Data processing agreement

Last updated: 25 October 2026 · version 2026-10-25

This is a translation of the Spanish original. If there is any difference between versions, the Spanish version prevails.

This agreement, under article 28 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), is entered into by each business using Fidelizando, as controller, and Javier Arenillas (3CWeb), as processor. The business accepts it when creating its account (or from its dashboard), and the date, version and IP address are recorded. For businesses in the United Kingdom, it also serves as the processing contract required by the UK GDPR.

1. Processor

Owner: Javier Arenillas
Trading name: 3CWeb
Spanish tax ID (NIF): 52994848L
Address: Calle Castilla y León, 15, portal 1, 3.º C, 28760 Tres Cantos (Madrid), España
Email: info@3cweb.es
Phone: 91 060 30 90
Website: fidelizando.io

2. Subject matter and duration

The processor processes the data of the business’s customers only to provide it with the Fidelizando service, while the account is active and, afterwards, during the return and deletion period in section 9.

3. Nature and purpose

Hosting the data; issuing and updating cards in Apple Wallet, Google Wallet and the web app; recording stamps, points, visits and redemptions; sending service notifications and the campaigns the business sets up to those who accepted them; and showing the business its statistics.

4. Data and data subjects

Data subjects: the business’s customers who sign up to its card, and the business’s staff with dashboard access. Data: name, email or phone, birthday (optional), card code, programme activity (stamps, points, visits, redemptions), consents and sign-up IP address. No special categories of data are processed.

5. Processor’s obligations

Process the data only on the documented instructions of the business, which are those it gives when configuring and using the platform.
Ensure the confidentiality of the persons authorised to process it.
Apply the security measures of article 32 GDPR: encryption of customers’ personal data in the database, encrypted connection (https), encrypted passwords, role-based access, two-factor authentication for the super-administrator, backups and access logs.
Not disclose the data to third parties except to the sub-processors in section 6 or where required by law.
Help the business respond to its customers’ rights and meet its obligations on security, impact assessments and consultations with the authority.
Notify the business without undue delay, and within 48 hours at most, of any security breach affecting its data, with the information needed to report it.
Keep a record of the processing activities carried out on behalf of the business.
Make available the information needed to demonstrate compliance (this agreement, the list of sub-processors and the description of security measures) and, where the law requires it, allow one audit per year, with 30 days’ notice, at the business’s cost and under confidentiality.

6. Sub-processors

The business gives the processor general authorisation to use these sub-processors, under contracts that impose the same obligations on them:

Dinahosting, S.L. (Spain): hosting, database and email sending.
Apple Inc. and Google LLC: issuing the card in Apple Wallet and Google Wallet, only if the customer saves it there.
Google LLC (Analytics), only to measure Fidelizando’s public website with cookie consent: it does not receive data of businesses’ customers.

We will give at least 30 days’ notice in the dashboard and by email of any change of sub-processors (except in urgent cases for security reasons or a provider outage, which will be notified as soon as it is done). If the business objects on data protection grounds and there is no alternative, it can cancel the service without penalty. Any transfers outside the European Economic Area will be made with the safeguards of Chapter V of the GDPR.

7. Business’s obligations (controller)

Have a legal basis for the processing and inform its customers (the app includes a summary notice and the privacy policy).
Send offers only to those who accepted them and not import data without its owners’ permission.
Respond to its customers’ rights and supervise the processing.

8. Exercise of rights

If a customer of the business contacts the processor, the processor will forward the request to the business within 72 hours at most. The business can also download, correct and delete the data from the dashboard.

9. End of the agreement

When the business cancels, its data is not deleted automatically: it remains available for download or to reactivate the account. The processor deletes it when the business asks, within 30 days at most, except data it must keep blocked by law and anonymous statistics.

10. Precedence

If this agreement and the terms of use say different things about data processing, this agreement prevails. If there is any difference between languages, the Spanish version prevails.

11. Liability

If the processor uses the data for another purpose, discloses it or breaches this agreement, it will be considered controller for that processing and will be liable for the infringements it has committed.

Questions? Write to us at info@3cweb.es or call 91 060 30 90.