Privacy policy

1. Data controller

The controller is Pol Munné Martínez, a natural person trading as a self-employed individual (autónomo), with tax ID 48244334V and registered address at Vilafranca del Penedès (Barcelona), 08720, owner of the rechnia.com website and of the Rechnia service (hereinafter, «the provider»). Their full identification details appear on the invoices they issue and are provided to anyone who requests them at rechnia@rechnia.com. Contact e-mail for data protection matters: rechnia@rechnia.com.

This policy concerns the data the provider processes as controller: that of the people who request access, contract the service, hold an access account, subscribe to its news or communicate with the provider. The data that the company contracting the service (hereinafter, «the customer») enters in the application about its own business, staff and contacts is governed by the data processing agreement, under which the provider acts as processor on the customer's behalf.

2. What data is processed and where it comes from

Access request and contact form (public website): company name, contact person's name, e-mail address, telephone number if provided, plan of interest and any free text written, together with the language in which it was filled in, the version of the legal texts accepted —or, on the contact form, the version of the privacy policy the person confirmed having read— and the date and time of that acceptance or confirmation. Provided by the interested person themselves. If the link through which the person reached the website indicates a channel —for example, «feria» or «visita»—, it is stored too, to know through which route requests arrive.

Company registration: company name, legal form, tax ID, activity, company telephone and e-mail; tax address, VAT regime and registry details; representative's name, surname, tax ID and position; delivery address with its contact person, telephone and e-mail; chosen plan and the version of the legal texts accepted, with the registration completion date. After registration, the company's administrator can state in Company details whether the company is on the VAT Immediate Supply of Information system (SII), is not, or does not know. The provider sees that answer together with the legal form, whether the company name, tax ID or tax address are missing, and how many invoices the company has issued in the application —not their content—, in order to know which customers VeriFactu affects and from when.

Anti-abuse checks: when an access request is saved, the application automatically notes whether it shows signs of not being genuine —a name that looks like a joke or is too short, the company and the person having the same name, an impossible telephone number or a message containing links— so that a person can review it; the note neither rejects nor delays the request. Requests that use an address from a disposable e-mail service or carry a link in the name are, however, rejected. When registration is completed, the application checks whether the company's tax ID, e-mail or telephone, the representative's tax ID or the account e-mail already appear in another customer company; and, when the first month is paid by card (including through Apple Pay or Google Pay), the application obtains from Stripe the type of card (credit, debit or prepaid) and its fingerprint —an identifier Stripe assigns to each card that does not reveal its number or allow it to be charged—, and stores the fingerprint with the company; with other payment methods nothing equivalent is obtained or stored. If, as a result of those checks, the promotional first month is withdrawn early, the application records in the company's subscription the date, the reason and whether its administrator account was notified, and sends that account an e-mail with the reason and how to ask for a person to review the decision.

Access accounts: name, position, e-mail address, role, start and end dates, telephone and profile photo if filled in, language and appearance preferences —among them, if the person uploads it, the photo they choose as the background of their sign-in screen, which is shown on that screen in the browsers where they sign in with their account and is deleted when changed, when going back to the usual background or when the company's data are erased—, and the number of allowance-based queries each account makes each month, which the company's administrator can see. They are entered by the customer company's administrator when creating each account —the first one, by whoever completes registration— and the person can complete or correct them from their profile. The password itself is not stored: only an irreversible hash of it (calculated with scrypt and salt), from which not even the provider can recover the original password.

Open session: while an account has a session open, a random identifier, a generic label of the browser and system (for example, «Chrome on Windows»), the start time and the time of last use are stored. This allows each account to be open in only one place at a time and indicates where it is open when someone tries to log in from elsewhere. Neither the IP address nor the full browser identifier is stored.

Failed login attempts and submission limits: for each e-mail address used in an unsuccessful login attempt, together with the IP address it is attempted from, the number of consecutive attempts and the date of the last one are counted, in order to temporarily block login after five failures; they are also counted per origin so that a third party cannot lock someone out by mistyping their e-mail. The same counter limits, with the IP address only, repeated submission of the public access request and contact forms and subscriptions to the news from the box in the website footer and from Settings › Account, and, with the e-mail and with the IP address separately, requests for password reset links. Each failed attempt is also recorded, with the e-mail typed and the time —without the IP address—, in the server's general log, which is not visible from the application.

