Parties and processing record
The processor is Alejandro García Martínez, trading as Vuelvy, Spanish tax ID 49170885J, Calle Cronista Carlos Valcarcel, 8, 30120 Murcia, Spain. Privacy: privacy@vuelvy.com; incidents: seguridad@vuelvy.com. The controller is the actual business owner identified in its contract, including tax identity, address, representative and privacy contact. A brand name or Google sign-in alone does not establish identity or representation. The individual record defines channels, functions, integrations, categories and contacts; unselected functions are excluded.
Purpose, individuals, operations and duration
Vuelvy processes necessary data on the controller's behalf for contracted functions during the relationship and orderly closure. The contract, processing record, authorised user actions and settings, and verified requests document instructions.
- Wallet: minimum holder/pass identifiers and fields, status, points, benefits, uses, preferences, technical tokens and events; enrolment, issuance, lookup, hosting, updates, redemption, revocation and deletion.
- Audiences and email: email, necessary attributes, source, lawful basis, opt-outs, content and results; import, organisation, segmentation and expressly instructed sends. This agreement does not authorise additional tracking.
- Shopify: enabled customer, order and product data only within authorised functions and permissions; connecting alone does not authorise writing to the store or commercial messages.
- Support: limited access to necessary data to diagnose and carry out verified instructions; no secrets or unnecessary personal information in conversations.
Limits and responsibilities
The controller determines purposes and lawful bases, informs individuals, supplies minimum data, maintains contacts and supervises processing. Saving a pass or importing a contact is not consent to advertising. Special categories, criminal data and programmes aimed at minors require specific prior assessment and agreement. Proximity does not authorise continuous surveillance or Vuelvy collection of phone location. Vuelvy does not sell holder data or reuse it for its own advertising or model training. Its own account, billing, security and legal-claims processing is separate and governed by its privacy policy.
Instructions, confidentiality and assistance
Vuelvy follows documented instructions, including transfers, and immediately warns if it considers them unlawful. It informs the controller before legally required processing unless prohibited. Authorised personnel receive relevant training and confidentiality duties. Rights requests are forwarded without avoidable delay, with assistance to locate, export, correct, restrict or delete data; Vuelvy does not respond for the controller without authorisation. It assists impact assessments, prior consultations and security duties. Urgent rights and incidents do not wait for commercial support deadlines.
Security, breaches and audits
Measures include TLS, server-side business authorisation, roles, PostgreSQL RLS isolation, application encryption of secrets, scoped private storage, file validation, traceability and backups with verified recovery. Published brand assets for passes may be accessible to their providers and must not contain confidential information. Vuelvy reviews proportionate measures and does not claim unverified certification or comprehensive encryption at rest. It notifies breaches without undue delay after awareness, progressively providing nature, scope, contact, consequences and measures; the controller's 72-hour authority deadline does not allow the processor to delay notice. Reasonable evidence and audits are provided while protecting third-party data. Arrangements for extraordinary work cannot prevent legal duties or make breach response conditional on another payment.
Providers and functions
The individual record identifies applicable subprocessors and necessary data. These locations do not assert exclusive EU residence for all operations or access.
- OVH Hispano S.L.: PostgreSQL and backups in Milan, Italy, European Union. Its contractual chain may include access from Canada and the UK with applicable safeguards; this does not establish access by every entity.
- Vuelvy directly operates Wallet, email, connectors and Versity object storage on its Mac mini in Spain, European Union. S3 compatibility does not mean storage in Amazon Web Services.
- Vercel Inc.: web, functions and necessary account/service data; production functions in iad1, United States, with global delivery and other processing. Its DPA is incorporated in the Pro agreement with applicable SCCs.
- Cloudflare Inc.: DNS, network and security according to enabled function; global processing and a DPA with SCCs. DNS alone does not establish that all traffic is proxied.
- Resend (Plus Five Five, Inc.): recipients, content and email events where applicable; metadata, logs and account/API records in the United States even with a European sending region. Vuelvy's own account/support mail is separate processing.
- Apple/APNs, Google Wallet and Shopify: minimum data for selected integrations. Apple and Google are independent controllers for their platforms; roles and safeguards per operation belong in the record. Klaviyo, Cal.com and advertising tools are not added merely because Vuelvy uses them commercially.
Subprocessor authorisation and changes
Formalisation authorises only identified subprocessors and operations. Vuelvy imposes equivalent written obligations and remains responsible for their compliance. Additions or replacements chosen by Vuelvy receive at least thirty calendar days' notice identifying entity, function, location and data. Existing providers' chain changes are communicated without delay and with available notice, without promising deadlines beyond Vuelvy's control. The controller may object on substantiated data-protection grounds. An alternative is sought; without resolution, only the affected function is disabled or ended without a penalty for that cause, with orderly exit. A new flow does not start without valid authorisation and safeguards. Urgent security or legal changes are justified and promptly notified.
International transfers
Before an EEA export, a valid safeguard for the entity and flow is documented: applicable adequacy or Standard Contractual Clauses, assessment and supplementary measures where required. Vercel, Resend and Cloudflare safeguards are documented through their SCCs, especially Module 3 for the processor-subprocessor chain; DPF certification is not assumed. Data is minimised with TLS and scoped access, without claiming that necessary content is hidden from its technical provider. Invalid safeguards, incompatible demands or unmitigable risk trigger suspension of the affected flow and assessment of an alternative. European storage does not exclude third-country access.
Return, deletion and backups
The controller chooses return in a usable format followed by deletion, or deletion with confirmation. Comprehensive closure is handled manually under verified instructions: ordinary primary return/deletion within thirty calendar days after effective termination or a valid instruction, and removal of the last affected copy within ninety days. Statutory rights deadlines still apply. Own backups have maximum ages of fourteen days for daily, forty-two for weekly and sixty for monthly copies. Pending copies are excluded from ordinary use and deletions are reapplied before restoration resumes. Partial maintenance does not replace complete closure or instructions to third parties. Non-payment alone is not a deletion instruction. Vuelvy does not promise remote removal of a pass independently retained by a device/provider; revocation or updates are applied where possible and the actual scope is explained.
Minimum legal retention
Only necessary evidence for duties or claims is separated with documented purpose, restricted access, starting point and expiry: generally four tax years from the statutory start, six commercial-record years from the last accounting entry and five for personal actions from enforceability, subject to special rules or evidenced interruption. This does not retain the whole contacts, passes, campaigns or logs dataset. Statutory blocking under Article 32 of Spain's LOPDGDD has specific restrictions and is distinct from a limited legal archive. Evidence is deleted when its grounds end, without restarting periods by copying it. A stable QR link does not require indefinite personal-data retention.
Formalisation and applicable version
These terms are completed in Annex II of the contract generator with both parties' identity and representation, business, actual processing record, contact, channels, inventory and exit choice. An immutable PDF is retained with reference, version, date and signature or express representative acceptance. Generating a PDF, visiting this page, receiving notice or previously accepting general terms does not record acceptance of this annex or change earlier acceptances retroactively. Both parties cooperate with authorities and review the agreement when processing changes. To complete it or request closure instructions: privacy@vuelvy.com.