Privacy policy

The controller of your data is:

• Company name: [to be completed], which operates the BuenSpot brand.
• NIF: [to be completed].
• Registered office: [to be completed].
• Registration: [to be completed].
• Contact: the contact form or the contact form.

For any data protection question, write «Protección de datos» in your message. More about the company is in the legal notice.

We have not appointed a data protection officer (DPO), because our activity does not fall under the mandatory cases of Article 37 GDPR and Article 34 LOPDGDD. If we appoint one later, we will publish the contact details here and notify the AEPD.

Until then, the controller handles all privacy questions directly at the contact form or through the contact form.

We only process the data we need in each situation. You give us most of it. Other data arises from using the platform, comes from the venue or our payment provider, or is given to us by someone else (for example, a person who gives you a voucher as a gift).

• Account: name, email address, language, password (we only store a hash, never the password itself), sign-up date, email verification date, role and your preference for review emails. To verify your email or reset your password we only store the hash of the one-time link and its expiry.
• Purchase: the deals and options bought, amounts, order status, promo code used, date and the payment ID Stripe returns to us. We do not see or store your full card details: Stripe processes them.
• Vouchers: voucher code (BS-XXXX-XXXX), check digit, signed QR code, expiry date, redemption status and date, and the redemption attempts (valid or not) recorded by the venue.
• Gift: if you mark an order as a gift, the recipient's name, email address and message. You give us this data as the buyer.
• Reservation: date, time or nights, number of people, status (confirmed, changed, cancelled, no-show) and, if you wish, a phone number and a note for the venue.
• Favourites: the deals you save.
• Review: score, comment, date, the deal it concerns and, where applicable, the venue's public reply and the reason for hiding it.
• Support and chat: your messages, the subject, the ticket status and the team's replies. If you write without an account, also your name and email. A review with a low score opens a support ticket.
• Emails sent: a copy of the service emails we send you (recipient, subject, content, type, delivery status). You can see them in your account.
• Account notices: the notifications we show you on the website.
• Newsletter: email address, language, chosen city or cities, where you signed up, request date, confirmation date and, where applicable, unsubscribe date.
• Partner venues and their contacts: business name, address, phone, description, locations and opening hours, and the details of the person who manages the account (name, email, hashed password). For settlements: legal name, NIF/CIF, IBAN, billing address and email, and the settlements and commission invoices. The terms for venues are in the partner terms.
• Business enquiries (page «For businesses»): business name, contact person, email, phone, city, and the notes and status of the sales follow-up.
• Technical and security data: your IP address, temporarily, to limit attempts (login, registration, password reset, newsletter, account deletion), a log of actions by the team and the venues (audit log) and a log of redemption attempts. The technical cookies we use and, only if you accept them, the Google Analytics cookies are described in the cookie policy.
• Location: on the nearby deals page you can use «my location». Your browser asks for your permission. The position is only used in your browser to calculate distances and is not sent to or stored on our servers.

We do not process special categories of data (health, religion and so on). Please do not give us such data in reservation notes, reviews or messages. If a note for the venue must include, for example, an allergy, we pass it only to that venue to provide the service you ask for.

If you give us data about someone else (for example, a gift recipient), you confirm that you are allowed to do so and that this person knows this policy. We inform gift recipients in the voucher email itself, as Article 14 GDPR requires.

The table below shows, for each processing activity, what we use the data for, the legal basis under Article 6(1) GDPR and how long we keep it.

Where we rely on legitimate interest, we have checked that this interest does not override your rights. You can object at any time (section 13).

When the period of use ends, we restrict the data under Article 32 LOPDGDD: it is only available to judges, courts and authorities during the limitation period. After that we delete or anonymise it.

Some data is required for the contract. Without a name and email we cannot create your account or send your vouchers. Optional data (reservation phone or note, gift message) can be left blank.

The venue provides the service (the meal, the hotel night, the treatment or the activity). To make that possible, we only pass on what is needed:

• your name;
• the number of people, the date and time or nights of the reservation;
• the phone number and note, if you left them;
• the voucher code and the deal or option bought, and whether the voucher is valid when redeemed.

We do not share your payment details with the venue. The venue sees published reviews like any visitor and can reply publicly.

The venue processes this data as an independent controller to provide the service and meet its own obligations (for example, the guest register for accommodation). In our contract it undertakes to use the data only for your visit and not to send you advertising without your consent. For what the venue does with your data outside BuenSpot, its own privacy policy applies.

We work with providers that process data on our behalf (processors, Art. 28 GDPR). With each of them we have an agreement that obliges them to use the data only on our instructions and to protect it.

Stripe also processes some data as an independent controller, for example to prevent fraud and meet its obligations as a payment institution. Stripe's own privacy policy applies to that.

Within BuenSpot, only team members who need your data for their task (administration, sales or customer service) can access it, with a personal user and a limited role.

We only disclose data to authorities and public bodies when a law obliges us to, for example to the tax authority (Agencia Tributaria), judges and courts, the police or consumer authorities, and always limited to what is legally requested.

