Privacy policy

• Controller: Trocalia Digital S.L.
• NIF (Spanish tax ID): B70751490
• Address: Barcelona
• Contact address, and address for exercising your rights: info@puntuazo.com
• Data protection officer: not required given the volume and type of processing. Queries are handled at the address above.

• If you ask for The Mirror: the name of your business and its town, the link to your listing if you give it to us, and your email address. Nothing else. There is no phone field on this site.
• If you are a client: also your billing details and the delegated access you authorise from your own Google account. Never passwords.
• If we write to you first: professional contact details of your company (trading name, activity, location and an email address published by the business itself), obtained from publicly accessible sources and from the businesses’ own websites.
• If you unsubscribe: your email address, and only so we know not to write to you.

We do not handle special categories of data, we do not profile and we take no automated decision with legal effects on you.

• Producing and sending you The Mirror, and answering what you ask us. Basis: your consent (art. 6.1.a GDPR) and the pre-contractual steps you request (art. 6.1.b).
• Sending you, at most, two more emails about the service after the report. Basis: the same consent, revocable in one click on every send.
• Providing and invoicing the service you buy. Basis: performance of the contract (art. 6.1.b) and our legal accounting and tax obligations (art. 6.1.c).
• Sending commercial communications to companies and professionals we have no prior relationship with. Basis: legitimate interest in business-to-business prospecting (art. 6.1.f), supported by art. 19 of Ley Orgánica 3/2018 (Spain’s data protection act), which presumes that basis covers the processing of purely professional contact details whose purpose is to maintain a relationship with the legal person. There is a documented balancing test and you can ask us for a copy.
• Maintaining the suppression list of everyone who has unsubscribed. Basis: complying with the legal obligation not to write to them again (art. 6.1.c and art. 21.2 of Ley 34/2002).

Objecting to commercial communications is absolute and unconditional: one click on the unsubscribe link in any of our emails, or the unsubscribe page on this site. It is immediate, permanent and applies to every Trocalia Digital S.L. project.

In running your review request campaign we handle data about your customers: their contact address and the date of service, which is what sets the 30 calendar-day window under art. 20.4 of the texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios (Spain’s consolidated consumer act).

In that processing you are the controller and we are the processor, with the art. 28 GDPR processor agreement signed before we start. That agreement covers sub-processors, security measures, confidentiality, return or deletion at the end, and the duty to assist you if a complaint arrives.

• We only handle that data on your documented instructions.
• We only ask for the contact and the date of service. Not the ID number, not the postal address, not the purchase history.
• We never use one client’s contacts for another client or for ourselves.
• We do not work with bought lists or with data scraped from third parties.

We do not sell or transfer data to anyone. It is accessed only by the suppliers we need in order to operate, each under its own processor agreement:

• Email delivery provider, to get the messages to you.
• Hosting and website infrastructure provider.
• Payment gateway, which handles your card details directly, without us seeing or storing them.
• Google, when you authorise delegated access to your listing, on the terms of your own account.
• Accountants and tax advisers, and public authorities where the law requires it.

If any supplier handles data outside the European Economic Area, the transfer is covered by the European Commission’s standard contractual clauses or by an adequacy decision in force. You can ask us for the up-to-date list of suppliers at info@puntuazo.com.

• Mirror requests that do not end in a contract: up to 12 months from the last contact, then deleted.
• Client data: for as long as the relationship lasts, and afterwards for the limitation period of any claim under the contract. Invoices, for as long as tax and company law requires.
• Data handled on a client’s behalf: returned or deleted at the end of the engagement, as they instruct.
• Suppression list: kept indefinitely, because it is precisely what stops us writing to you again. It is the one case where keeping the data protects you.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, without affecting processing carried out beforehand.

Write to info@puntuazo.com saying which right you want to exercise. We answer within the legal deadline of one month and, almost always, the same day. We do not ask for forms or unnecessary paperwork.

If you believe we have not dealt with your request properly, you can complain to the Agencia Española de Protección de Datos (the Spanish data protection authority), at www.aepd.es.

If we change anything material, we update the review date on this page and, where the change affects you as a client, we tell you by email before applying it.