Password reset: when someone requests a reset from the login screen and the e-mail corresponds to an account, the application sends to that e-mail —never to another— a single-use link and stores an irreversible hash of the link (not the link itself), the account it belongs to, the language in which it was requested, the creation time, the expiry time (one hour later) and, if used, the time of use.

Change of an account's e-mail address: when an administrator of the customer company changes the e-mail address of an account with a password from its record, the change does not take effect until it is confirmed from the new address. The application sends the new address a single-use link to confirm it and, to the previous address, a notice with the new address partly hidden, the name of whoever requested the change and a single-use link to cancel it; it stores an irreversible fingerprint of each link (not the link itself), the account, both addresses, who requested it, the language, the time of creation, the expiry time (twenty-four hours later) and, if used, the time of confirmation or cancellation. Until it is confirmed, the account keeps signing in with the previous address.

Activity log: the application records in a file-based log, separated by company, logins and logouts (with the account name), relevant save actions —among them, each download of the company's data, with the e-mail of whoever makes it, and each market value or service history query for a vehicle, with its VIN— and errors, with date and time. The server's general log, which is not visible from the application, records failed login attempts (with the e-mail typed), password reset requests (with the e-mail typed or the account name), access requests (with the company name, the reasons if they are flagged for review and the e-mail if they are rejected or throttled), and invitations issued. Neither log records the IP address; the browser only appears, as a generic label («Chrome on Windows»), when someone closes a session open on another device in order to sign in.

Communications: the messages the customer sends to the provider from the application's support section (subject, text, urgency and the reply), with the name and e-mail of the account and the name of the company sending them, and the name and e-mail of the provider's account that replies, with the date of the reply. Each message is also sent by e-mail to the provider's mailbox; when replying by e-mail is enabled, the provider can answer it from there, and the application collects that reply from the mailbox and stores it with the message.

E-mail: the messages anyone sends to rechnia@rechnia.com or to any other address on the rechnia.com domain (sender, content and attachments) and the provider's replies. Provided by whoever writes. The e-mails the application sends by itself come from an unmonitored address (noreply@rechnia.com); anything replied to that address is discarded unopened, which is why each one says in its footer how to write to the provider (the application's support section and the website's contact form). The notice to the provider of each support message may instead be sent from a provider replies address (respuestas@rechnia.com), because it is addressed to the provider itself and is meant to be answered.

News by e-mail: whoever subscribes to the provider's news and promotions —from the box in the website footer, from Settings › Account or by ticking the box at registration— provides their e-mail address, which is stored with the language, where they subscribed from, the date and time they requested it, when the link was sent to them and when they confirmed it, the version of this policy in force when confirming it and, if they unsubscribe, the date of unsubscription; and, for the links in their e-mails, a random code to unsubscribe and, while the subscription is pending, an irreversible hash of the link to confirm it (not the link itself). From the website and from Settings › Account, the subscription does not start until it is confirmed with the link sent to that address, and no more than one link per hour is sent to the same address; for that, and for the cap on links sent each day, the time and a hash of the address (not the address) are recorded for each link sent, and are deleted within two days at most; at registration, the address is the one that received the invitation and the subscription starts when registration is completed. Subscribing is voluntary and is not a condition for registration or for the service.

