Privacy policy
Last updated: October 16, 2026 · v1
This translation is for information only. If there is any difference, the Spanish version prevails.
This policy explains how we process the personal data of the businesses that use Premzo and of the people in their teams (owners, administrators and employees). It also covers people who visit our website or reserve a founder spot.
The data of each business's end clients(the people who receive a loyalty card) is processed by each business as controller. Premzo only acts as processor on behalf of the business. For that data, please see the business's privacy notice.
Basic information
| Heading | Summary |
|---|---|
| Controller | Manuel Ortega Galiano (Xyvenza), owner of Premzo |
| Purpose | To provide the Premzo service, manage the account, security and subscription, let you know about the launch if you reserve a spot, and answer your queries |
| Legal basis | Performance of the contract, consent (spot reservation), legal obligation and legitimate interest (security) |
| Recipients | Technology providers acting on our behalf. Some are outside the EEA, with appropriate safeguards |
| Rights | Access, rectification, erasure, objection, restriction and portability. You can lodge a complaint with the AEPD |
1. Data controller
- Owner: Manuel Ortega Galiano, self-employed professional (trade name Xyvenza)
- NIF (Spanish tax ID): 77379966P
- Address: Calle Dámaso Torres 25, 18800 Baza (Granada), España
- Contact and privacy email: hola@premzo.app
- Data protection officer: not appointed
2. What data we process
Business account data. Trade name, plan subscribed to, start date and status of the subscription.
Team user data. Email, password (we only store an encrypted hash, never the password itself), role in the business (owner, administrator or employee), email verification date and invitations received or sent.
Security data. If you turn on two-step verification, the authenticator secret (encrypted) and the recovery codes. Session identifiers. IP address and email used in sign-in, sign-up or password recovery attempts, to limit abusive attempts.
Usage data. A log of the actions carried out in the app (for example, stamps added or cancelled, redemptions, invitations or plan changes), with the user who performed them.
Device data. The push notification token of your phone, if you turn them on. Technical information about app errors, with the user and business identifiers.
We do not ask for your name, date of birth or any special category data.
3. Founder spot reservation
Before Premzo launches, you can reserve a founder spot on our website. The terms of the offer are set out in the founder price conditions.
- Data: your email, the name of your business and the plan you are interested in (the last two are optional), and the version of the privacy text you accepted, with the date and time you did so. We do not store your IP address.
- Purpose: to let you know by email when Premzo is available and to keep your founder price.
- Legal basis: your consent (Art. 6(1)(a) GDPR), which you give when you submit the form and confirm with the link we email to you.
- Retention: confirmed reservations are kept until the launch and the 30 days you have to activate your account after the notice, or until you unsubscribe. Unconfirmed reservations, whose link expires after 7 days, are deleted periodically.
- Recipients: Mailtrap (sending emails), Hetzner (servers) and Backblaze (backups), with the safeguards described in section 6.
- Unsubscribing: you can withdraw your consent at any time using the unsubscribe link included in every email, or by writing to us. Unsubscribing deletes your reservation.
4. What we use the data for and on what legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Creating and managing the account, the team and the subscription; providing the service | Performance of the contract (6(1)(b)) |
| Sending the necessary emails: verification, password recovery, invitations and welcome | Performance of the contract (6(1)(b)) |
| Sending push notifications about the business’s activity | Performance of the contract (6(1)(b)). You can turn them off on your phone |
| Letting you know about the launch and keeping your founder price | Consent (6(1)(a)) |
| Protecting accounts: two-step verification, attempt limits and activity log | Legitimate interest in the security of the service (6(1)(f); recital 49) |
| Detecting and fixing technical errors | Legitimate interest in the proper functioning of the service (6(1)(f)) |
| Invoicing and accounting and tax obligations | Legal obligation (6(1)(c)) |
| Answering your queries | Performance of the contract or legitimate interest (6(1)(b), 6(1)(f)) |
We do not make automated decisions with legal effects on you, nor do we carry out profiling. We do not send you marketing communications without your prior consent.
