Privacy policy

Last updated: 25 October 2026

This is a translation of the Spanish original. If there is any difference between versions, the Spanish version prevails.

1. Controller

Owner

Javier Arenillas

Trading name

3CWeb

Spanish tax ID (NIF)

52994848L

Address

Calle Castilla y León, 15, portal 1, 3.º C, 28760 Tres Cantos (Madrid), España

Email

info@3cweb.es

Phone

91 060 30 90

Website

fidelizando.io

2. Three types of data

Data of the businesses that register with Fidelizando (name, email, phone, billing details): the controller is Javier Arenillas (3CWeb), to provide the service, invoice and give support.

Data of each business’s customers (name, email or phone, stamps, points and visits): the controller is the business that issues the card. Javier Arenillas (3CWeb) acts as processor (art. 28 GDPR) and only uses the data so that the card, the app and the notifications work.

Data of anyone who writes to us through the contact form or by email (name, email, phone if given, business and message): the controller is Javier Arenillas (3CWeb), to reply.

3. Purposes and legal basis

• Providing the contracted service and managing the account: performance of the contract.
• Invoicing and tax obligations: legal obligation.
• Card notifications (stamps, rewards, expiry): performance of the service requested by the customer.
• A business’s offers and news: only with the customer’s consent, which can be withdrawn from the app itself.
• Replying to people who write to us: their request and our legitimate interest in dealing with it.
• Platform security and fraud prevention: legitimate interest.

4. Retention

Business data: while the account is active and, afterwards, for as long as tax and commercial obligations require (generally 6 years for invoicing). Data of a business’s customers: while they have the card. If the business closes its account, its customers’ data is not deleted automatically: it stays stored so the business can download it or come back, and it is deleted when the business asks (from the dashboard or by email), within 30 days at most. A card with no activity for 24 months may be deleted. Contact messages: up to 12 months after being dealt with. Proof of consent is kept for as long as it may be needed to demonstrate it.

5. Marketing communications

A business can only send offers to customers who have expressly accepted them (the offers box is never pre-ticked). We record which text each customer accepted, when and from where. Every offers email includes a one-click unsubscribe link, and offers can also be switched off from the card itself. Service notifications (stamps, rewards, expiry) are not offers and keep arriving while the customer has the card.

6. Recipients and transfers

Providers needed for the service, under processing agreements: hosting and email sending (Dinahosting, in Spain), payments by businesses (Stripe), Apple and Google to save the card in their wallet if the customer chooses so, and Telegram to notify us on our phone of new sign-ups and contacts (only the name and the reason; the email, phone and the rest are checked in our dashboard). Some of them may process data outside the European Economic Area; they do so with the safeguards of the GDPR (adequacy decision, such as the EU-US Data Privacy Framework, or standard contractual clauses). We do not sell or share data.

7. Security

The name, email and phone of businesses’ customers and contact messages are stored encrypted in the database. Connections are encrypted (https), passwords are stored with one-way encryption, dashboard access is permission-based and the super-administrator account has a second factor.

8. Your rights

Access, rectification, erasure, objection, restriction, portability and withdrawal of consent at any time, without affecting earlier processing.

• If you are a customer of a business, that business is the controller: you can ask it directly, remove offers from your card or with the link in each email, or write to us at info@3cweb.es and we will pass your request on within 72 hours at most.
• If you are a business or have written to us, write to us at info@3cweb.es. From the dashboard you can also download and delete your customers’ data.

We reply within one month at most. If you are not satisfied, you can complain to the data protection authority of the country where you live or work: in the United Kingdom, the ICO (ico.org.uk); in Ireland, the DPC (dataprotection.ie); in Spain, the AEPD (aepd.es); in Germany, your federal state’s authority or the BfDI (bfdi.bund.de); in France, the CNIL (cnil.fr); in Italy, the Garante (garanteprivacy.it); in Portugal, the CNPD (cnpd.pt); in Austria, the DSB (dsb.gv.at); in Belgium, the APD (autoriteprotectiondonnees.be); in Switzerland, the FDPIC (edoeb.admin.ch).

9. Minimum age and automated decisions

To save a card you must be the minimum age your country’s law sets for giving consent: 13 in the United Kingdom, Portugal and Belgium; 14 in Spain, Italy and Austria; 15 in France; 16 in Germany, the Netherlands and Ireland. We do not make automated decisions with legal effects or build profiles of that kind: automatic campaigns (birthday, we miss you) are set up by each business and are based only on activity on its card.

Questions? Write to us at info@3cweb.es or call 91 060 30 90.