We may also share data with legal or tax advisers bound by confidentiality when needed to defend our rights or comply with the law.

Some providers are outside the European Economic Area (EEA), mainly in the United States. We only transfer data if there is an appropriate safeguard:

• the European Commission's adequacy decision on the EU-US Data Privacy Framework (July 2023), when the provider is certified;
• or the standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR), with additional measures where needed.

You can ask for a copy of the applicable safeguards at the contact form or through the contact form.

We do not sell or rent your data. We do not share data with advertisers and do not use advertising cookies.

We do not make decisions based solely on automated processing that produce legal effects for you or similarly affect you (Art. 22 GDPR).

We do use simple automatic rules to protect the platform: for example, we temporarily block a form after too many attempts, or refuse a redemption if the voucher has already been used, has expired or does not belong to that venue. If you think such a rule affects you unfairly, write to us and a person will review it.

The order of deals on the website depends on criteria such as location, popularity, discount, rating, price or novelty. This is not profiling with legal effects.

BuenSpot is intended for people aged 18 and over. You must be at least 18 to create an account or buy. We do not knowingly collect data from minors.

If we find that an account belongs to a minor, we will delete it. If you are a parent or guardian and believe a minor has given us data, write to us through the contact form.

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:

• encrypted connections (HTTPS) across the whole website;
• passwords stored only as a hash (bcrypt);
• one-time verification and reset links with an expiry, of which we only store a hash;
• vouchers with a signed QR code and check digit, which can only be redeemed once;
• signed httpOnly session cookies, inaccessible to scripts;
• row level security (RLS) in the database;
• role-based access for the team and the venues, and an audit log of relevant actions;
• limits on attempts for login, registration, password reset and other forms.

No system is infallible. If a security breach affects your data, we will notify the AEPD within 72 hours where required and, if there is a high risk to you, tell you without delay (Arts. 33 and 34 GDPR).

You help too: use a unique password and do not share your voucher codes.

You have the right to:

• Access: know what data we process and get a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed or there is no legal basis.
• Restriction: ask us to suspend processing in certain cases.
• Portability: receive the data you gave us in a structured, commonly used format.
• Objection: object to processing based on legitimate interest, and always to direct marketing.
• Withdrawal of consent: at any time, without affecting the lawfulness of earlier processing.
• Not to be subject to automated decisions with legal effects (section 10).

How to exercise them:

• In your account: at /cuenta/gegevens you can download your data (profile, orders, vouchers, favourites and reviews) as JSON and delete your account yourself. You can see your name, email and language in your account and ask us to correct them.
• In writing: at the contact form or through the contact form, stating «Protección de datos» and the right you are exercising. Also by post to [to be completed].

If you write from your account's email address, we usually need nothing more. If we have reasonable doubts about your identity, we may ask for additional, proportionate information (Art. 12(6) GDPR). Do not send a copy of your ID unless we ask for it.

We reply within one month of receiving the request. If it is complex or we receive many, we may extend this by two more months; we will tell you within the first month. Exercising your rights is free, except for manifestly unfounded or excessive requests.

What happens when you delete your account: we replace your name with «Verwijderd account» and your email with a non-existent address, and end your session. Paid orders are kept without your name or email, because the law requires us to keep accounting records (section 5). Unredeemed vouchers are then no longer reachable through an account; download or use them first, or ask for a refund first if you are still entitled to one. Venue and team accounts cannot be deleted through the website; write to us for those.

If you disagree with our answer, you can file a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. We appreciate it if you write to us first, but this is not required.

Newsletter. We only send it if you sign up and confirm with the link we email you (double opt-in). You choose the cities you are interested in.

Customers. If you have bought from BuenSpot, we may email you BuenSpot deals similar to what you bought, as Article 21.2 LSSI allows. You can object when we collect your data and in every email.

Unsubscribing. Every marketing email has a link to unsubscribe with one click, simply and free of charge. You can also ask through the contact form. After you unsubscribe these emails stop within a short time.

Review emails. After a redemption we ask for your opinion once. You can switch these emails off with the link in the email itself.

Service emails. Order confirmations, vouchers, reservation notices, expiry reminders, support replies and security emails are part of the service and are not advertising. You cannot unsubscribe from them while you have orders or an active account.

We do not send marketing messages by SMS, WhatsApp or phone.

You can only write a review after redeeming a voucher (verified visit). When published, the deal page shows your score, your comment, the date and the name in your account. If you prefer to show only your first name, change the name in your account before writing the review, or write to us.

Do not include personal data about yourself or others in your comment. We hide a review only for the reasons in the review policy, including when it contains someone else's personal data.

If you delete your account, your reviews no longer show your name. You can ask us at any time to remove a review of yours.

We may update this policy when our services, providers or the law change. The version and date of the last change are shown at the top.

If a change is significant, for example a new purpose or a new type of recipient, we will tell you by email or with a notice on the website before it applies. If a new processing activity requires your consent, we will ask for it.

The Spanish text is the binding version. The Dutch and English versions are translations for information only.