Continue
BoostMediaSocialBoostMediaSocial

Privacy policy

Information on the processing of personal data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Data controller

Tomás Rodenas Marchante, NIF 53761327T, registered at C/ Germanies 32, 46900 Torrent, España. Contact address for any privacy matter: support@boostmediasocial.com.

What data is processed

Only the data needed to provide the service and to meet the associated legal obligations is processed.

  • Email address, essential for sending the receipt and the order tracking link.
  • Name and billing details, only if the customer provides them for the invoice.
  • Order data: service purchased, quantity, amount, and the public username or destination link.
  • Technical security data: IP address, user agent and timestamp, linked to the order and to sign-in.
  • Password, if the customer creates an account. Stored hashed with bcrypt and not reversible.

Purposes and legal bases

Performance of the contract (art. 6.1.b GDPR): processing the order, delivering it, handling the refill guarantee and providing support. Without this data the service cannot be provided.

Legal obligation (art. 6.1.c): issuing and keeping invoices and accounting records, and responding to requests from competent authorities.

Legitimate interest (art. 6.1.f): payment fraud prevention and account security. The balancing test for this interest is documented and available on request.

Consent (art. 6.1.a): marketing communications, only where the customer has opted in. Consent can be withdrawn at any time without affecting the service purchased.

Recipients

Data is disclosed solely to the providers needed to deliver the service, all of them bound by a data processing agreement under article 28 GDPR:

  • Stripe Payments Europe, Ltd. (Ireland), to process payment and issue the invoice. Card details are provided directly to Stripe and never pass through our systems.
  • Delivery providers in the sector, who receive only the public destination detail (username or link) and the quantity. They never receive the customer’s email, name or payment data.
  • Email provider, for sending transactional messages.
  • Hosting provider, within the European Economic Area.

International transfers

Hosting and the database are located within the European Economic Area. Some delivery providers may be established outside the European Union; in that case the transfer relies on the standard contractual clauses approved by the European Commission and is limited to the public destination detail and the quantity purchased.

Retention periods

Order data is kept for the duration of the relationship and then blocked for the applicable limitation periods: four years for tax obligations and six years for commercial accounting obligations.

Account data is kept while the customer keeps the account open. Technical security data is kept for twelve months. Data processed on the basis of consent is deleted when consent is withdrawn.

Your rights

Customers may exercise their rights of access, rectification, erasure, objection, restriction of processing and portability by writing to support@boostmediasocial.com, stating the right being exercised. Requests are handled within one month at most.

If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos): https://www.aepd.es.