Privacy notice

Who is responsible

The controller is Carlos Bertomeu Marín, sole trader, NIF 47828113G, Calle Federico García Lorca 109, 43580 Deltebre (Tarragona), Spain. BoxTempo is the trade name. Email: hello@boxtempo.com.

Write to this address for every question about the data that BoxTempo is responsible for. BoxTempo has not appointed a data protection officer. The law does not require one for this activity (article 37 of the General Data Protection Regulation, GDPR, and article 34 of the Spanish Organic Law 3/2018, LOPDGDD).

Your BoxTempo account and your membership in a box

One BoxTempo account works in every box that you use. The account and the membership have different controllers:

• Your account: BoxTempo is the controller. This is your email address, the sign-in codes, your sessions, the security records, your account language, the profile in your account (first name, surname, phone, birth date and address), and the list of the boxes of your account. BoxTempo decides to offer one account for many boxes and keeps it secure, so BoxTempo is responsible for it.
• Your membership in a box: the box is the controller. This is your application, your membership and plan, your identity document if the box asks for it, the box policy that you accepted, your bookings, the waitlist, your history, the notices and announcements of the box, and the push notifications of the app of the box. The box decides who becomes a member, which data it asks for and how it runs its classes. BoxTempo processes this data only for the box, under a data processing agreement (article 28 GDPR).

When you apply to a box or are a member, the box sees the profile values that it asks for, while your application or membership is active. You ask BoxTempo for this when you apply. The box uses these values as controller, for your membership, and keeps the copy that it received under its own rules. BoxTempo and the box are not joint controllers: each decides its own purposes. Only you change your profile, and a change applies to all your boxes.

For questions about your membership data, write to your box. Each box gives its own privacy information, for example in its policy text. If you write to us about membership data, we send your request to the box and help the box to answer.

Which data we use, why, and on which legal basis

Visits to boxtempo.com

Our hosting provider receives the technical data that a browser sends with every request: IP address, browser, page and time. We need it to show the pages and to protect the website. Legal basis: our legitimate interest in a secure website (article 6(1)(f) GDPR and recital 49).

We count visits with PostHog in cookieless mode. We see, as statistics, which pages people open, from which website they come, and the type of browser, device and screen. PostHog stores nothing on your device. Its code reads data of your browser, such as the screen size, and sends it to PostHog. To count a visit once on a day, PostHog makes a code on its servers from the IP address, the browser data, the website and a random key that changes every day. PostHog deletes the key after that day, and it does not keep the IP address. We do not identify you, and we do not join these statistics with other data. Legal basis: our legitimate interest in knowing which pages are useful (article 6(1)(f) GDPR). The statistics store nothing on your device. The Spanish Data Protection Agency (AEPD) also says that this type of audience measurement needs no consent under article 22.2 LSSI when it serves only this website and gives only anonymous statistics (AEPD guide on audience measurement tools, January 2024). If your browser sends Do Not Track or Global Privacy Control, we count nothing.

Early-access requests

When you send the form, we store your name, the name of your box, your email address, your city and your message (if you give them), the page language, the version of this notice and the time. Cloudflare Turnstile checks that a person sends the form. For this check, Cloudflare processes your IP address and data about your browser. Cloudflare uses these signals to detect bots. As an independent controller, it also uses them to improve Turnstile. We also use your IP address to limit the number of requests. We do not store it with your request.

We use your request to answer you and to talk with you about early access to BoxTempo. Legal basis: your request, as a step before a possible contract (article 6(1)(b) GDPR). The security check and the limits protect the form against spam (article 6(1)(f) GDPR). We send you emails about early access because you ask for them (article 21 LSSI). You can tell us to stop at any time.

Customers: the boxes that use BoxTempo

For the contract with a box, we use the name, email address and role of the owner and of the staff, the data of the box, the billing data (name or company name, tax ID and billing address), the payments and invoices, our messages, and the version and time of the terms that the owner accepted. Legal basis: the contract (article 6(1)(b) GDPR) and our legal duties for invoices and tax (article 6(1)(c) GDPR). We can send customers news about BoxTempo functions that are similar to the service that they use. Legal basis: our legitimate interest (article 6(1)(f) GDPR, recital 47) and article 21.2 LSSI. You can object at any time: in the sign-up form and in each message.

Your BoxTempo account

To give you an account, we use your email address, the sign-in codes that we send you, your sessions, your account language, your profile and the list of your boxes. We store sign-in codes only as a hash. A code works once, for 5 minutes. We do not store your IP address with your sessions. If a box invites you, we receive your email address, and sometimes your name, from the person who invites you. Legal basis: the account that you ask for (article 6(1)(b) GDPR).

