Privacy policy

1. Identification of the Controller

In accordance with Article 13 of the GDPR, the controller of personal data collected through the Agendalo Platform is:

Company name: Agendalo AI, S.L.

Trading name: Agendalo

Website: https://agendalo.net

General email: info@agendalo.net

Data protection email: info@agendalo.net

2. Data Protection Officer (DPO)

Agendalo has designated a data protection contact to handle all inquiries about personal data processing and the exercise of rights. You can contact our privacy lead at:

Email: info@agendalo.net

Agendalo shall periodically assess whether it must formally appoint a Data Protection Officer under Article 37 of the GDPR, taking into account changes in the volume and nature of the data processed.

3. Scope and Agendalo's Dual Role in Processing

This Privacy Policy applies to personal data processing carried out by Agendalo in the following contexts:

Role 1 — Agendalo as Controller

Agendalo acts as controller for the data of its own customers (businesses subscribing to the service), users accessing the platform on those businesses' behalf, and visitors to its website. This Privacy Policy primarily governs this role.

Role 2 — Agendalo as Processor

When Agendalo's customers (beauty businesses) use the Platform to manage their own end clients' (consumers') data, Agendalo acts as processor , processing that data solely on behalf of and on instructions from the business customer (controller). This role is governed by the Data Processing Agreement (DPA) in Annex I to the T&C and Section 6 of this Policy.

4. Categories of Personal Data Processed (Controller Role)

As controller, Agendalo collects and processes the following categories of personal data:

4.1. Identification and Contact Data of the Business Customer and Its Users

First and last name of the business representative/administrator.
Trading name and business details (legal name, CIF/NIF tax number and registered tax address).
Email address.
Contact phone number.
Username and password (hashed, never in plain text).
Billing and credit/debit card details (handled by our PCI DSS-certified payment provider; Agendalo does not store complete card details).

4.2. Usage and Technical Data

IP address and approximate geolocation data.
Web browser type and version.
Operating system and device used.
Access logs and activity on the Platform.
Pages visited, features used and usage time.
Performance metrics and technical diagnostics.
Account settings and preferences.
Cookies and tracking technologies (see Section 13).

4.3. Communications Data

Content of technical support or customer service communications with Agendalo.
History of support requests and incident resolution.
Responses to satisfaction surveys or feedback forms (if the Customer chooses to participate).

4.4. WhatsApp Module Data (Configuration)

Phone number linked to the Customer's WhatsApp Business account.
WhatsApp Business API access tokens (stored encrypted).
Automation settings, message templates and conversation flows created by the Customer.

Note on special categories: In managing its own platform, Agendalo does not request or store special categories of data under Article 9 of the GDPR (health data, ethnic origin, religious beliefs, etc.) of its business customers or users. If a business customer chooses to enter their end clients' health data (e.g., in medical aesthetic treatment notes), they do so at their sole responsibility and must have an appropriate legal basis under Article 9 of the GDPR.

5. Processing Purposes and Legal Bases

Agendalo processes its business customers' and users' personal data for the following purposes, relying on the legal bases indicated:

Purpose	Legal basis (Art. 6 GDPR)
Subscription agreement management: account registration, configuration, maintenance and support.	Art. 6(1)(b) — Performance of a contract
Billing, subscription fee collection and payment management.	Art. 6(1)(b) — Performance of a contract / Art. 6(1)(c) — Compliance with a legal obligation (tax)
SaaS service provision: technical operation of the Platform.	Art. 6(1)(b) — Performance of a contract
Technical support and customer service.	Art. 6(1)(b) — Performance of a contract
Service communications (notifications about changes, incidents and maintenance).	Art. 6(1)(b) — Performance of a contract / Art. 6(1)(f) — Legitimate interests
Platform security: detection and prevention of fraud, unauthorized access and abusive use.	Art. 6(1)(f) — Legitimate interests (platform security and customer protection)
Service improvement: analysis of Usage Data to develop features and optimize the Platform.	Art. 6(1)(f) — Legitimate interests (product improvement)
Training and improvement of Artificial Intelligence models with anonymized or pseudonymized data.	Art. 6(1)(f) — Legitimate interests (product improvement) [anonymized data: outside the scope of the GDPR]
Commercial and marketing communications about new Agendalo features, plans or offers.	Art. 6(1)(a) — Consent (for first contact) / Art. 6(1)(f) — Legitimate interests (for existing customers, under Art. 21.2 LSSICE)
Compliance with legal obligations: tax, accounting and requests from competent authorities.	Art. 6(1)(c) — Compliance with a legal obligation
Production of industry statistics and market studies (always using aggregated and anonymized data).	GDPR not applicable (anonymized data) / Art. 6(1)(f) — Legitimate interests (non-anonymized usage data)

Legitimate interests: Where we rely on legitimate interests for processing (Art. 6(1)(f) GDPR), we have balanced our interests against data subjects' rights and freedoms, concluding that those interests do not override the rights of the individuals concerned. You may object to this processing at any time (see Section 10).

