Privacy policy

1. Who is responsible for your data

The data controller is Scan and Buy Tech SL, registered at Calle García de la Serna 35, 29620 Torremolinos, Málaga, España. You can reach us at hola@scanandbuy.io or on +34 695 309 224 for anything concerning your personal data.

2. What data we collect and where it comes from

We only process data you give us directly or that your browsing generates. We do not buy databases or obtain your data from third parties.

• ·Contact form: name, email address, phone if you provide it, company and the content of your message.
• ·Demo request: the above plus business type and number of locations, if you tell us.
• ·Browsing: IP address, browser type, pages visited and time on site, through the cookies described in our Cookies Policy.
• ·App usage: if you are a customer of a store using Scan and Buy, we process your account, purchases and payment methods in order to provide the service.

3. Why we use it and on what legal basis

Each processing activity has a specific purpose and a legal basis. We do not use your data for anything outside this list.

• ·Answering your commercial enquiry — legal basis: your consent, which you may withdraw at any time.
• ·Providing the in-store purchase service — legal basis: performance of the contract.
• ·Issuing invoices and meeting tax and accounting obligations — legal basis: legal obligation.
• ·Measuring site usage to improve it — legal basis: your consent, collected in the cookie notice.
• ·Preventing fraud and keeping the platform secure — legal basis: our legitimate interest.

4. How long we keep it

We do not store data indefinitely just in case.

• ·Commercial enquiries that do not lead to a contract: 12 months from last contact.
• ·Customer data: for the duration of the contract and thereafter for the applicable limitation periods.
• ·Invoicing and tax data: 6 years under the Spanish Commercial Code, and 4 years for tax purposes.
• ·Browsing and analytics data: the period stated for each cookie in the Cookies Policy.

5. Who we share it with

We do not sell or transfer your data. We do work with technology providers acting as processors, who may only use it to provide us their service, under contract and with the safeguards of Article 28 GDPR.

• ·Hosting and infrastructure: our own servers in the European Union.
• ·Database: a self-hosted Supabase instance on our own EU servers.
• ·Transactional email: Resend, to send you receipts and replies.
• ·Receiving form notifications: the notification reaches a corporate mailbox hosted in the European Union and, in copy, a Google (Gmail) account belonging to the team. Google processes data outside the European Economic Area; the transfer relies on the Standard Contractual Clauses. We say so because elsewhere on this site we state that data is hosted in the EU, and this is the exception.
• ·SMS messaging: Twilio, where the service requires phone verification.
• ·Payments: Yavin as the gateway. We never store your full card details at any point; they are handled directly by the gateway, certified to the PCI DSS standard.
• ·Public authorities, where there is a legal obligation to disclose.

6. Transfers outside the European Union

Our main infrastructure is hosted in the European Union. Where a provider processes data outside the European Economic Area, the transfer relies on the Standard Contractual Clauses approved by the European Commission or on a valid adequacy decision.

7. Your rights and how to exercise them

You can exercise any of these rights by writing to hola@scanandbuy.io, stating which one. We will reply within one month at the latest. Exercising them is free of charge.

• ·Access: find out what data of yours we process.
• ·Rectification: correct anything inaccurate.
• ·Erasure: ask us to delete it when it is no longer necessary.
• ·Objection: object to processing based on our legitimate interest.
• ·Restriction: ask us to keep it but stop using it.
• ·Portability: receive your data in a structured, commonly used format.
• ·Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• ·Lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe we have not handled your request properly.

8. Automated decisions and profiling

We do not make automated decisions producing legal effects on you or similarly significantly affecting you. The computer vision technology used in autonomous stores detects objects and operational situations; it does not perform facial recognition and does not identify individuals.

9. Security

We apply technical and organisational measures proportionate to the risk: TLS 1.3 encryption in transit with HSTS, role-based access control, audit logging of sensitive operations, backups with periodic restore verification, and dependency review. No system is invulnerable, but should a breach occur that poses a risk to your rights, we would inform you and notify the supervisory authority within the legal deadline.

10. Changes to this policy

If we change how we process your data, we will update this page and state the date of the last revision. Where the change is substantial, we will let you know through the contact details we hold.