To keep the service secure, we limit the sign-in attempts and the requests from one network and for one email address, we check the session on every request, and we keep change records that hold only internal identifiers. Legal basis: our legitimate interest and the interest of the boxes in a secure service (article 6(1)(f) GDPR and recital 49).

Emails to us

When you write to hello@boxtempo.com, we use your email address and your message to answer you. Legal basis: our legitimate interest in answering you (article 6(1)(f) GDPR), or the contract if you are a customer.

How long we keep data

• Technical data of visits: at most 7 days, in the Worker logs of our hosting provider.
• Statistics of visits: at most 25 months.
• Early-access requests: 12 months after you send them. Then the system deletes them. If you become a customer, the rules for customer data apply.
• Records of the request limits: 2 days.
• The text of sign-in emails: at most 24 hours in our system.
• Sessions: a session stops working when you sign out, or 90 days after its last use. Records of expired sessions and of used or expired sign-in codes: at most 12 months.
• Change records with internal identifiers: at most 2 years.
• Your account and your profile: while you keep the account. Write to us to delete it. Each box keeps the membership data that it is responsible for, under its own rules.
• Customer data: during the contract. Then 6 years for invoices and accounting records (article 30 of the Spanish Commercial Code), and longer if tax law needs it.
• Emails to us: up to 2 years after the last message.

Minors

BoxTempo accounts are for persons aged 14 or older. If you are under 14, do not create an account. If we learn that a person under 14 has an account, we delete it.

Each box sets a minimum age for new members, from 14 to 18. The default is 16. The Service applies this age with the birth date or the age statement that the person gives when they apply. For a member under 18, the box is responsible for the permission of the parents or guardians where the law requires it.

Identity documents

A box can ask for an identity document (DNI, NIE, passport or another document) in its application form. The box decides this as the controller, and it must ask for the document only when it needs it. BoxTempo stores only the type and the number, never a copy or a photo. Box administrators see the number masked, for example ••••1234. The number is never in our emails, notices, logs or change records.

Who receives data

We do not sell personal data, and we do not use it for advertising.

Our service providers process data for us: hosting and database, email sending, the mailbox of the operator, security checks, statistics, error reports, and later payments. The sub-processor list gives each provider, what it does, where it processes data, and how a transfer outside the EU is protected.

BoxTempo does not use Stripe yet. Customers pay by the method that they agree with BoxTempo in writing. If BoxTempo starts to use Stripe for payments, we update this notice first. Stripe then also uses some payment data as an independent controller, for example to prevent fraud and to meet its legal duties. The privacy notice of Stripe applies to that use.

When you apply to a box or are a member, the box receives the data of section 2. Public authorities, courts and the tax authorities receive data only when the law requires it.

Transfers outside the European Economic Area

We keep the database of the service in the European Union (Ireland), and the statistics of the website in Germany. Our email provider sends emails from Ireland, but it keeps its records of sent emails in the United States. Our hosting provider delivers pages through a global network. Some providers are companies in the United States, and their staff can get access from there, for example for support.

When data leaves the European Economic Area, the provider is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), or the transfer uses the standard contractual clauses of the European Commission (Decision 2021/914). The sub-processor list gives the safeguard for each provider. You can ask us for a copy.

Your rights

Right to object. You can object at any time to a use of your data that is based on our legitimate interest, and to news by email. Write to hello@boxtempo.com, or use the link in each message.

You can ask for access to your data, correction, deletion, restriction of use and a copy in a common format (portability). You can object to a use that is based on our legitimate interest (articles 15 to 21 GDPR). If a use is based on your consent, you can withdraw it at any time.

Write to hello@boxtempo.com from the email address of your account, or give us data that lets us find you. We answer within one month. If we cannot confirm who you are, we can ask for more information.

For the data of your membership in a box, write to the box. If you write to us, we send your request to the box within 5 working days and help the box to answer.

You can make a complaint to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es, C/ Jorge Juan 6, 28001 Madrid). Please write to us first, so we can try to solve the problem.

The visit statistics hold no identifier of you, so we cannot find your visits in them (article 11 GDPR).

We make no decisions about you only by automated means that have legal effects or similar effects on you (article 22 GDPR).

Data that you must give

The required fields of the form and the email address of the account are necessary. Without them, we cannot answer your request or give you an account. The other fields are optional.

Security

We protect data with measures that fit the risk. Examples: data in the EU, encrypted connections (HTTPS), a separate data area for each box that every function checks, sign-in codes and links stored only as hashes, a check of the session on every request, limits against automated attacks, and access only for the persons who need it.

Changes to this notice

We can change this notice, for example when we add a function or a provider. The version and the date are at the top. We tell account holders about important changes by email or in the app before they apply.