6. End Client Data Managed through the Platform (Processor Role)

6.1. Business customers using Agendalo to manage their own client base (consumers of their beauty or aesthetics services) enter those end clients' personal data into the Platform. This data may include name, phone number, email address, appointment history, service preferences, treatment notes and WhatsApp messages.

6.2. For this data, Agendalo acts exclusively as processor under Article 28 of the GDPR. The business customer is the controller and determines the purposes and means of processing.

6.3. Processing instructions. Agendalo shall process end clients' personal data only in accordance with the business customer's documented instructions, as specified in the Data Processing Agreement (DPA) and the settings established on the Platform by the business customer.

6.4. Processing purposes as processor. Agendalo shall process end clients' data exclusively to:

Allow the business customer to manage their appointment calendar and client base.
Automate communications with end clients through the WhatsApp Module where configured by the business customer.
Generate business analysis and statistics for the business customer.
Provide technical support to the business customer in connection with their data.
Ensure the security and integrity of stored data.

6.5. Prohibition on use for own purposes. Agendalo shall not use end clients' data for its own purposes outside the instructions of the business customer acting as controller, except for anonymization or aggregation as described in Article 8 of the T&C, or where legally required.

6.6. Information to end clients. The business customer (controller) is solely responsible for informing their end clients about the use of the Agendalo Platform to manage their data under Article 13 of the GDPR, and for obtaining the necessary legal bases for processing (including sending automated WhatsApp messages).

7. Data Retention Periods

Personal data shall be retained for the following periods:

Data category	Retention period	Justification
Subscription agreement data (business details and administrator contact details)	For the term of the agreement + 5 years after termination	Limitation period for civil actions (Art. 1964 Civil Code) and tax obligations (Arts. 66–70 General Tax Act)
Billing data and accounting documentation	6 years from invoice issuance	Art. 30 Commercial Code / Art. 70.1 General Tax Act
Usage Data and technical logs	12 months from generation (except for active security incidents)	Legitimate interests (security) and Law 25/2007 on the retention of communications data
Business end clients' data (processor role)	Term of the agreement + 30-day grace period for export, followed by permanent deletion	Art. 28(3)(g) GDPR — processor's obligation to delete or return data to the controller
Customer support communications	3 years from ticket closure	Legitimate interests (service quality and documentation)
Data for sending commercial communications	Until consent is withdrawn or an objection is made, plus 3 years to document it	LOPDGDD / LSSICE

Once the specified periods expire, data shall be securely and irreversibly deleted or, where appropriate, anonymized for statistical use.

8. Recipients and Disclosure of Data to Third Parties

8.1. Agendalo does not disclose or sell personal data to third parties for their own purposes, except where provided for by law or with the data subject's express consent.

8.2. Subprocessors. To provide the service, Agendalo relies on third-party technology service providers (subprocessors) that may access personal data as processors or subprocessors. Agendalo guarantees that these providers offer sufficient safeguards under the GDPR. The main subprocessors are:

Provider / Category	Purpose	Location
Cloud infrastructure provider (hosting and databases)	Platform hosting and data storage	EU / EEA
Meta Platforms, Inc. (WhatsApp Business API)	Transmission of WhatsApp messages	USA (see Section 9)
Payment gateway provider (PCI DSS certified)	Payment processing and billing	EU / EEA
Transactional email service provider	Sending notification, support and marketing emails	EU / EEA or USA (with appropriate safeguards)
AI model provider (third-party LLMs, if applicable)	Generation of automated natural language responses	Varies (with appropriate safeguards)
Analytics and technical monitoring tools	Performance monitoring and error detection	EU / EEA or with appropriate safeguards

8.3. Agendalo may also disclose personal data to competent authorities (AEPD, tax authorities, law enforcement agencies and courts) where legally required.

8.4. In the event of a merger, acquisition, corporate restructuring or asset sale affecting Agendalo, personal data may be transferred to the resulting entity, which shall be required to process the data in accordance with this Privacy Policy or notify data subjects of any material change.