5. How long we keep the data
- Account and team: while the account is active. After closure, we keep the data for 30 days and then erase it, except what we must keep by law.
- Invoicing: the period required by tax and commercial law (generally 6 years, Art. 30 of the Spanish Commercial Code, Código de Comercio).
- Activity log: 730 days.
- Sessions: access expires after 15 minutes and the renewable session after 14 days. Verification links expire after 24 hours and password recovery links after one hour.
- Sign-in attempt limits: deleted 24 hours after the monitoring period ends.
- Error reports: as long as needed to analyse and fix each error, on our own error logging server.
- Founder spot reservations: as described in section 3.
- Backups: we make a daily backup and keep the latest 14.
6. Who we share the data with
We do not sell or transfer your data. Only the providers who provide services to us and act as processors under contract have access to it:
| Provider | Service | Location and safeguards |
|---|---|---|
| Hetzner Online GmbH | Server and database hosting | Falkenstein, Germany (EU) |
| Hetzner Online GmbH | Our own error logging server | Nuremberg, Germany (EU) |
| Backblaze, Inc. | Backups (Backblaze B2, eu-central region) | Amsterdam, Netherlands (EU). Daily backups; the latest 14 are kept |
| Mailtrap (Railsware Products Studio LLC) | Sending emails | USA. EU-US Data Privacy Framework and standard contractual clauses |
| 650 Industries, Inc. (Expo) | Push notifications to the mobile app | USA. See section 7 |
| RevenueCat, Inc. | Management of subscriptions purchased in the app | USA. See section 7 |
If you subscribe from the app, payment is handled by Apple (App Store) or Google (Google Play) as controllers of their own processing, under their own terms.
We may also disclose data to authorities, judges and courts when required by law.
7. International transfers
Some providers are in the United States or may access the data from there. In those cases the transfer relies on the EU-US Data Privacy Framework (when the provider is certified) or on the European Commission's standard contractual clauses. You can ask us for a copy of these safeguards by writing to hola@premzo.app.
8. Your rights
You can exercise the following rights at any time:
- Access: find out what data we process.
- Rectification: correct inaccurate data.
- Erasure: ask us to delete your data.
- Objection: object to processing based on legitimate interest.
- Restriction: ask us to suspend processing in certain cases.
- Portability: receive your data in a structured format.
- Withdraw consent, where processing is based on it, without affecting prior processing.
How to exercise them. Write to hola@premzo.app from the email of your account or reservation, or by post to Calle Dámaso Torres 25, 18800 Baza (Granada), España, stating the right you are exercising. If we have doubts about your identity, we may ask you for additional information. We will reply within one month, which may be extended by two further months in complex cases (Art. 12(3) GDPR).
Complaints. If you believe we have not handled your request properly, you can lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
9. Security
We apply appropriate technical and organisational measures. These include: encrypted communications (HTTPS), passwords stored with a strong hashing algorithm, optional two-step verification, separation of each business's data, role-based permission control, attempt limits, an activity log and daily backups.
10. Cookies and storage on the website
The public pages of the website (the home page, the reservation and these texts) do not set cookies. We do not use analytics or advertising cookies, or tracking pixels. If we ever add them, we will ask for your consent first.
The business dashboard only uses the technical elements needed to sign in and keep the session open:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| premzo_access_token | First-party cookie (HttpOnly) | Keep you signed in | 15 minutes |
| premzo_refresh_token | First-party cookie (HttpOnly) | Renew the session without signing in again | 14 days |
| premzo_user | Local storage | Show the session email | Until you sign out |
| premzo_business_id | Local storage | Identify the active business | Until you sign out |
These elements are exempt from consent (Art. 22.2 LSSI-CE) because they are strictly necessary for the service you request.
11. Changes to this policy
We may update this policy. If the change is significant, we will tell you by email or in the app before it takes effect.