MY RECOMY SL · Tax ID B93904688 Av. Fuente Nueva 8, Madrid, Spain Contact email: hola@myrecomy.com
Identification and contact data: name, surname, email address, telephone, country of registration.
Profile and role data: user type (customer, business, professional, ambassador), profile photograph, biography, area of activity, social media accounts provided.
Business or professional data: name, sector, address, opening hours, capacity, billing details.
Activity data: bookings, consumption, amounts, ratings and reviews, recommendations, links between customer and ambassador, loyalty points.
Supporting documents: photographs of receipts and invoices uploaded by customers or businesses.
Tax data: tax identification (NIF, NIE, TIN or equivalent), country of tax residence, tax documentation provided, certificates of tax residence and forms required depending on country (W-8BEN, W-9 or others).
Payment data: managed by Stripe. My Recomy does not store card numbers or complete bank details.
Technical and usage data: IP address, device and browser type, language, access logs, and browsing data in accordance with the Cookies Policy.
Legal acceptance records: date, time, version of the document accepted, role, country and boxes ticked, as evidence of consent or contractual acceptance.
Performance of contract: provision of the service, management of bookings, payments, commissions and rewards.
Legal obligation: tax and accounting compliance, withholdings, reporting to tax authorities (DAC7 and equivalents), and identity verification required by anti-fraud regulations.
Consent: commercial communications, non-essential cookies and, where applicable, processing of biometric data during identity verification.
Legitimate interest: platform security, fraud prevention and service improvement.
Data is retained while the account remains active and, subsequently, for the periods required by law:
Tax and invoicing data: for the applicable tax and commercial limitation periods. Legal acceptance records: for as long as necessary for the defence of rights and compliance with obligations. Technical and access data: for the period strictly necessary for security purposes.
Once those periods have elapsed, data is blocked, anonymised or deleted as appropriate.
To provide the service we rely on providers acting as data processors, under the corresponding data processing agreements (DPAs):
Hosting and infrastructure provider for the application. Stripe, for payment processing, connected account management and identity verification. Email, messaging and notification providers. Analytics providers, where applicable and with consent.
Identity verification: this process may be carried out by Stripe. Where such process requires biometric data for identifying the individual, the user will receive specific information and the legal bases and safeguards required by the GDPR will apply. My Recomy does not store identity documents or facial images where the process can be delegated to the specialist provider.
Platform data is hosted on servers located in the United States, which constitutes an international transfer of data outside the European Economic Area.
This transfer relies on the safeguards provided for in Chapter V of the GDPR: the provider's adherence to the EU-US Data Privacy Framework, verified in the official register of participants.
Users may request information about the applicable safeguards by writing to hola@myrecomy.com.
Users' identification and income data may be disclosed to tax authorities where required by law, in particular in compliance with the DAC7 Directive in the European Union and equivalent reporting obligations in other territories.
Users may exercise the following rights by writing to hola@myrecomy.com, providing proof of identity:
Access to their personal data. Rectification of inaccurate data. Erasure of their data, where applicable. Objection to processing in certain circumstances. Restriction of processing. Portability of their data. Withdrawal of consent at any time, without affecting the lawfulness of prior processing.
The exercise of these rights does not affect the retention of data which must be kept by legal obligation, in particular tax and accounting records.
Users may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of their country of residence.
The service is not directed at minors. Data relating to persons under 18 years of age is not knowingly collected. Should the registration of a minor be detected, the account will be cancelled and their data deleted.
Appropriate technical and organisational measures are applied: encryption of communications (HTTPS), role and permission-based access control, user authentication, PIN-restricted access to team dashboards, access logging and periodic security reviews.
Tax data, IP addresses and technical identifiers linked to users are processed with access restricted to authorised personnel.
The platform applies automated rules for fraud detection and for the precautionary blocking of settlements. These decisions may be reviewed at the user's request, who has the right to obtain human intervention, express their point of view and contest the decision by writing to hola@myrecomy.com.
This policy may be updated. Material changes will be communicated to users through the application or by email, indicating the effective date.
v1.0 — 7/10/2026