9. International Data Transfers

9.1. Some providers working with Agendalo (primarily Meta Platforms, Inc. for the WhatsApp Business API service, and certain AI model providers) are located outside the European Economic Area (EEA), primarily in the United States of America.

9.2. Agendalo guarantees that any international transfer of data to countries that do not provide an adequate level of protection according to the European Commission is carried out with the appropriate safeguards required by Chapter V of the GDPR, in particular through:

Standard Contractual Clauses (SCCs) adopted by the European Commission (Implementing Decision (EU) 2021/914), which establish legally binding data protection obligations between the data exporter and importer.
EU–U.S. Data Privacy Framework , where the receiving provider is certified under that framework, adopted by the European Commission's Adequacy Decision of July 10, 2023.

9.3. In particular, for the use of Meta Platforms, Inc.'s WhatsApp Business API, data transfers are covered by the SCCs and/or the EU–U.S. Data Privacy Framework. The Customer is informed that Meta Platforms, Inc. may process WhatsApp communication metadata in accordance with its own privacy policies.

9.4. Data subjects may request additional information about the safeguards applicable to international transfers by contacting us at info@agendalo.net.

10. Data Subjects' Rights

Under Articles 15 to 22 of the GDPR and Articles 13 to 18 of the LOPDGDD, data subjects whose personal data is processed by Agendalo as controller have the right to:

Right of Access (Art. 15 GDPR)

Know which of their personal data is being processed, the purposes, categories, recipients, retention periods and source of the data.

Right to Rectification (Art. 16 GDPR)

Request correction of inaccurate or incomplete personal data.

Right to Erasure / “Right to Be Forgotten” (Art. 17 GDPR)

Request deletion of their personal data where, among other circumstances, it is no longer necessary for the purpose for which it was collected, consent is withdrawn or the data has been unlawfully processed.

Right to Restriction of Processing (Art. 18 GDPR)

Request suspension of processing in certain circumstances (disputed accuracy, unlawful processing, data needed for legal claims, etc.).

Right to Data Portability (Art. 20 GDPR)

Receive their data in a structured, commonly used and machine-readable format and transmit it to another controller where processing is based on consent or the performance of a contract.

Right to Object (Art. 21 GDPR)

Object to processing based on legitimate interests or the performance of a task in the public interest, and to processing for direct marketing purposes.

Right Not to Be Subject to Automated Decisions (Art. 22 GDPR)

Not be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects them. See Section 14.

Right to Withdraw Consent (Art. 7(3) GDPR)

Where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.

How can you exercise your rights?

You may exercise any of the above rights by sending a written request to:

Email: info@agendalo.net

The request must include: first and last name, the email address registered to the account, a copy of an identity document (DNI/NIE/passport) and a clear description of the right you wish to exercise. Agendalo shall respond within one month of receiving the request (extendable to three months in complex cases, with prior notice to the data subject).

Important for businesses' end clients: If you are a client of a business using Agendalo (e.g., a beauty salon) and wish to exercise your rights over data managed by that business, you must address your request directly to the business, which is the controller. As processor, Agendalo shall assist the business in handling the request under the DPA.

11. Technical and Organizational Security Measures

Agendalo applies appropriate technical and organizational security measures under Article 32 of the GDPR, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing, as well as risks to natural persons' rights and freedoms. These measures include:

Encryption

Encryption in transit using TLS/SSL (HTTPS).
Encryption at rest of sensitive data (bcrypt-hashed passwords and API tokens).
Database encryption at the cloud infrastructure provider.

Access Control

Robust authentication with secure passwords and PINs.
Application-level role-based access control (RBAC).
Production system access restricted to authorized personnel.

Availability and Integrity

Regular automated backups.
Infrastructure redundancy to ensure service continuity.
Continuous Platform monitoring and anomaly alerts.

Incident Management

A documented security breach management procedure.
Notification to the AEPD within 72 hours of becoming aware of a breach, under Art. 33 GDPR.
Notification to affected individuals where a breach poses a high risk, under Art. 34 GDPR.

Notwithstanding the above, no security system is completely infallible. Agendalo cannot guarantee absolute data security, but commits to taking all reasonable and proportionate measures to protect it.

12. Children's Data

12.1. The Agendalo Platform is intended exclusively for professional and business (B2B) use. Registration and contracting for the service are restricted to persons over 18 or legal entities represented by persons over 18. Agendalo does not knowingly collect data from persons under 18 as customers or users of its platform.

12.2. For end client data managed by business customers (processor role), the business customer (controller) is responsible for ensuring that children's data is processed with the consent of the holder of parental responsibility or guardianship, in accordance with Article 8 of the GDPR and Article 7 of the LOPDGDD (age of digital consent: 14 in Spain).

