Privacy policy

1. Who is responsible for your data

The controller of your data is Weston Trade SL, the company that provides the cataloop Service. In this policy, "we" means that company (Art. 13(1)(a) GDPR).

• Company name: Weston Trade SL
• CIF (Spanish tax ID): B64950371
• Registered office: Paseo de la Ribera 44, 08870 Sitges (Barcelona)
• Registro Mercantil (the Spanish Commercial Registry) entry: [COMPLETAR CO-04: Commercial Registry entry: volume, folio, sheet and registration]
• Email for privacy matters: privacidad@cataloop.app
• Website: https://cataloop.app

This policy explains how we process personal data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). It is how we meet our duty to inform you (Arts. 13 and 14 GDPR; Art. 11 LOPDGDD). Words with an initial capital have the meaning given to them in the Terms.

2. Our two roles

We process personal data in two different roles, and each has its own rules (Arts. 4(7), 4(8) and 28 GDPR).

• We are the controller of Sellers' data: the Owner and the Team users. We are also the controller of the data of Visitors and of people who write to us. We decide why and how that data is processed.
• We are a processor of Buyer Data. Each Seller decides which data of its Buyers it keeps in its Shop and why. We process that data only on the Seller's behalf and on the Seller's instructions.

Our role as processor is governed by the Data processing agreement (the "DPA"), which forms part of the contract with each Seller.

We also use some Buyer data for a purpose of our own: protecting the Service. That data is the IP address in attempt limits and in server logs, and whatever remains in error reports after they are scrubbed. For those uses we are the controller.

If you are a Buyer: your Seller decides about your data, and its privacy information is in the footer of its Shop. Ask your Seller first. If you write to us instead, we will pass your request on to the Seller and tell you so.

3. What data we process, why, on what basis and for how long

The table summarises each processing activity (Arts. 13(1)(c), 13(1)(d) and 13(2)(a) GDPR). The legal bases are those of Art. 6(1) GDPR. The row marked processor describes data we process on the Seller's behalf.

4. Where the data comes from

You give us almost all the data yourself. The rest comes from these sources (Art. 14(2)(f) GDPR):

• The Owner, who adds Team users and chooses who receives Order emails.
• Stripe, which tells us whether a payment went through or failed.
• The Service itself, which automatically records the IP address of each request.
• The Seller or the Buyer, in the case of Buyer Data.

5. What data you must give us

The signup form fields and the Subscription fields are required (Art. 13(2)(e) GDPR). Without them we cannot create your Shop or charge the Subscription. When you take out a Plan, your registered name and tax ID are required because the law requires them to issue your invoice.

All other data is optional. If you leave it out, some feature may be incomplete, but the Service keeps working.

6. When we rely on legitimate interest

Some processing relies on our legitimate interest (Art. 6(1)(f) GDPR). We have weighed that interest against your rights, and here is the result in one line per activity:

• Owner acting for a company, Team users and email recipients: we use only their business contact details, for the relationship with the Seller (Art. 19 LOPDGDD).
• Support access log: it protects the Seller and us, and holds only work data about our team and the note of the request.
• Security and attempt limits: stopping abuse protects every user and barely affects anyone using the Service normally, and the data is deleted after 24 hours (Recital 49 GDPR).
• Server logs and error reports: without them we cannot keep the Service running or fix faults.
• Internal statistics: they are anonymous counts or counts by ID, with no email addresses.
• Demo shop and preferences: we process the minimum needed for you to try the product and to store your choice.
• Support and feedback: answering people who write to us without being Sellers, and reading the feedback from the Back office.

You can object to any of these activities on grounds relating to your situation (Art. 21 GDPR). We will stop processing your data unless there are compelling legitimate grounds or we need it to defend a legal claim.

7. Who we share your data with

We share data only with those who need it to provide the Service, or when the law requires it:

• Our sub-processors, who host the Service, store the data or send the emails. Their names are on the Sub-processor list.
• Stripe, which handles the Subscription payments. Stripe acts as our processor to provide the payment service, and as an independent controller for its own purposes, such as preventing fraud and meeting its legal obligations. Its privacy policy is at https://stripe.com/privacy.
• Authorities, judges and courts, when a law obliges us.
• Our tax and accounting adviser, for accounting and tax obligations.

We do not sell data. We do not advertise. We use no analytics or tracking tools, and no third-party maps or chats.

A Shop may show a video hosted elsewhere or a WhatsApp link. If you press the video or the link, your browser connects directly to that third party, which processes your data under its own rules.

8. Transfers outside the European Economic Area

Railway, Neon, Cloudflare, Resend, Sentry, Stripe and Google are US companies or part of their groups, and they may process data in the United States even if they store it in the European Union. We allow this only with the safeguards of the GDPR (Arts. 44 to 46 GDPR):

• the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR; Commission Implementing Decision (EU) 2023/1795), to which those companies or their parent companies have signed up;
• in addition, the European Commission's standard contractual clauses, which their contracts include (Art. 46(2)(c) GDPR; Commission Implementing Decision (EU) 2021/914).