E-mails sent by the application: in addition to the reset link and the two e-mails of an account's e-mail address change (the link to confirm it, to the new address, and the notice with the link to cancel it, to the previous one), the application sends the invitation link to complete registration (to the address given in the access request, which does not yet belong to any account), a welcome e-mail once registration is complete (to the address of the first account, with the person's name, the company's name and the chosen plan), an e-mail confirming that the plan is active, once the subscription is paid (to the oldest active administrator account, with the person's name, the company's name, the plan, the payment method chosen, what has been charged and what will be charged next) and, when these legal texts change, a notice with a summary of the changes and the date from which they apply to existing customers (to the oldest active administrator account of each customer company, with the person's name and the company's name); for each notice it records to whom it was sent, for which version, when and with what result, and keeps that record with the company's data; and, to those who pay the subscription yearly, a notice thirty days before each renewal, with the date, the plan and the amount to be charged (to the same administrator account, with the person's name and the company's name), for which it likewise records to whom it was sent, for which renewal, when and with what result; when the subscription is cancelled, a notice with the day until which the service can be used, that nothing more is charged from that day and what happens to the data afterwards, and, if the cancellation is undone, another confirming that the subscription continues and when the next charge is (both to the oldest active administrator account, with the person's name, the company's name and the plan); when the promotional first month is withdrawn early, a notice with the date, the reason, the plan and the fee charged from that day (to the same account, with the person's name and the company's name); and, when the provider replies to a message sent from the support section, a notice to the person who wrote it, with their name and the number and subject of the message, without the reply, which is read inside the application. It also sends the provider, to its mailbox, a notice of each message written from the support section, with the company name, the name and e-mail of the account writing it, the subject, the urgency and the text; and, when replying by e-mail is enabled, it reads in that mailbox only the folder where replies to those notices arrive, of which it stores only the text written by the provider, without the quotation of the original message. And, to whoever subscribes to the news from the website or from Settings › Account, the link to confirm it, sent to the subscribing address and with no data other than that address; and, to whoever asks on the website for the link to unsubscribe from the news, that link, only if the address is subscribed and with no data other than that address. For every e-mail it sends, whether or not it goes out, the application records the recipient, the subject, the date and the outcome of the sending —never the content— in a log that only the provider sees, so that delivery can be checked.

Mandatory data: the fields marked as mandatory in the access request, in registration and in each account's record are necessary to handle the request, conclude the contract and give access to the application; without them this is not possible. The rest are optional.

Minors. The service is aimed at companies and professionals and is not intended for children under fourteen (14): no data of minors is requested or knowingly processed. The data of the people a customer gives access to is that of its staff, who by law cannot be under sixteen (16) (article 6 of the Spanish Workers' Statute). If the provider became aware of having collected data of a child under fourteen without parental or guardian consent, it would delete it; any question may be sent to rechnia@rechnia.com.

3. Purposes and legal basis

Handling and assessing access requests and contact form enquiries, and contacting whoever sends them. Basis: pre-contractual measures at the request of the data subject when a sole trader or professional writes in their own name (art. 6(1)(b) GDPR); when someone writes on behalf of a company, the provider's legitimate interest in replying to the interested company, presumed under article 19 of Spanish Organic Law 3/2018 (art. 6(1)(f) GDPR).

Completing registration, providing the contracted service, managing access accounts and giving support. Basis: performance of the contract when the customer is a sole trader or professional (art. 6(1)(b) GDPR); for the data of a company's representative and of the people the customer gives access to, the legitimate interest of the provider and the customer in enabling the customer's staff to use the contracted service (art. 6(1)(f) GDPR, in connection with article 19 of Spanish Organic Law 3/2018).

Answering questions received by e-mail. Basis: performance of the contract or pre-contractual measures at the request of the data subject when whoever writes is a customer or wishes to become one in their own name (art. 6(1)(b) GDPR) and, in other cases, the provider's legitimate interest in replying to whoever contacts it or to the company on whose behalf they write (art. 6(1)(f) GDPR).

Invoicing and keeping supporting documents. Basis: legal obligation (art. 6(1)(c) GDPR).

Keeping the service secure: a single open session per account, blocking after failed attempts, limits on repeated form submissions, single-use password reset links and the activity log. Basis: the provider's legitimate interest in protecting the service and customers' data against use contrary to what was contracted (art. 6(1)(f) GDPR). The minimum possible data is processed for this. The IP address is used only in the attempt and submission counters described in section 2 and is not recorded in the activity logs; the network and security provider (Cloudflare) and the hosting provider (Render) also receive it in their technical connection logs, as the provider's processors.

Preventing false registrations and repeated use of the promotional first month, through the anti-abuse checks in section 2. Basis: the provider's legitimate interest in protecting the service and its commercial conditions against fraud (art. 6(1)(f) GDPR). The review flags on requests decide nothing: a person looks at them. There are only two automatic consequences: if a new company's identification details match those of another customer company, the promotional first month does not apply to it; and if the card is prepaid or has already paid the first month of another company, that price stops applying and the full plan fee is charged from that day. Anyone affected may ask for a person to review the decision, express their point of view and contest it by writing to rechnia@rechnia.com.

