Privacy policy
In a nutshell
- Businesses (bars, cafés, shops…) use Rondafy to have loyalty cards on their customers' phones.
- If you're a customer of a business and add its card: the controller of your data is that business. Rondafy only stores and processes it on their behalf, so the card works.
- To have the card you don't need to give any personal data: it's identified by an anonymous code. Name, email, phone number and date of birth are optional.
- We don't sell data, we don't share it for third-party advertising and we don't track your location.
- You can delete the card from your Wallet whenever you want and ask for your data to be deleted by writing to info@rondafy.es.
1. Who is the controller
Rondafy is a service provided by:
- Owner: Ishaak Begua Zelmati
- Tax ID (NIF): 31047172R
- Address: C/ Covadonga, 21, 46680 Algemesí (Valencia), Spain
- Contact and privacy email: info@rondafy.es
- Website: https://rondafy.es
In this policy we call it «Rondafy» or «we». Depending on who you are, Rondafy acts in a different role:
| Who you are | Rondafy's role | Who decides about your data |
|---|---|---|
| Business using Rondafy (Rondafy customer) | Controller | Rondafy |
| Person who requests a demo, signs up or writes to Rondafy | Controller | Rondafy |
| Customer of a business who adds its card to their phone | Processor (art. 28 GDPR) | The business whose card you've added |
2. If you're a customer of a business and have added its card
2.1 Who is the controller
The controller of your data is the business that offered you the card: its name appears on the card itself and on the page where you added it. Rondafy processes your data solely on its instructions and with the confidentiality and security obligations of a processor. We don't use your data for our own purposes.
2.2 What data is processed
- Always (no visible personal data): an anonymous card identifier, the stamps and rewards earned, the sign-up date and the date of each visit, and the card status.
- Only if you provide them (optional): name, email, phone number and date of birth (each business chooses which ones it asks for).
- If you play a welcome game (for example, «scratch-and-win»): the prize won and the date.
- Wallet technical data: to update the card on your phone, Google Wallet or Apple Wallet give us a technical identifier for the device or card. We also record the device type (iPhone/Android) to offer you the right card.
We don't process your location. Some cards include the business's address so your own phone can remind you of the card when you're nearby. That check is done by your phone; neither Rondafy nor the business receives your position.
2.3 What it's used for
- Making the card work: adding stamps, letting you know when you have a reward and redeeming it.
- Sending you the business's notifications on your card (for example, promotions, birthday greetings or a review request after redeeming a reward). You can turn them off in your Wallet settings or delete the card at any time.
- Providing the business with usage statistics for its programme (visits, repeat rate, returning customers). These statistics are shown in aggregate or with the card's anonymous identifier.
- If you gave your name or email, allowing the business to identify you within its loyalty programme.
2.4 Legal basis
The legal basis is determined by the controlling business. In general:
- The performance of the loyalty programme you voluntarily join by adding the card (art. 6.1.b GDPR).
- Your consent for the optional data (name, email, phone number, date of birth) and for receiving promotional notifications (art. 6.1.a GDPR). You can withdraw it at any time by deleting the card or writing to the business or to info@rondafy.es.
2.5 How long it's kept
For as long as the card is active and the business keeps using Rondafy. If the business leaves the service, we delete or return the data within 30 days at most, unless a law requires it to be kept. If you request erasure, the data that identifies you is deleted.
2.6 Your rights
You can exercise your rights (see section 6) with the business. If you write to us directly at info@rondafy.es, we'll pass your request on to the business without delay and help it respond. To find your card, tell us the name of the business and, if you can, the code shown on the card.
2.7 Minors
The cards are not aimed at children under 14. If you're under 14, you need the consent of your mother, father or guardian to give personal data.
3. If you're a business using Rondafy
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Business name, contact person, email, phone, city and type of business, venue address | Creating and managing your account and providing the service | Contract (art. 6.1.b GDPR) | For the duration of the contract and, afterwards, until any possible liabilities expire |
| Password (stored encrypted, never in readable text) and login data | Account security | Contract and legitimate interest in security (art. 6.1.f GDPR) | For as long as the account exists |
| Billing and payment data | Charging for the service and meeting tax and accounting obligations | Legal obligation (art. 6.1.c GDPR) | 6 years (Spanish Commercial Code) or the period required by tax law |
| Logos, images, texts and settings of your cards | Designing and displaying your cards | Contract | For as long as the account exists |
| Support communications | Assisting you and improving the service | Contract and legitimate interest | For the duration of the relationship and up to 1 year afterwards |
| Email for Rondafy news | Sending you news and service improvements | Legitimate interest as a customer (art. 21.2 LSSI) or consent; you can unsubscribe in every email | Until you unsubscribe |
Regarding your customers' data, you are the controller and Rondafy your processor, under the terms of the processing agreement included in the Terms and conditions.
4. If you request a demo or write to us
We process your name, email, phone, business and whatever you tell us in order to reply and, if you ask, show you Rondafy. The legal basis is your consent and taking pre-contractual steps at your request (art. 6.1.a and 6.1.b GDPR). If you don't sign up, we delete this data within 12 months at most.
5. Who we share data with
We don't sell or transfer data to third parties for their own use. It's only shared with the providers we need to deliver the service, under a processing agreement and with security guarantees:
| Provider | Purpose |
|---|---|
| Render Services, Inc. | Application hosting |
| Supabase, Inc. | Database |
| Google LLC (Google Wallet) | Creating and updating cards in Google Wallet |
| Apple Inc. (Apple Wallet) | Creating and updating cards in Apple Wallet |
| Hostinger International Ltd. | Domain and related services |
| Email provider | Sending service emails (login, account notices) |
| Google Ireland Limited (Google Analytics) | Measuring public website usage in aggregate, only if you accept analytics cookies |
We may also disclose data to authorities or courts when required by law.
Transfers outside the European Economic Area: some of these providers are based in the United States. In those cases transfers rely on the EU-US Data Privacy Framework when the provider is certified, and/or on the standard contractual clauses approved by the European Commission.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent, by writing to info@rondafy.es with the subject «Data protection». We'll reply within one month at most. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.
If you think we haven't handled your data properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), passwords stored with irreversible encryption, access to each dashboard restricted to its business, backups and internal access limited to what's strictly necessary. If a security breach affecting personal data occurred, we'd act in accordance with the GDPR and notify the controlling business without undue delay.
8. Cookies and browser storage
Rondafy doesn't use advertising cookies. We use two types of cookies or storage:
Technical (necessary, no consent required, art. 22.2 LSSI):
- A technical session cookie to keep each business's dashboard session logged in.
- Browser local storage on the card sign-up page, to remember that you've already added a card so you don't get a duplicate, and on the public website to remember your choice about analytics cookies.
Analytics (only if you accept them): on the public rondafy.es website we use Google Analytics 4 (Google Ireland Limited) to find out, in aggregate, how many people visit each page and whether they go on to request a demo. It's only activated if you tap «Accept» in the cookie notice; if you reject it, it isn't loaded. The cookies it sets are _ga y _ga_*, with a maximum duration of 2 years. We don't use this data for advertising or to identify you. Google may process data outside the European Economic Area with the safeguards described in section 5.
You can delete all cookies from your browser settings. Some pages load fonts from Google Fonts, which means your browser connects to Google's servers.
9. Changes to this policy
We may update this policy to reflect legal or service changes. We'll always publish the current version on this page with its date and, if the change is significant, we'll notify businesses by email.