Privacy policy

This Privacy Policy governs the processing of personal data carried out by Bouzon Digital through the website www.bouzondigital.com, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD).

1. Data controller

• Controller: Pablo Bouzon, doing business under the trade name Bouzon Digital.
• Spanish NIE: Z0115635L
• Address: Av. Gamonal 4, 29630 Benalmádena (Málaga), Spain
• Email: [email protected]

For any matter concerning the processing of your personal data you may contact the controller at the email above. A Data Protection Officer (DPO) is not required under article 37 GDPR.

2. Data we collect and purposes

Source	Data	Purpose
Contact form	Name, email, phone (optional), message, project subject	Reply to the enquiry and, where applicable, prepare a commercial proposal
Onboarding form	Business data (name, address, phone), contact details of the owner, files (logo, photos, menu), service preferences	Onboard the client and provision the contracted services
Public support chat	Messages exchanged, language, source page	Resolve pre-sale questions and guide the user to the right service
Subscriptions / payments	Identification and bank/card data provided to the GoCardless or Stripe payment gateway	Manage invoicing and collection of the contracted service
Web analytics (with consent)	Technical browsing data (URL, event, viewport, referrer, anonymous session ID)	Understand how the site is used and improve experience
Marketing (with consent)	Pixel identifier, interest events (visits, clicks, form starts)	Optimise advertising campaigns and build retargeting audiences

3. Legal basis

• Consent of the data subject (art. 6.1.a GDPR) for the contact and onboarding forms, the chatbot, analytics cookies and marketing cookies.
• Performance of a contract (art. 6.1.b GDPR) for managing the contracted service, invoicing and support.
• Legal obligations (art. 6.1.c GDPR) in tax, accounting and fraud-prevention matters.
• Legitimate interest (art. 6.1.f GDPR) for maintaining site security, preventing abuse and handling pre-contractual enquiries.

4. Retention periods

• Pre-sale enquiries without a contract: up to 2 years from the last contact, unless the data subject requests earlier erasure.
• Client data: for the duration of the contractual relationship and, after termination, for the applicable legal periods: up to 6 years for commercial documentation (Spanish Commercial Code, art. 30) and up to 4 years for tax obligations (Spanish General Tax Law, art. 66).
• Analytics data: up to 25 months (Microsoft Clarity default). The anonymous session ID is only linked to an email when the user provides it in a form.
• Marketing data: up to 13 months (Meta Pixel) or until consent is withdrawn.

After these periods data is deleted or anonymised, unless a legal obligation requires further retention.

5. Processors (third parties processing data on our behalf)

To provide the service we rely on the following processors, each under a written data processing agreement compliant with article 28 GDPR. Unless otherwise stated, servers are located in the European Economic Area (EEA):

Processor	Purpose	Location
Hetzner Online GmbH	Server hosting	Germany (EU)
Cloudflare, Inc.	CDN, DDoS protection, DNS resolution	USA — DPF
Resend, Inc.	Transactional email and notifications	USA — DPF
Sendinblue SAS (Brevo)	Transactional email when the primary provider's daily quota is exhausted	France (EU)
Soluciones Corporativas IP, S.L. (DonDominio)	Domain registration and professional email hosting (when contracted)	Spain — EU
Microsoft Corporation (Clarity)	Cookieless web analytics	USA — DPF
Meta Platforms Ireland Ltd.	Ad Pixel and Conversions API (marketing consent only)	Ireland (EU) / USA — DPF
GoCardless Ltd.	SEPA direct-debit and subscription management	United Kingdom (Adequacy Decision)
Stripe Payments Europe Ltd.	Card payment gateway (online shop or deposits, when contracted)	Ireland (EU) / USA — DPF
Google Ireland Ltd. (reCAPTCHA, optional)	Anti-spam form protection	Ireland (EU) / USA — DPF
Google Ireland Ltd. (Google Maps Platform)	Geocoding of the delivery address and route and arrival-time calculation for deliveries, when the main provider fails	Ireland (EU) / USA — DPF
Google Ireland Ltd. (Gemini)	Public chatbot, and description of images and transcription of audio received via WhatsApp	Ireland (EU) / USA — DPF
Anthropic, PBC	AI model for the public chatbot and for the WhatsApp technical-support assistant, including the technical data returned by the apps in section 15	USA (see section 6)
Groq, Inc.	Transcription of voice notes received via WhatsApp	USA (see section 6)
HeiGIT gGmbH (OpenRouteService)	Route and estimated-arrival-time calculation for deliveries	Germany (EU)
OpenStreetMap Foundation (Nominatim)	Geocoding of the delivery address for home-delivery orders	United Kingdom (Adequacy Decision)

6. International transfers

Some of the above processors handle data in the United States. Bouzon Digital relies on the EU-US Data Privacy Framework (European Commission Adequacy Decision of 10 July 2023) where the processor is certified, or on Standard Contractual Clauses (Decision 2021/914) otherwise. Transfers to the United Kingdom rely on the Adequacy Decision of 28 June 2021.