Recording which version of the legal texts each customer accepted and when, as evidence of the conclusion of the contract. Basis: performance of the contract and defence against claims (arts. 6(1)(b) and 6(1)(f) GDPR).

Knowing through which route requests arrive —the channel indicated by the link through which the person reached the website, such as a trade fair or a visit— to decide where to focus commercial effort. Basis: the provider's legitimate interest in knowing which contact channels work (art. 6.1.f GDPR). Only the number of requests and sign-ups per channel is counted; it is not used to build profiles or to decide on the request.

Sending by e-mail, to whoever has subscribed, news about the service and the provider's commercial communications (promotions). Basis: the person's consent (art. 6.1.a GDPR and art. 21 of Spanish Law 34/2002 of 11 July on information society services and electronic commerce), given when subscribing —and, from the website or from Settings › Account, when confirming it with the link sent to that address— which may be withdrawn at any time, free of charge, with the unsubscribe link in every e-mail, from Settings › Account or by writing to rechnia@rechnia.com; withdrawing it does not affect the lawfulness of earlier sends. After unsubscription, the record of the subscription is kept blocked, for the period in section 4, solely to be able to prove that the sends had that consent and so that the unsubscribe link in earlier e-mails still works to unsubscribe if the address subscribes again (arts. 7.1 and 6.1.f GDPR). The provider through which the news is sent will be stated in section 5 before the first send.

Apart from what is described in this section, no decisions based solely on automated processing are taken and no profiling is carried out.

4. How long data is kept

Access requests and enquiries that do not result in registration, with their review flags, invitations that are never used and registration drafts that are not completed: up to twelve (12) months from the last communication; the provider then deletes them.

Registrations that are completed but never paid for: twelve (12) months from registration; the provider then deletes that company's data.

Record of the contracting of whoever becomes a customer —the request, the invitation, the version of the texts accepted and the date and time of acceptance, with the company name and tax ID— and, if their data is deleted, the record of that deletion (company name, tax ID, termination and deletion dates) and the subscription payments recorded by hand by the provider, such as bank transfers (date, period paid, payment method, amount, reference and note of each payment, with the company name and tax ID): for as long as the contractual relationship lasts and, after termination, six (6) years, the period that article 30 of the Spanish Commercial Code sets for business records; the provider then deletes them.

Data of active customers and their access accounts: for as long as the contractual relationship lasts. Access accounts the customer deactivates are kept as part of the company's history for as long as the relationship lasts.

After the customer's termination (the end of the service, under the terms and conditions): thirty (30) calendar days so that they can download their data or request a complete copy; the provider then deletes the company's data, including its card fingerprint and the review flags of its request, except for data that must be kept by legal obligation —mainly tax and accounting documentation, with the payments recorded by hand, and the contracting record— for the periods set by law.

Open session: the record is replaced on each new login and deleted on logout, when the person is removed or when their access is withdrawn. If the session expires without being closed, the entry —with no data other than the browser label and the times— remains until the next login attempt with that account.

Failed login attempts and submission limits: each counter ceases to have effect fifteen minutes after the last attempt; the counter entries (e-mail, IP address or both, number of attempts and date of the last one) and the general log entries corresponding to e-mails that never log in are deleted by the provider within the following twelve (12) months.

Password reset links: each link expires one hour after being requested and is cancelled when used or when another is requested; its entry is kept with the company's data and deleted with it.

Links for changing an account's e-mail address: each link expires twenty-four hours after being requested and is cancelled when used, when the change is cancelled or when another is requested; its entry is kept with the company's data and deleted with it.

Activity log and support messages, with who replied to them: for as long as the contractual relationship lasts; the provider deletes them together with the rest of the company's data. Of the e-mails the application looks at in the replies folder, only how they were handled is recorded, without their content, and the record of those that do not belong to any message is deleted after twelve (12) months.

The server's general log: twelve (12) months; each day's file is then deleted.

Log of e-mails sent by the application: twelve (12) months from sending; entries addressed to a company's accounts are deleted earlier if that company's data is deleted.