12.3. If Agendalo becomes aware that it has inadvertently collected a child's data without appropriate authorization, it shall delete it immediately.

13. Cookie Policy

13.1. What are cookies? Cookies are small text files stored on a user's device when they visit a website. They allow the website to remember information about the visit (preferences, signed-in session, etc.).

13.2. Types of cookies used by Agendalo:

Type	Purpose	Legal basis
Technical / essential cookies	Necessary for the Platform to function (session management, authentication and interface preferences). They cannot be disabled.	Art. 6(1)(b) GDPR — Contractual necessity / Art. 22.2 LSSICE — exempt from consent
Analytics / performance cookies	Collect information about Platform use to improve its operation (pages visited, loading times and errors).	Art. 6(1)(a) GDPR — Consent
Preference / functional cookies	Remember user preferences (language and interface settings).	Art. 6(1)(a) GDPR — Consent
Marketing / advertising cookies	Track user behavior to personalize communications and advertisements (if applicable).	Art. 6(1)(a) GDPR — Express consent

13.3. Users may configure their browser to reject or delete cookies. However, disabling technical cookies may affect the Platform's proper operation. Cookie management instructions vary by browser.

13.4. Agendalo provides a cookie consent banner in accordance with the AEPD's guidance on cookies, allowing users to configure their preferences when first visiting the website.

14. Artificial Intelligence and Automated Decisions

14.1. The Agendalo Platform incorporates Artificial Intelligence (AI) systems to automate responses to end clients through WhatsApp, optimize appointment scheduling and provide analysis and recommendations to business customers, among other purposes.

14.2. For Platform users (business customers and their employees), Agendalo does not make decisions producing legal effects or significantly affecting them based solely on automated processing of their data, in accordance with Article 22 of the GDPR.

14.3. Responses generated by Agendalo's AI within the WhatsApp Module are automation tools controlled and configured by the business customer. As controller, the business customer determines the scope and limits of automation in communications with their end clients and must ensure transparency towards them.

14.4. Agendalo may use anonymized or pseudonymized usage data to train and continuously improve its AI models, as established in Article 8 of the T&C. Identifiable end client personal data shall never be used for AI training without express instructions from the controller.

14.5. Algorithmic transparency. Agendalo recognizes the importance of transparency in AI use. At the Customer's request, Agendalo shall provide general information about the logic of AI systems that may affect them, as required by applicable law, including Regulation (EU) 2024/1689 on Artificial Intelligence (EU AI Act) as it enters into force.

15. WhatsApp Module: Processing Messages and Communications

15.1. When a business customer activates the WhatsApp Module, messages exchanged between the business and its end clients through WhatsApp are processed by Agendalo's infrastructure to enable automation and conversation logging.

15.2. Agendalo stores the content of WhatsApp conversations managed through the Platform on behalf of the business customer (as processor) to: (i) allow the business to supervise conversations; (ii) ensure traceability of the booking process; (iii) improve AI response quality (using anonymized data).

15.3. The business customer (controller) is responsible for informing end clients about the use of automated systems (AI) to manage their WhatsApp messages and for obtaining the necessary legal bases for that processing under the GDPR.

15.4. Agendalo does not systematically read or monitor WhatsApp message content for its own purposes beyond those described in this Policy, except for security, technical support requested by the business customer or requests from a competent authority.

16. Changes to the Privacy Policy

16.1. Agendalo reserves the right to update this Privacy Policy at any time to reflect regulatory changes, case law, industry practices or Platform features. Customers shall be notified of changes by email or a prominent notice on the Platform at least 30 calendar days before they take effect.

16.2. The current version of the Privacy Policy shall always be available at agendalo.net/politica-de-privacidad . We recommend reviewing it periodically.

17. Complaints to the Supervisory Authority

17.1. Without prejudice to any other administrative remedy or legal action, data subjects have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) , Spain's competent supervisory authority for personal data protection, if they consider that the processing of their personal data infringes the GDPR or LOPDGDD.

Spanish Data Protection Agency (AEPD)

C/ Jorge Juan, 6 · 28001 Madrid

Website: www.aepd.es

Electronic office: sedeagpd.gob.es

17.2. Before lodging a complaint with the AEPD, we invite you to contact us at info@agendalo.net to try to resolve the matter promptly and satisfactorily.

Version: 1.0 | Effective date: March 30, 2025

For inquiries about this Privacy Policy or the processing of your personal data: info@agendalo.net

Table of Contents