in the course of their activities.
In these cases:
The Tenant acts as Data Controller with regard to such data.
The Platform acts as Data Processor, limiting its role to providing hosting, technical processing, and controlled access to the infrastructure.
The Platform does not determine the purposes or uses of the data managed by Tenants, nor does it use such data for its own purposes other than providing the contracted service.
Each Tenant is responsible for complying with its legal obligations regarding data protection, including informing its clients and obtaining the legal bases required for processing.
5. Legal Basis for Processing
The processing of personal data carried out by the Platform as Data Controller is based on the following legal grounds, in accordance with Article 6 of the GDPR:
Performance of a contract: where processing is necessary to provide the requested service or manage the contractual relationship with the Tenant or user.
Compliance with legal obligations: where processing is necessary to comply with tax, accounting, or other obligations required by applicable regulations.
Legitimate interest: to ensure the security of the Platform, prevent misuse, and maintain service stability, always respecting the rights and freedoms of data subjects.
Consent: where necessary to send non-essential commercial or informational communications, or where required by applicable regulations.
When the Platform acts as Data Processor, the legal basis for processing will be that determined by the Tenant in its capacity as Data Controller.
6. Data Retention
Personal data processed by the Platform will be retained:
For as long as the contractual relationship remains in effect or the user maintains an active account.
For the periods necessary to comply with legal obligations.
For the time strictly necessary to address any potential liabilities arising from the processing.
Once the contractual relationship has ended, data may be blocked and retained solely to comply with legal obligations, or securely deleted or anonymized.
The Platform may maintain technical backups as part of its ordinary security procedures. These backups are managed using appropriate technical and organizational measures and are used exclusively to ensure the integrity and recovery of the service.
7. Third-Party Providers and Services
For the proper provision of the service, the Platform may rely on external technology providers that act as data processors or subprocessors, as applicable.
These providers may include, among others:
Cloud infrastructure services.
Storage and backup services.
External authentication services.
Email service providers.
Payment processors.
Artificial intelligence services.
Mapping or geolocation services.
Other technology services necessary for the operation of the system.
In each case, the Platform selects providers that offer appropriate data protection safeguards and enters into the relevant agreements where required by applicable regulations.
The Platform does not sell or disclose personal data to third parties for its own commercial purposes.
8. International Data Transfers
Some technology providers used by the Platform may be located outside the European Economic Area (EEA) or process data from third countries. In such cases, the Platform will adopt the appropriate safeguards required by the GDPR, such as standard contractual clauses approved by the European Commission, adequacy decisions, or other safeguards recognized under applicable regulations.
9. Data Subject Rights
Data subjects may exercise the following rights with respect to personal data processed by the Platform as Data Controller:
Right of access.
Right to rectification.
Right to erasure.
Right to restriction of processing.
Right to data portability.
Right to object.
To exercise these rights, a request may be sent to the email address mvesquelsl@gmail.com, clearly indicating the right to be exercised and providing proof of the applicant's identity where necessary.
Where data has been provided to a Tenant and the Tenant acts as the Data Controller, the exercise of rights must be directed directly to the relevant Tenant.
Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if they believe that the processing of their data does not comply with the applicable regulations.
10. Security
The Platform implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, among others:
Data minimization principle.
Restricted access control.
Encryption or pseudonymization where appropriate.
Monitoring and maintenance of the technological infrastructure.
Security measures are reviewed and updated periodically to adapt to technological developments and existing risks.
11. Minors
The Platform is not intended for minors and does not actively promote the registration of persons who do not have the legal capacity to enter into contracts.
If it is detected that personal data of a minor has been collected without the proper legal basis, the necessary measures will be taken to delete it.
Tenants are responsible for compliance with the applicable regulations regarding the personal data of their own customers, including, where applicable, provisions relating to minors.
12. Changes to the Privacy Policy
The Platform reserves the right to modify this Privacy Policy to adapt it to legislative, case law, or technical changes.
If the changes are significant, users will be informed through the usual communication channels used by the Platform.
The version in force will always be the one published on the website at the time of access.