E-mail correspondence: that of customers, for as long as the contractual relationship lasts and until their company's data is deleted; that of anyone who does not become a customer, up to twelve (12) months from the last communication; in both cases except for what must be kept by legal obligation or to deal with possible claims.

News by e-mail: for as long as the person remains subscribed. If a subscription requested from the website or from Settings › Account is not confirmed, the link expires after seven (7) days and the address is deleted within the following twenty-four (24) hours. After unsubscription, the record of the subscription (the address, the language, the dates, where it was requested from, the version of this policy and the code of its unsubscribe link) is kept blocked for three (3) years, the limitation period for very serious data protection infringements, and is then deleted. If a customer company's data is deleted, the subscriptions of its accounts' addresses are deleted too.

Shared table of distances between addresses (section 6): up to twelve (12) months from when each distance is calculated.

Backups: each daily backup is replaced after seven (7) days, so deleted data also disappears from the backups within that period.

5. Who else may access the data

Hosting and infrastructure provider: Render Services, Inc. (a United States company; servers in Frankfurt, European Union), which hosts the application, the database, uploaded files and backups. The provider has a data processing agreement with it.

Network and security provider: Cloudflare, Inc. (United States). All traffic between the browser and rechnia.com passes through its network, which protects the site against attacks and abuse and delivers it encrypted. To do so it receives the IP address and the technical data of each connection (browser, address requested, date and time) and processes in transit the content of what is sent and received, including forms and uploaded documents. It acts as processor, directly or through the hosting provider, in accordance with its data processing agreement.

Off-server backup storage, from 28 October 2026: Cloudflare, Inc. (United States), the same network and security provider, with its R2 storage service and in a bucket located in the European Union jurisdiction. Every day it receives a copy of the application's database, without the uploaded files, and each copy is kept there for seven (7) days. It acts as processor, contracted directly by the provider, in accordance with its data processing agreement.

E-mail provider: Zoho Corporation B.V. (Netherlands), Zoho Mail service contracted in its European version, with mailboxes hosted in European Union data centres. It receives and stores e-mail correspondence with the provider (access requests, support, invoicing and anything written to rechnia@rechnia.com or to another address on the rechnia.com domain) and is also the means by which the application sends the e-mails it sends by itself: the link to reset a forgotten password (to the account's e-mail), the link to confirm a change of an account's e-mail address (to the new address) and the notice of that change with the link to cancel it (to the previous address), the link to confirm the subscription to the news by e-mail (to the subscribing address), the invitation link to complete registration (to the address given in the request, which is not yet any customer's), the welcome e-mail once registration is complete, the e-mail confirming that the plan is active, the notice of changes to these legal texts, the advance notice of the renewal of an annual subscription, the notices of the cancellation of the subscription and of its resumption and the notice of the early withdrawal of the promotional first month, with its reason, to the administrator account of each customer company; the notice that the provider has replied to a support message, without the reply (to the person who wrote it); and the link to unsubscribe from the news (to the subscribed address that requests it). It also carries the notice to the provider of each message sent from the application's support section, with its content, and, when replying by e-mail is enabled, the reading, by the application's server, of the folder in the provider's mailbox where replies to those notices arrive. It acts as processor in accordance with its data processing agreement, and states in its terms that it does not use the content of e-mails for its own purposes.

Built-in help provider: Mistral AI (France), which processes the data in the European Union and receives only what is indicated in section 6.

Payment provider: Stripe Payments Europe, Ltd. (Ireland), when the customer pays through Stripe, with the method they choose (a card or another method Stripe offers). Payment method details are entered in a Stripe form embedded in the application —a frame the customer's browser loads from Stripe's domain— or, where applicable, on Stripe's payment page; in both cases they travel from the customer's browser to Stripe and never pass through the provider's servers. The provider shares the customer company's name, tax ID, address and billing e-mail with Stripe, and the language in which it wants to receive receipts and invoices, in order to manage the subscription and issue invoices. Stripe acts as the provider's processor to manage the subscription, payments and invoices, and as an independent controller for its own purposes —such as fraud prevention and compliance with its obligations as a payment institution—, in accordance with its privacy policy. The provider receives from Stripe the status of payments and the type of method used to pay (for example, card, Bizum or Klarna) and, from the first card payment, the type of card and its fingerprint (section 2); of the payment method it stores nothing but that type and that fingerprint. When, by agreement, payment is made by bank transfer outside Stripe, bank details are processed only by each party's financial institutions.