7. Recipients

Your data is not shared with third parties other than the processors listed above, except:

• Under a legal obligation (tax, judicial or supervisory authorities).
• With your express consent for a specific purpose.

Bouzon Digital does not sell or rent personal data to third parties for advertising.

8. Automated decision-making and profiling

Bouzon Digital does not take automated decisions with legal or significant effects on users, nor does it carry out profiling with that scope. Marketing cookies may use standard ad-segmentation, but no algorithm decides on contracting, pricing or service provision without human intervention.

9. Minors

The services and website are aimed at professionals and businesses (B2B). We do not knowingly process data of minors under 14. If we detect such processing it will be deleted immediately.

10. Your rights

As a data subject you may exercise the following rights at any time by emailing [email protected] with a copy of a document proving your identity:

• Access — know which of your data we process.
• Rectification — correct inaccurate data.
• Erasure ("right to be forgotten").
• Objection to processing, under the GDPR conditions.
• Restriction of processing.
• Portability of data to another controller.
• Withdrawal of consent, without affecting the lawfulness of prior processing.

If you believe your rights have not been properly addressed, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es, C/ Jorge Juan 6, 28001 Madrid.

11. Security measures

We apply technical and organisational measures appropriate to the risk: encryption in transit (TLS), encrypted daily backups, minimum necessary access controls, records of processing activities and breach-management procedures pursuant to article 33 GDPR.

12. Cookies

See the Cookie Policy for the cookies used and how to manage your consent.

13. Use of YouTube API Services

Bouzon Digital uses YouTube API Services for a single purpose: publishing the video manuals for our software on our own channel, which we then link from the admin panel and from the documentation our clients receive.

When you use the features that display or link to that content, the YouTube Terms of Service apply to you. Information processed by Google through those services is further governed by the Google Privacy Policy.

• What data we handle — only the authorisation credentials (OAuth 2.0) of the Google account that owns our channel, needed to upload our own videos. We do not collect, store or process personal data of YouTube users, nor do we access any third party's account data.
• Retention and deletion — authorisation tokens are stored encrypted and outside the repository, only for as long as the publishing tool is in use, and are deleted when access is revoked or on written request to [email protected].
• Revoking access — you may withdraw the permissions granted to this and any other application at any time from your Google account permissions page.

14. Use of Google Business Profile API Services

For clients who subscribe to the Reviews module, Bouzon Digital uses the Google Business Profile API Services for a single purpose: reading and publishing replies on the client's own Google Business listing, with the permission the client grants by connecting their own Google account.

• What data we handle — the authorisation token (OAuth 2.0, business.manage scope) of the Google account the client connects, and a copy of the public content of their listing: reviews (reviewer name, text and rating), the published reply, and an automatic classification (sentiment and topics) we generate about the content of each review, not about the person who wrote it. We do not access any other Google listing, nor any personal data of the connected account beyond what is needed to identify their business listing.
• Purpose — to display reviews and their statistics in the client's admin panel, draft replies, and, if the client approves it — or enables automatic publishing for positive reviews with no text, an option disabled by default that the client can turn on or off in their settings — publish the reply on their listing. This data is not sold or shared with third parties, and is not used for advertising purposes.
• Retention and encryption — the authorisation token is stored encrypted (AES-256). It is deleted when the listing is disconnected from the panel or on written request to [email protected]; if the connection stops being valid due to a persistent error, the token becomes unusable and is deleted at that same point of disconnection or request. The copy of the reviews is kept for as long as the client has the Reviews module active, and is deleted on written request to the same email address.
• Revoking access — the client may disconnect their listing at any time from their admin panel, and withdraw the permission granted to Bouzon Digital from the Google account permissions page.

Bouzon Digital's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

15. Bouzon Digital apps for Android and Windows

Bouzon Digital offers apps for Android and Windows that the client business uses to access its management panel and connect its receipt and kitchen-order printers. They are intended for the business and its staff, not for the general public. On Windows there are two versions: the windowed app, which opens the panel, and a windowless print agent, which only prints. In addition to what is described in the rest of this policy, the apps process the following data:

• Account and business data — the windowed app opens the Bouzon Digital management panel (admin.bouzondigital.com), where the user signs in with their account. The account data and the data the business manages from the panel are the same as those of the contracted service and are processed under this policy; the app does not use them for any other purpose.
• Start-up and updates — the windowed Windows app starts on its own when the user signs in to Windows, and the Android version installed outside Google Play starts on its own when the device is switched on. Versions not installed from an app store download their updates from Bouzon Digital's servers.
• Printers: local network, Bluetooth and USB — to find and use the business's printers, the app looks for printers on the local network the device is connected to and, on Android, also over Bluetooth and USB (on Windows it also uses the printers installed on the computer itself). The Bluetooth permission is not used to locate the user. When a device acts as the venue's print server, its local-network IP address is sent to Bouzon Digital and shared with the other devices of the same business so they can send it kitchen orders; it is only visible to that business's users and to our support team, and it stops being shown a few minutes after the device stops being active.
• Local server, reachable from the business's network — to receive kitchen orders from other devices in the venue, the app runs a server on port 9876, open to the local network and without a password. Any device connected to the same local network can read at least the following technical data from it: version, technical identifier, the device's role (whether or not it is the print server), its local-network IP addresses, the addresses and status of the printers, the status of the support connection and, on Android, the version of the built-in browser; and, on Android, the names and addresses of paired Bluetooth devices. Depending on the version of the app installed, it can also read the list of printers found (on Android, with the names of connected USB devices) and the app's recent technical log. We recommend connecting these devices to a Wi-Fi network reserved for staff.
• Technical device identifier — each installation uses a stable pseudonymous identifier so we know which printers and which role belong to each device. On Android it is computed as a cryptographic hash (SHA-256) of system identifiers, so it does not change when the app is reinstalled and can be recomputed by anyone who knows those identifiers; if they are not available, it is a random value. On Windows it is a random value. It is not an advertising identifier and is not used to track the user outside the service.
• Precise location (Android only, and only during a delivery) — if the business makes home deliveries, the Android app asks for location permission when the courier starts a delivery and sends the device's position for as long as that delivery lasts, including with the screen locked, so the customer can follow their order. The first point sent may be the last position the device already knew when the delivery started; after that it only sends new positions, and it stops when the delivery ends. The latest position is stored with the order and remains visible on that order's tracking link. The destination is obtained when the order is placed, by converting the delivery address into coordinates with a geocoding service (OpenStreetMap Nominatim or, as a fallback, Google), and to calculate the route and estimated arrival time the coordinates of the courier and of the destination are sent to a routing service (OpenRouteService or, as a fallback, Google). The Windows app does not use location.
• Diagnostics — the app sends Bouzon Digital: roughly every minute, its technical identifier, version and operating system (Android or Windows), so we know whether the device is connected; and, while the panel is open on the device, its technical log (prints, tests and errors, with each printer's name, IP address and port, and rejected access attempts, with the IP address of the local-network device that made them) together with the built-in browser's identifier —which on Android includes the Android version and the device model— and the screen resolution, plus the print server's local-network addresses and which printers respond. This is used to detect and fix faults.
• Technical support — the Bouzon Digital support team, or its automated, AI-powered support assistant (see section 5), can ask the app at any time, with no action on the device, for readings from a closed list: status of the app and the printers; network data (interfaces, IP addresses, gateways, DNS servers and, if the system provides it, the Wi-Fi network name); printer search (on Android, with the names and addresses of paired Bluetooth devices and the names of connected USB devices); connection test to a printer on the local network; technical log; granted permissions and, on Android, whether the app is exempt from battery saving; version of the built-in browser and, on Android, whether Chrome is installed and its version; and the list of printers configured for the business. Actions that change something —printing a test receipt, authorising a USB printer, setting whether the device is the venue's print server, installing an update, adding, editing or deactivating the business's printers and, in the Android app or in the Windows app, starting the remote assistance described in the next points— can only be requested during a temporary support session, which the support team or its assistant opens without confirmation on the device and which expires on its own (after 45 minutes, extendable up to a maximum of 4 hours); once started, the remote assistance follows its own rules for ending, described in the next points (it does not end because this temporary support session expires), and on the Windows app and the Google Play version of the Android app it also requires the business to have turned it on beforehand. Every request and its result are logged. Bouzon Digital uses this channel to handle the issues the business reports to it. Apart from that remote assistance, the apps do not let Bouzon Digital see the screen or operate the device, or run programs or commands outside that list.
