Privacy policy

*This is an English translation of our privacy policy, provided for convenience. The Spanish version is the binding text and prevails if the two versions differ.*

In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights, the controller of the personal data collected through this website is:

Controller: Orchid Ventures S.L. ("Beebox One", the trade name under which it operates)

Registered office: C/ Constitució 74-78, Bajos, 08014 Barcelona (Barcelona)

Tax ID (NIF): B75576389

Contact email: [email protected]

Registry details: Registro Mercantil de Barcelona, Tomo 1000442278365, Folio 1, Hoja B 628664, Inscripción 1

This policy applies to the website beeboxone.com and to the management platform that Beebox One provides to its clients.

Beebox One develops and sells software for managing self-storage facilities and storage spaces. Because of the nature of this business, we process personal data in two different capacities:

As a controller, for the data of visitors to this website, of people who request a demo or contact us, of our clients' contact persons, and of the users who are given access to the platform. This processing is what this policy describes.

As a processor, for the personal data our clients enter and manage in the platform (for example, the data of their facilities' end customers). The controller of that data is the client who owns the facility, and Beebox One processes it only on their instructions, under the data processing agreement signed with each client in accordance with Article 28 GDPR.

We process the personal data we control for the following purposes:

Handling requests and sales contact: managing requests for information or for a product demo. Legal basis: taking pre-contractual steps at the data subject's request.

Managing the relationship with our clients: creating user accounts, providing and maintaining the service, giving support and administering the contractual relationship. Legal basis: performance of the contract.

Invoicing and accounting: issuing invoices, managing payments and meeting tax and commercial obligations. Legal basis: performance of the contract and compliance with legal obligations.

Operational communications: sending relevant information about the account or the service, such as maintenance notices or changes to the terms. Legal basis: performance of the contract.

Security and fraud prevention: keeping the website and the platform secure, verifying that access is legitimate and preventing fraudulent use. Legal basis: legitimate interest in protecting our systems and the data they hold.

Marketing communications: only with the data subject's prior consent, sending information about our products or services. Legal basis: consent, which can be withdrawn at any time.

When a client uses the platform to manage their facility, the personal data of their own customers and users (identification, contact, contractual or billing data, among others) is that client's responsibility. Beebox One acts as a processor: it processes that data only to provide the contracted service, following the client's documented instructions, and does not use it for its own purposes or disclose it to third parties, except to the sub-processors needed to provide the service.

If you are an end customer of a facility managed with Beebox One and want to exercise your rights over the data that facility processes, contact its owner, who is the controller of your data. Even so, if we receive such a request, we will pass it on to the relevant client and help them respond to it.

The platform lets our clients voluntarily connect their Google Calendar account to record the visits they schedule. The connection uses Google's authorization (OAuth), in which the user sees and explicitly accepts the permissions requested. We only access the data those permissions cover, and only for the functions described below.

Google Calendar. With the `calendar.calendarlist.readonly`, `calendar.events`, `openid` and `email` permissions we access:

- The list of calendars in the account that the user can write to, so they can choose which one visits are recorded in.

- The events in the chosen calendar for the day the user is scheduling a visit (start and end time and title), to show them their availability and avoid overlaps. These events are read on demand and are not stored.

- The email address of the connected account, to show in the platform which Google account is linked.

When the user schedules, changes or cancels a visit, we create, update or delete the corresponding event in the chosen calendar. We only change events created by the platform itself, and we keep their identifier so we can keep them up to date.

Storage and protection. The access tokens Google issues are stored encrypted in a secrets manager, separate from the rest of the platform's data, and are used only by Beebox One's servers to perform the operations described. All communication with Google uses encrypted connections (HTTPS).

Limited Use. Beebox One's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. In particular:

- We only use Google data to provide and improve the user-facing feature described in this section.

- We do not sell Google data or use it for advertising, profiling or determining creditworthiness.

- We do not transfer it to third parties, except where necessary to provide this feature, to comply with the law, or as part of a merger, acquisition or sale of assets, always with the user's consent where applicable.

- No person reads this data, except with the user's explicit consent, where necessary for security purposes, or to comply with the law.

- We do not use Google data to develop, improve or train generalized or foundational artificial intelligence or machine learning models.

Revocation and deletion. The user can disconnect Google Calendar at any time from the platform's settings, and can also withdraw access from their Google account at https://myaccount.google.com/permissions. When it is disconnected, we delete the stored access token and stop accessing the account. Events already created in Google Calendar remain in the user's Google account, where they can manage them. To request the deletion of any other related data, write to [email protected].

We keep personal data while there is an active relationship with Beebox One and, once it ends, duly blocked for the limitation periods of the applicable legal obligations (in particular, tax and commercial ones).

Data processed on behalf of our clients is kept for as long as the contract with each client provides and, when it ends, is deleted or returned in accordance with the data processing agreement.

Data may be processed by providers that supply us with technology, hosting, invoicing, security and support services, always under contracts that guarantee confidentiality and compliance with data protection law.

Some of these providers may be located outside the European Economic Area. In those cases, we ensure the transfer is covered by an adequacy decision of the European Commission or by appropriate safeguards, such as the standard contractual clauses approved by the European Commission.

We do not disclose personal data to third parties for commercial purposes.

Beebox One applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or improper disclosure. These measures are reviewed and updated regularly in line with the risks identified and the state of the art.

The verification and protection systems we use may collect technical data about the device or connection (such as the IP address or browser information) solely for security and abuse prevention. This data is not used for advertising or tracking.

Anyone whose data we process as a controller can exercise the rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to [email protected] and stating the right they wish to exercise.

They also have the right to withdraw their consent at any time, without affecting the lawfulness of prior processing, and to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they consider that the processing breaches the law.

If your data is processed by Beebox One on behalf of one of our clients, send your request to the owner of the relevant facility, as explained in the section "Data processed on behalf of our clients".

The use of cookies and similar technologies on this website is governed by the Cookie Policy, available at beeboxone.com/en/politica-de-cookies.

Beebox One may change this policy to adapt it to legislative, operational or technological changes. The version in force is the one published on this website; when changes are relevant to our clients, they will also be communicated by appropriate means.

For any questions about this policy or about the processing of personal data, write to [email protected].