Privacy policy
What personal data we process, why we are allowed to do so, how long we keep it, who we share it with and what you can require of us.
Last updated: September 19, 2026
This English version is a courtesy translation. In the event of any discrepancy, the Spanish version prevails.
Working draft. This text was written by our product team, not a law firm. A lawyer must review it before it goes live, and the details highlighted in amber still need to be replaced with the company's real ones.
1. Data controller
- Data controller: PENDING: company name
- Tax ID (NIF): PENDING: NIF or CIF
- Address: PENDING: full registered office address
- Privacy email: PENDING: controller’s email address. Until that address is operational, any request sent to hola@payezz.app will be handled in the same way, and time limits will run from the day it is received.
- Data protection officer (DPO): PENDING: data protection officer, if one must be appointed
2. What this policy covers
Payezz acts in two different capacities, and it is important not to confuse them, because they determine whom you need to contact.
- As data controller. For the data of visitors to this website, of anyone who writes to us, and of our customers’ contact and billing persons. This is what this page describes.
- As data processor. For the data that each customer uploads to or generates in its own Payezz instance: its buyers, its orders, its invoices, its support tickets. There, the customer is the data controller and Payezz processes that data solely on the customer’s instructions, under the terms of the data processing agreement. If you are a buyer from a store powered by Payezz, you exercise your rights with that store, not with us, although if you write to us we will help you identify it.
3. What data we process
We do not ask for more than is necessary and we do not buy databases. The categories are as follows:
- Identification and contact data. First name, surname, email address, telephone number if you provide it, company and job title.
- Account data. Account identifier, subscribed plan, verified domains, configuration preferences and administrative activity log.
- Tax and billing data. Company name, tax ID (NIF), tax address, invoices issued and their payment status.
- Payment data. Processed by Stripe. Payezz does not store full card numbers or security codes: it only receives identifiers, the last four digits, the card brand and the outcome of the transaction.
- Technical data. IP address, timestamp, user agent and error traces, in the server and proxy logs, which are necessary to operate the service and detect abuse.
- Communications. The content of the emails and support requests you send us.
The data comes from you, except for technical data, which is generated automatically when you use the service, and payment data, which we receive from Stripe as a result of the transaction.
4. Purposes and legal bases
| Purpose | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Responding to your enquiry or your early access request | Identification, contact, message content | Pre-contractual measures taken at the data subject’s request, Art. 6(1)(b) |
| Creating the account and providing the subscribed service | Identification, contact, account data | Performance of a contract, Art. 6(1)(b) |
| Invoicing the plan and charging the applicable fee | Tax, billing and payment data | Performance of a contract, Art. 6(1)(b), and legal obligation under accounting and tax law, Art. 6(1)(c) |
| Providing technical support and handling incidents | Contact, account data, communications, technical data | Performance of a contract, Art. 6(1)(b) |
| Maintaining security, preventing fraud and abuse, and keeping access logs | Technical data, account data | Legitimate interest in protecting the service and its users, Art. 6(1)(f) |
| Sending you service notices: relevant changes, incidents, the end of a time period | Contact, account data | Performance of a contract, Art. 6(1)(b) |
| Sending commercial communications about Payezz news | Contact | Consent, Art. 6(1)(a), which may be withdrawn at any time, or the legitimate interest provided for in Article 21(2) of Law 34/2002 on Information Society Services and Electronic Commerce (LSSI) where you are already a customer and the communications concern similar products |
| Responding to requests from authorities and defending claims | Only the data strictly necessary in each case | Legal obligation, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f) |
No data is used for a purpose other than the one for which it was collected without first informing you and, where applicable, asking for your consent.
