Privacy Policy

1. Data controller

2. Personal data we collect

2.1 Data provided directly by the Client

• Engagement data: full name, email, phone, business name.
• Billing data: tax address, NIF/NRT or other identifier, payment data (processed by Monei; Woply does not store card data).
• Contact data: information provided through forms, email or other channels.
• Content provided for website production: texts, photographs, logo, documents and any other material the Client uploads to the configurator. This data is processed exclusively for the purpose of providing the service.

2.2 Data collected automatically

• Browsing data: IP address, browser type, operating system, pages visited, time spent.
• Cookies: as described in our Cookie Policy.

3. Processing purposes

• Order management and provision of the design, development and delivery service of the engaged website.
• Provision of the Woply Cuidado service if engaged: hosting, backups, monitoring, small changes and support.
• Management of billing and collection of orders and subscriptions through Monei.
• Handling of Client queries, incidents and requests.
• Sending of commercial communications and newsletters, provided the Client has given prior and specific consent.
• Service improvement and statistical analysis of Website use (anonymized or aggregated data).
• Compliance with applicable legal and tax obligations.

4. Legal basis for processing

• Performance of contract: for the provision of the service, order management and billing [art. 6.1.b) GDPR].
• Consent: for the sending of commercial communications [art. 6.1.a) GDPR].
• Legitimate interest: for service improvement and fraud prevention [art. 6.1.f) GDPR].
• Legal obligation: for compliance with tax and accounting obligations [art. 6.1.c) GDPR].

5. Data retention

• Contractual data: during the term of the contractual relationship and the 5 years following its termination.
• Tax data: during the periods established by applicable tax legislation (between 4 and 6 years).
• Content provided by the Client: during the term of the Woply Cuidado service and, where applicable, up to 30 days after cancellation, during which the Client may request a copy.
• Consent data (commercial communications): until the Client revokes their consent.

6. Data recipients

For the provision of the service, Woply uses the following providers as data processors:

• Monei — payment gateway, for transaction processing.
• Netlify — web hosting provider (hosting and site delivery).
• Supabase — database and storage provider for the Client's materials during production and, where applicable, the provision of the Woply Cuidado service.
• Systeme.io — email marketing platform, used exclusively to send commercial communications to Clients who have given their consent.
• Public administrations and competent authorities, when there is a legal obligation to communicate.

No international data transfers are carried out outside the European Economic Area without the appropriate safeguards under the GDPR (standard contractual clauses approved by the European Commission or other equivalent mechanisms).

7. Client rights

• Access: to know what personal data we are processing.
• Rectification: to request the correction of inaccurate or incomplete data.
• Erasure: to request the deletion of data when no longer necessary.
• Objection: to object to processing under certain circumstances.
• Restriction: to request the restriction of processing.
• Portability: to receive the data in a structured and commonly used format.
• Withdraw consent at any time, without this affecting the lawfulness of previous processing.

To exercise any of these rights, the Client may send a request to hola@woply.io, accompanied by a copy of their identity document.

The Client has the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the Andorran Data Protection Agency (www.apda.ad), as appropriate.

8. Security

Woply adopts appropriate technical and organizational measures to guarantee the security, integrity and confidentiality of personal data, including encryption in transit (SSL/TLS), role-based access control and periodic backups.