If the adequacy decision for the Data Privacy Framework ceased to apply, those transfers would still be covered by the standard contractual clauses.

Bunny is a European Union company. The details for each provider are on the Sub-processor list. You can ask us for a copy of the safeguards at privacidad@cataloop.app.

9. How long we keep your data

As a rule, we keep your account and Shop data while the Subscription or the Free trial is active, and for the 90 days after the Effective cancellation date. If the Free trial ends without your taking out a Plan, we keep it for 90 days from then. After that we delete it, except invoices and their records, which we keep for as long as the law requires.

Buyer Data follows the same rule: the Seller decides about it while using the Service, and it is deleted 90 days after the Effective cancellation date, with the same exception for invoices.

The other periods are in the table in section 3. Database backups are our provider's, and they are deleted automatically after 7 days. We make no other copies.

Where we must keep data only to comply with the law or deal with claims, we block it (Art. 32 LOPDGDD). Blocked data is set apart and not used. We make it available only to judges, courts, the public prosecutor or the competent authorities, and delete it once the liabilities lapse.

10. Your rights

For the data we process as controller, you have these rights (Arts. 15 to 22 GDPR; Arts. 12 to 18 LOPDGDD):

• Access: know what data of yours we process and get a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data, for example when it is no longer needed, when you object to its processing or when we process it without a legal basis.
• Objection: object to processing based on legitimate interest.
• Restriction: ask us to freeze data while a question is resolved.
• Portability: receive in a structured, commonly used and machine-readable format the data you gave us, where we process it under a contract and by automated means, and ask us to send it to another controller where technically feasible (Art. 20 GDPR).
• Not to be subject to automated decisions with legal effects.

To exercise them, write to privacidad@cataloop.app. Tell us which right you want to exercise and, if you are a Buyer, the name of the Shop.

If we have reasonable doubts about your identity, we will ask for what we need to confirm it (Art. 12(6) GDPR). Exercising your rights is free, unless your request is manifestly unfounded or excessive. In that case we may charge a reasonable fee or refuse to act on it, and we will explain why (Art. 12(5) GDPR). We will reply within one month at most. If the request is complex, that period may be extended by two more months, and we will tell you (Art. 12(3) GDPR).

No processing relies on your consent, so there is no consent to withdraw.

If you are a Buyer: Buyer Data is decided by your Seller. Send your request to the Seller. If it reaches us instead, we will pass it on without delay.

If you believe we have not handled your data properly, you can complain to the Agencia Española de Protección de Datos (the Spanish Data Protection Agency) at www.aepd.es (Art. 77 GDPR), or to the supervisory authority of the place where you habitually live, where you work or where the alleged infringement took place. We would appreciate it if you wrote to us first, so we can try to resolve it.

11. Data protection officer

We have not appointed a data protection officer, because the law does not require us to (Art. 37 GDPR; Art. 34 LOPDGDD): we do not monitor people systematically and on a large scale, we do not process special categories of data on a large scale and we do not profile users.

For any privacy question, write to privacidad@cataloop.app.

12. How we protect your data

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR). Among them:

• We store passwords only as a scrypt hash, never in plain text.
• The database is encrypted at rest, and connections are encrypted.
• Session cookies cannot be read by the page's own code, and in production they travel only over encrypted connections.
• We automatically slow down repeated attempts to sign in or to guess an Access code.
• We remove metadata (EXIF) from photos, such as the location where they were taken.
• Support access is read-only by default, we email you every time it is used, and it is logged.
• Before sending an error report, we try to remove emails, phone numbers, cookies and user data from it. This is automatic filtering and does not guarantee that no data remains.

The details are in the security measures annex of the DPA. No system is infallible. If a personal data breach affects your data, we will tell you when the law requires it (Arts. 33 and 34 GDPR).

13. Automated decisions

We make no decisions based solely on automated processing that produce legal effects on you or affect you in a similar way (Art. 22 GDPR).

The only automatic step is a security brake. When you sign in, use an Access code, reset a password, sign up or place Orders, the Service limits repeated attempts. The limit lifts by itself and is not recorded in your account.

14. Children

The Service is designed for businesses and professionals. It is not aimed at minors, and we do not knowingly process data about minors.

15. Cookies

We use cookies and browser storage to keep you signed in, remember your language and theme, and keep your cart in your own browser. We use no analytics or advertising cookies.

Each one is described in the Cookie policy.

16. Changes to this policy

We may update this policy. The version in force is the one bearing the date shown at the top. If a change is significant, we email the Owner of each account at least 30 days before it applies.

We do not send you commercial communications.

On the signup form we show you a summary of this policy (Art. 11 LOPDGDD).

17. Language

This policy is published in Spanish and in English. The Spanish version is the binding one, and it prevails over the English translation if the two differ.