Legal
Privacy policy
This is a translation for convenience. In case of any discrepancy, the Spanish version prevails.
Controller
Vadim Savchuk, self-employed professional, tax ID [tax ID pending], address [address pending]. Data protection contact: [email protected].
Who this policy covers
It covers visitors to paf-paf.app and PafPaf customers: the clubs, associations, studios and professionals that subscribe to the service, and the people who use the application on their behalf (owners and employees).
The data of members, clients and employees that each customer records in its PafPaf workspace is processed by that customer as controller; PafPaf acts only as a processor under the Data processing agreement. To exercise your rights over that data, contact the organisation you deal with.
What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Technical visit data: IP address, browser, requested pages | Serve the website, protect it against abuse and diagnose errors | Legitimate interest in the security of the service (Art. 6(1)(f) GDPR) |
| Account: name, email, phone, role, hashed password, access logs | Create the workspace, provide access and deliver the subscribed service | Performance of the contract (Art. 6(1)(b) GDPR) |
| Billing: company name, tax ID, address, plan, payments | Collect the subscription, issue invoices and meet tax and accounting obligations | Performance of the contract and legal obligation (Art. 6(1)(b) and (c) GDPR) |
| Email and the content of your messages | Answer questions and provide support | Performance of the contract or, if you are not yet a customer, your request |
| Customer email | Tell you about PafPaf news similar to what you subscribed to; you can unsubscribe in every message | Art. 21(2) LSSI-CE and legitimate interest; for other marketing, your consent |
We use no analytics or advertising tools, do no profiling and make no automated decisions with legal effects on you.
Payments are processed by Stripe. PafPaf neither receives nor stores your full card details.
How long we keep it
- Account data: for the duration of the contract and, after it ends, the data export period set in the Terms (30 days). It is then deleted.
- Invoices and accounting data: six years (Article 30 of the Spanish Commercial Code) and, in any case, while tax liabilities may arise.
- Technical logs: only as long as needed for the security of the service, at most 90 days.
- Enquiries without a contract: until resolved and then for the period of possible claims.
Recipients
We do not disclose your data to third parties unless required by law. The providers that serve us access it only for that purpose and under a processing agreement: hosting, file storage, content delivery, email and payments. The full list with locations is in Sub-processors.
Some of these providers belong to groups based in the United States. In those cases the transfer relies on the EU-US Data Privacy Framework and, as an additional safeguard, the European Commission's standard contractual clauses.
Your rights
You may request access to, rectification or erasure of your data, restriction of processing and data portability, object to processing, and withdraw consent where it is the legal basis. Write to [email protected] stating the right you exercise; we may ask you to prove your identity. We reply within one month.
If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
Security
Connections are encrypted, passwords are stored with a one-way hash and each customer's data is kept separate from everyone else's. Access to the systems is limited to those who need it.
Minors
PafPaf is a service for organisations and professionals and is not intended for anyone under 18.
Changes
If we change this policy, we will publish the new version on this page with its date and, if the change is significant, notify customers by email.