Public authorities, courts and financial institutions, where there is a legal obligation.

No disclosures other than the above are made. The other external services, those in the following section, receive only what is indicated there, and only when the customer uses the corresponding feature.

6. External services the application queries

While logged in, the application queries third-party services to obtain information linked to what the customer does: sometimes when a button is pressed (checking a vehicle, asking the help), other times when a screen that needs the data is opened (placing an address on a map, calculating the kilometres of a route). These queries are made by the provider's server and do not include access account data. None of these features is necessary for the basic operation of the program. Vehicle checks and route calculation with Google have a monthly allowance depending on the plan; the built-in help, a monthly token allowance depending on the plan and a rate limit of twelve questions every five minutes per person; the others have no allowance.

Vincario (api.vincario.com): market value, manufacturer service history and factory equipment of a vehicle, when the person presses «Decode VIN» in the list of candidates of a project; the history and the equipment are only requested for makes whose manufacturer provides them. The vehicle identification number (VIN) is sent and, for the market value, the vehicle's mileage. The reply is not stored: it is shown to whoever requested it and discarded at most one hour later; the application only records, per company, which VIN was queried, which query it was, when and with what mileage, in order to apply the quota. The history may include the workshop that carried out each service, but no data about the owners.

Google Routes (Google, routes.googleapis.com): calculation of road distances between the location of a candidate vehicle and the customer's delivery address, when a project is opened, to estimate the transport of each candidate. The two postal addresses are sent as text. If there is no allowance left or the service fails, that route is left uncalculated, without turning to any other service, and the application says so. The distance obtained is stored together with the two addresses in a results table shared by all customers, without indicating which company or vehicle it comes from, so that the query is not repeated; no company can see its content: only the server reads it to reuse a distance already calculated.

Google Geocoding (Google, maps.googleapis.com): converts postal addresses into coordinates to place them on a map; it receives the address as text, also while it is being typed in the vehicle registration and delivery address forms. A postal address may be personal data when it belongs to a private individual.

Embedded map: on screens that show a map (home, vehicle record and registration, delivery address and company details), the viewer's browser loads the map frame directly from Google Maps. In that load the map provider receives the coordinates of the point, the browser's IP address and the site origin (rechnia.com), not the specific page being viewed. It is a browser connection, separate from the queries above, and the map provider may set its own cookies or read those it already has in that browser; see the cookie policy.

calendariosnacionales.com: official public holiday calendars by autonomous community for the application's calendar. The year and the community code are sent; no customer data. The reply is stored in the application.

Help with artificial intelligence: the built-in help answers by means of an external language model provider: Mistral AI (api.mistral.ai, France; data is processed in the European Union). With each question, the help's instructions and the entries of its knowledge base that deal with the topic asked about —material about using the program, the same for all customers—, the text of the question and up to the last twelve turns of that conversation are sent. The application does not send any data about the company, its vehicles, its employees or its customers on its own: what travels is what the person types, which is why the field itself warns not to type customer data or registration plates. The conversation is not stored on the provider's server —the history is kept only in each person's browser, as the cookie policy explains—: the server only records, per company and month, the number of questions and the tokens used, to apply the plan's allowance, and, for the rate limit, when each person asked in the last five minutes. If the provider returns an error, a fragment of its error response is kept in the server's technical log for diagnosis. Mistral AI does not use what is sent to train its models, because the provider has disabled that option in its account, and it may keep it for up to thirty (30) days, solely to monitor abuse, before deleting it.

Uploaded documents: invoices, receipts and staff documents are read **on the server itself**. Their text is extracted by the program using a library installed there, and the file is not sent to any external service — not to the artificial-intelligence help provider of the previous paragraph either.

The tables of municipalities and official average prices used by the application are built into it; no external service is queried for them.