5. Retention periods
| Data | Period |
|---|---|
| Enquiries that do not lead to a contract | One year from the last contact |
| Account and contractual relationship data | For as long as the account remains active and, thereafter, for the limitation period of any claims arising from the contract |
| Billing and accounting records | Six years under the Spanish Commercial Code (Código de Comercio) and four years under the Spanish General Tax Law (Ley General Tributaria), counted from the end of the financial year |
| Technical and security logs | Twelve months, unless a specific incident requires them to be kept for longer |
| Consent to commercial communications | Until you withdraw it, and thereafter for the time needed to prove that your unsubscribe request was honoured |
| Export package of a closed instance | Thirty days from the destruction of the instance, after which it is deleted |
Once the period has expired, the data is erased or anonymised. While a legal obligation or a pending claim remains, the data is blocked: accessible only in order to respond to the competent authority.
6. Recipients and processors
We do not sell personal data or disclose it to third parties for their own use. We do work with providers that process it on our behalf, under a signed data processing agreement:
| Provider | Purpose | Where the data is processed |
|---|---|---|
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Payment processing, connected accounts and billing for Payezz plans. | Ireland and the United States |
| Hetzner Online GmbH | Hosting of the containers, databases and backups. | Germany and Finland (European Union) |
| PENDING: outgoing email provider | Sending transactional emails and service notices | PENDING: provider location |
In addition, data may be disclosed to the tax authorities, law enforcement agencies, courts and tribunals, and our legal and accounting advisers, where there is a legal obligation to do so or where it is necessary to defend a claim.
With regard to payments, Stripe acts as an independent data controller for the transaction data, in accordance with its own privacy policy and the payment services regulations, and not merely as our data processor.
7. International transfers
Payezz’s infrastructure is located in the European Union. There is, however, one transfer that we must disclose clearly:
Stripe. The contracting entity is Stripe Payments Europe, Ltd., established in Ireland, but the processing may involve access by Stripe, Inc., in the United States. That transfer is based on the standard contractual clauses approved by the European Commission and on the supplementary measures agreed with the provider, and on the US entity’s participation in the EU-U.S. Data Privacy Framework, found to provide an adequate level of protection by the Commission Decision of 10 July 2023.
You may request a copy of the safeguards applied by writing to the address given in section 1. If in the future we engage another provider outside the European Economic Area, this policy will be updated before we start using it.
8. Your rights and how to exercise them
You may exercise the following rights at any time:
- Access. To know whether we process data about you and to obtain a copy of it.
- Rectification. To have inaccurate data corrected or incomplete data completed.
- Erasure. To have your data deleted when it is no longer necessary and there is no legal obligation to retain it.
- Restriction of processing. To have us retain your data without processing it while a challenge is being resolved.
- Objection. To object, on grounds relating to your particular situation, to processing based on our legitimate interest.
- Data portability. To receive your data in a structured, commonly used format, or to have us transmit it to another controller where technically feasible.
- Withdraw your consent at any time, where consent is the basis for the processing, without affecting the lawfulness of processing carried out before its withdrawal.
To exercise them, write to the privacy address given in section 1, stating which right you are exercising. If we have reasonable doubts about your identity, we may ask you for additional information to verify it, and nothing more. We will respond within one month of receipt, which may be extended by a further two months if the request is complex, in which case we will inform you within the first month.
Exercising these rights is free of charge. If you believe that we have not handled your request properly, you may lodge a complaint with the supervisory authority, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), calle Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es. Before doing so, we would appreciate it if you wrote to us: it is almost always quicker.
9. Information security
We apply technical and organisational measures appropriate to the risk, including encryption in transit using TLS, encryption of secrets at rest, isolation of each customer in its own container and its own database, least-privilege access, logging of administrative activity and encrypted backups.
Details of these measures, in the version for customers, can be found in Annex II to the data processing agreement. Should a personal data breach occur that poses a risk to your rights, we will inform you without undue delay and notify the supervisory authority where required.
10. Minors
Payezz is a service intended for businesses and professionals. It is not intended for minors and we do not knowingly collect their data. If we discover that we have received data from a minor without a legal basis for processing it, we will erase it.
11. Automated decision-making
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, nor do we carry out profiling for that purpose. Stripe’s automated anti-fraud controls may decline a specific transaction; in that case you can ask us for human review by writing to us.
12. Changes to this policy
We will publish any changes on this page, together with their revision date. If a change is substantial and affects you as a customer, we will also notify you by email with reasonable advance notice.