Effivis Privacy Policy

At EFFIVIS TECHNOLOGIES S.L. ("Effivis"), we process personal data responsibly and transparently, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). This policy explains how we collect, process and protect the personal information you provide.

1. Data Controller

EFFIVIS TECHNOLOGIES S.L.
Tax ID (CIF): B23839962
Address: C/ Zurbano 49, Bajo – Oficina 4, 28010 Madrid, Spain
Contact: [email protected]

2. Purposes of Processing

The personal data you provide will be processed for the following purposes:

• Managing and responding to information requests or enquiries.
• Delivering the services contracted through the Effivis platform.
• Managing your user account and the contractual relationship.
• Processing payments and invoicing.
• Sending commercial communications (only with your consent).
• Complying with legal and tax obligations.
• Improving our services through anonymised statistical analysis.

3. Legal Basis

• Consent (GDPR Art. 6.1.a): for marketing communications and analytical cookies.
• Performance of a contract (Art. 6.1.b): to provide the contracted services and manage your account.
• Legal obligation (Art. 6.1.c): to comply with tax and accounting obligations.
• Legitimate interest (Art. 6.1.f): to safeguard platform security and prevent fraud.

4. Data Retention Periods

We keep personal data for the time necessary to fulfil the purpose for which it was collected and to determine any potential liabilities. Detailed retention tables are available in the Spanish original.

5. Data Processors

We share data with the following providers acting as Data Processors under our instructions and in compliance with the GDPR: AWS (EU hosting), Cloudflare (DNS/CDN), Stripe (payments, US, SCCs + DPA), Twilio, OpenAI, Google Cloud, Microsoft, Meta Platforms and Zendesk (all US, SCCs + DPA).

6. International Transfers

Where providers are outside the European Economic Area, we use Standard Contractual Clauses (SCCs) approved by the European Commission, signed Data Processing Agreements (DPAs), and additional technical measures (TLS 1.3 in transit, AES-256 at rest, pseudonymisation where possible).

7. Your Rights

You can exercise at any time your rights to:

• Access — know what data we process.
• Rectification — correct inaccurate or outdated data.
• Erasure (right to be forgotten) — where data is no longer necessary or you withdraw consent.
• Restriction of processing in specific circumstances.
• Objection to processing based on legitimate interest.
• Portability — receive your data in a machine-readable format.

To exercise them, email [email protected] with subject "Data Protection" and a copy of an ID document. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Information Security

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Per-tenant data isolation via Row-Level Security (RLS).
• Multi-factor authentication (MFA) available.
• Periodic security audits and continuous monitoring.
• Least-privilege access policies.

9. Cookies

This site uses first-party and third-party cookies that are strictly necessary for it to function and, upon consent, analytical cookies (Google Analytics 4 with IP anonymisation). You may withdraw consent at any time by clearing cookies in your browser or installing the Google opt-out add-on at tools.google.com/dlpage/gaoptout.

10. Messaging Data (WhatsApp/Instagram/Facebook)

If you have interacted with a business through WhatsApp Business, Instagram Direct or Facebook Messenger using our platform, the conversation data is controlled by that business as Data Controller. Effivis acts as a Data Processor on their behalf in compliance with the GDPR. See our data deletion instructions for details.

11. Updates

Effivis may update this Policy to reflect changes in regulation, technology or our services. Updates are published on this page with the effective date. For material changes, registered users will be notified by email.

12. Contact