7. International transfers

Google LLC (routes and map), Render Services, Inc. (hosting; servers in Frankfurt, European Union), Cloudflare, Inc. (network and security and, from 28 October 2026, storage of the backup copy, in a bucket in the European Union) and Stripe, Inc., parent company of Stripe Payments Europe, Ltd. (payments), are United States companies included in the EU-US Data Privacy Framework list, which is the safeguard covering transfers to them; Render and Cloudflare also incorporate the European Commission's standard contractual clauses into their processing agreements in case that framework ceases to apply.

With Mistral AI (help with artificial intelligence) the data is processed in the European Union and there is no transfer.

Vincario is sent only the vehicle identification number and, for the market value, the vehicle's mileage, with no data about the owner, seller or buyer, and has no access to anything else stored in the application. calendariosnacionales.com receives no personal data.

The provider's e-mail (Zoho Corporation B.V., Netherlands) is hosted in European Union data centres. Zoho states that, in order to provide technical support, staff of its subsidiary Zoho Corporation Pvt. Ltd. (India) may access the data, and that this access is covered by the standard contractual clauses approved by the European Commission signed between the two companies.

Information about the safeguards applied may be requested by writing to rechnia@rechnia.com.

8. Your rights and how to exercise them

Anyone may request access to their personal data, its rectification or erasure, the restriction of or objection to its processing, the portability of the data they have provided and human intervention in the automated decisions described in section 3, and withdraw at any time any consent they have given —such as for the news by e-mail— without affecting the lawfulness of the processing carried out before.

To exercise them, simply write to rechnia@rechnia.com, stating the right being exercised. Proof of identity may be requested where necessary to prevent a third party from exercising rights on someone else's behalf. Requests about access account, session, security log and correspondence data are handled directly by the provider; where the request concerns data that a customer company processes in the application about its staff or contacts (records, documents, clocking records, absences, payslips or contacts), the provider will forward it to that company, which is the controller, and assist it in handling it. A reply will be given within one month, which may be extended in the cases provided for in article 12(3) of the GDPR. The administrators of a customer company may also download their company's data at any time from Settings › Account.

If the response is unsatisfactory, a complaint may be lodged with the Spanish Data Protection Agency (www.aepd.es).

9. Security

To use the application you must identify yourself with e-mail and password, and the whole application sits behind that door. Without a session, only the public presentation pages, the access request and contact forms, the legal texts, the registration screen reached through an invitation link, the two screens for requesting and using the password reset link, the screen for the links to confirm or cancel a change of an account's e-mail address and the box to subscribe to the news by e-mail, with the screens of its links to confirm the subscription or unsubscribe, are accessible.

There is one more case: the subscription link to the company calendar (arrivals, expiries, events and who is absent and when, without the reason). It is personal to each person and protected by a random code, but anyone who receives it can read that calendar without logging in; it should therefore not be shared.

Passwords are stored as explained in section 2 and must be at least eight characters long with upper and lower case letters, numbers and symbols. After five consecutive failed attempts, login with that e-mail from that origin is blocked for fifteen minutes. A forgotten password is reset with a single-use link that the application sends to the account's e-mail, valid for one hour; the screen requesting it responds the same whether or not the account exists, so as not to reveal to a stranger which e-mails have one, and using the link closes any sessions that account had open. Sessions expire after thirty minutes of inactivity and, in any case, thirty days after starting.

Each customer company's data is separated from the rest: no account can read or modify another company's information, and automated tests check this on every change to the program. Within each company, the invoicing, accounting, staff and subscription screens are reserved for the administrator role, and each person sees only their own personal documents.

Communication with the application is encrypted using HTTPS; the server instructs the browser never to use unencrypted connections. Uploaded files are stored under a random name and served only to those entitled to see them.

The provider, as operator of the service, can see each customer company's name, plan, number of accounts and administrators' names, the requests and support messages it sends, the automatic review flags of its access request and the outcome of the anti-abuse checks. Viewing the full list of a company's accounts and any intervention on them is recorded in the provider's own log. In addition, as server administrator, the provider has technical access to the database, uploaded files and backups of the entire service, which it can download from the application; that access is used solely to operate, maintain and protect the service, and each download of a backup is recorded in the log.

Prevailing version

This document is an English translation of the original Spanish text, which is the one accepted and the one with contractual effect. In the event of any discrepancy between the two versions, the Spanish version prevails.