1 Data controller
The controller of the personal data collected through app.bendely.es is:
This policy applies to the data that Bendel processes as data controller: data of the businesses that subscribe to the service and of visitors to the website.
When Bendel acts as a data processor, processing the data of the businesses' end customers on their behalf, the information is in Privacy when booking and the terms of the processing agreement in clause 7 of the Terms and Conditions.
2 What data we process and why
Each processing activity for which Bendel acts as controller is described below:
| Activity | Data processed | Legal basis | Retention |
|---|---|---|---|
| Account registration and management | Name, email, business name, contact phone number | Performance of the contract | For the duration of the contract and then for up to 6 years (commercial and tax obligations) |
| Invoicing and payment | Billing details, payment method (handled by the payment provider) | Performance of the contract / legal obligation | 6 years from the invoice date (commercial and tax obligations) |
| Marketing communications | Consent (only if you expressly authorise it) | Until you withdraw consent | |
| Security and abuse prevention | IP address, technical browser data and access logs | Legitimate interest in keeping the service secure | As long as needed to detect and resolve security incidents |
| Customer support | Name, email, content of the enquiry | Legitimate interest | 3 years from the last interaction |
3 Marketing and transactional communications
Bendel may send communications strictly related to the provision of the service: notices about the account status, reminders that the trial period is ending, changes to the service's features, technical updates, security notifications, or changes to the financial or contractual terms. These communications are based on the performance of the contract and do not require prior consent.
Bendel does not currently send marketing communications. If it does so in the future, only people who have expressly authorised them will receive them, and each one will include an unsubscribe link.
That consent can be withdrawn at any time through the unsubscribe link or by writing to contacto@bendely.es.
Withdrawing consent does not affect transactional communications (invoices, notices of changes to the Terms, security notifications), which are necessary for the performance of the contract.
4 Disclosure of data to third parties
Bendel does not sell or share personal data with third parties for commercial purposes.
Bendel only shares personal data with the following providers, which act as data processors under a contract in accordance with Article 28 GDPR:
- Microsoft (Azure, servers in the EU): to store and process the service's data.
- Payment provider: to process subscription payments securely. Bendel does not store full card details.
- Google (reCAPTCHA): to protect forms against bots and automated submissions. It receives technical data about the connection and the browser.
- Microsoft (Microsoft 365): to send notifications, invoices and service-related communications.
Bendel may disclose personal data to public authorities when required by law.
5 International data transfers
The servers where the service's data is stored are located in the European Union, so no international transfers take place as regards primary storage.
Google reCAPTCHA may involve the transfer of technical data (such as the IP address or browser data) to Google servers in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, which ensures a level of protection equivalent to that required by the GDPR.
6 Your rights
Anyone whose data Bendel processes as controller can exercise the following rights:
- Access: obtain confirmation of whether their data is being processed and, if so, access it.
- Rectification: request the correction of inaccurate or incomplete data.
- Erasure: request the deletion of their data when it is no longer needed for the purposes for which it was collected.
- Restriction: request that the processing of their data be restricted in certain circumstances.
- Portability: receive their data in a structured, commonly used format in order to transfer it to another controller.
- Objection: object to processing based on Bendel's legitimate interest.
- Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, write to dpd@bendel.es stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask for the additional information needed to confirm it. Bendel will reply within one month.
If you believe the processing of your data does not comply with the applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es).
7 Data security
Bendel applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include encrypting communications over HTTPS, access control to systems and regular backups.
If a security breach occurs that may affect the rights and freedoms of data subjects, Bendel will notify the Spanish Data Protection Agency (AEPD) within 72 hours at the latest and, if the risk is high, will also notify those affected directly.
8 Minors
You must be over 18 to create a business account. We do not knowingly collect data from minors for this purpose and, if we learn that an account has been created in breach of this requirement, we will close it and delete its data. The position of minors who book an appointment is explained in Privacy when booking.
9 Cookies
Bendely only uses technical and preference cookies that are necessary for the service to work. It does not use analytics or advertising cookies. You can find full details in our Cookie policy.
10 Changes to this policy
Bendel may update this Privacy Policy to reflect changes to the service, to the applicable regulations or to its data processing practices. Significant changes will be notified by email to registered users at least 15 days in advance.
The date of the latest revision always appears at the top of this document.
11 Contact
For any questions about this Privacy Policy or about how your personal data is processed, you can contact us at contacto@bendely.es.