• Remote assistance with screen view and control (Android) — during a support session a member of the Bouzon Digital team can ask from their panel to see the device's entire screen live. The automated AI assistant cannot start it. In the Google Play version it is off by default and additionally requires the business to have allowed it beforehand in the app itself: from the "Remote support" section of the app's settings a prominent notice, "Allow remote support", opens, explaining what support can see and do; only if "Allow" is pressed is the permission saved (with its date); with "Not now" nothing is turned on. The permission can be withdrawn from the app at any time: withdrawing it ends any session in progress and none can start. Without that permission, no session starts. The device stores the date the permission was turned on and the date it was last withdrawn. The version installed outside Google Play does not require that prior permission in the app; the rest of the safeguards in this point are the same in both. Android asks for permission on the device to share the screen in every session, and nothing is shared until someone accepts. On Android 9 and earlier, that notice lets the person choose not to show it again, and later support sessions then start without that system notice; the same happens if the permission has been granted permanently with technical device-configuration tools. In every case, the persistent notification and the notices described below are shown. Only video is transmitted, with no sound, directly to the technician's browser (the connection is set up with the help of a public Google server that only sees IP addresses or, if configured, through a relay server), and it is not recorded or stored. While it lasts, a red frame is shown inside the Bouzon Digital app, with the notice "Bouzon Digital support at work — please don't touch the screen" (if the "Bouzon Digital" accessibility service is turned on, the frame covers the whole screen); and at all times, also outside the app, which is still visible to the technician, the device shows a persistent notification, "Bouzon Digital support connected", stating whether support can view the screen or view and operate it; Android also shows its own screen-sharing indicator. It has no duration limit and continues even if the temporary support session has expired, until the technician closes the session, the operating system stops the capture, the device stops responding for 90 seconds, in the Google Play version the permission is withdrawn in the app, or the technician stops watching it (3 minutes; 15 minutes if they never opened it). While taking control from their viewer, the technician can also operate the app: tap, long-press, swipe, scroll, go back, type and delete text in the active text field, if there is one, and send text to the device's clipboard; while in control they can also select text, rotate the app's screen and keep the on-screen keyboard hidden, all of which go back to how they were when control is released; and the text the technician copies or cuts in the app while in control reaches their computer's clipboard (never the contents of a password field). The device sends nothing else from its clipboard. Without further permissions, that control only works inside the Bouzon Digital app itself and while it is in the foreground. If, in addition, the "Bouzon Digital" accessibility service is turned on in the Android settings (an optional, separate step), the control reaches the whole device. The app uses that service only to carry out those actions during a session in which the technician has taken control; in the Google Play version, withdrawing the permission in the app blocks them instantly even if the service remains turned on in Android (to turn it off, use the Android settings). Every session is logged. The Windows app has its own remote assistance, with its own rules, described in the next point.
• Remote assistance with screen view and control (Windows app) — the windowed Windows app (whether downloaded directly or installed from the Microsoft Store; the windowless, headless version of the print agent, meant for advanced setups, does not include it) lets the technician view and operate the device. It is off by default: the business must explicitly turn on the app's own remote-support switch, which requires accepting a native Windows confirmation dialog; turning it off does not ask for confirmation and immediately cuts any session in progress. Without that opt-in, no session can start. Once opted in, a member of the Bouzon Digital support team —never the automated AI assistant, which cannot start it— launches the session from their panel during a temporary support session (see previous point); on Windows the session starts with no further confirmation prompt on the device at that moment. What is shown is the computer's entire main screen, including every window and program open on it, not just the app itself; if the computer has more than one screen, the others are not transmitted. From the device to the technician's browser go the screen image, with no sound, and any text copied on the device while the technician holds control (the connection is set up with the help of a public Google server that only sees IP addresses or, if configured, through a relay server); from the technician to the device, while they hold control, go mouse and keyboard actions and any text they send; none of it is recorded or stored. While it lasts, the device shows a red frame around the screen, with the notice "Bouzon Digital support at work — please don't touch the screen"; that frame stays visible for the whole session, cannot be closed and, while it is not visible, no control is accepted on the device; if it disappears or stops responding, the session ends. Once they take control, the technician can use the computer as if sitting in front of it — opening programs and files, and using the keyboard, including system keys such as the Windows key; while that control lasts, they can also send text to the device's clipboard, and the device in turn sends them whatever text gets copied on it from that point on (checked every 1.5 seconds, capped at 100,000 characters); anything copied before the technician took control is never shared. The session has no duration limit and continues even if the temporary support session has expired; it ends when the technician closes the room, if the opt-in is withdrawn (which cuts it immediately), if the app is closed, if the device stops responding for 90 seconds, or if the technician stops watching it (3 minutes; 15 minutes if they never opened it). Every session is logged by the server and, in addition, in a technical log on the device itself.
• Notifications (Android) — the Android app shows a notification while the print service is active and another while a delivery is in progress, because Android requires it for services running in the background. They are not used for advertising.
• Retention — there is currently no automatic deletion of this data: the technical diagnostic log, the record of support sessions and requests, and the position stored with each order are kept as service data, under the periods set out in section 4. Each device's local-network address and last connection are overwritten with every update.

For the data of the business's staff and customers processed through the apps, such as the courier's location or the orders, Bouzon Digital acts as a processor on behalf of the business, which is the controller (Art. 28 GDPR).

This data is not sold or used for advertising. The Bluetooth, location and notification permissions can be reviewed or withdrawn at any time from the device settings; if they are withdrawn, the features that depend on them stop working.

16. Changes

Bouzon Digital reserves the right to update this Privacy Policy to adapt it to regulatory changes or to the evolution of the service. The "last updated" date appears at the top of the document.