Privacy Policy

1. Data controller

The data controller for personal data collected through the Puncheo platform is Thalamus Spain SL, tax ID (NIF) B87752986, registered address Av. Juan Antonio Samaranch 121, 28055 Madrid (Spain). Contact: support@puncheo.com.

2. Data we collect

We collect the following personal data when you register and use Puncheo:

• Identification data: first name, last name, mobile phone number and email address.
• Profile data: country, language and communication preferences.
• Approximate location data: province and city estimated from your IP address, which may be stored in your profile.
• Business data (retailers only): business name, country, address and tax details.
• Technical data: IP address, browser type, operating system and session data.

3. Purposes and legal basis

We process your data for the following purposes and legal bases:

• Service provision (Art. 6(1)(b) GDPR — contract performance): account management, authentication, stamp promotion management, and service messages (for example, verification codes and stamp notifications via SMS or WhatsApp).
• Legitimate interest (Art. 6(1)(f) GDPR): security and fraud prevention, and estimating your country, language and approximate location from your IP to tailor the experience.
• Legal obligations (Art. 6(1)(c) GDPR): retention of accounting and tax records required by applicable law.
• Marketing communications (Art. 6(1)(a) GDPR — consent): sending news and promotions, only if you have given explicit consent.

4. Retention

We will retain your personal data for as long as your account remains active. After account deletion, data will be erased or anonymised, except for data we are legally required to keep: in particular, billing data is retained for 6 years under the Spanish Commercial Code, and tax data for the periods required by tax law.

5. Recipients and international transfers

To provide the service we rely on the following processors:

• Google Cloud (platform hosting, region europe-west1, Belgium) and Google Maps (business geolocation).
• Twilio Inc. (USA): sending SMS and WhatsApp messages for verification codes and stamp notifications.
• Stripe (USA): payment processing for retailer subscriptions.
• Google reCAPTCHA Enterprise (Google, USA): protecting forms against fraud and automated abuse.
• Google Ireland Ltd. / Google LLC (USA), through Google Tag Manager, Google Analytics 4 and Google Ads: measuring site usage and the performance of our campaigns. Only if you give your consent.
• Meta Platforms Ireland Ltd. / Meta Platforms Inc. (USA), through the Meta Pixel: measuring the performance of our ads on Facebook and Instagram. Only if you give your consent.

Some of these providers are located in the United States, which may involve international data transfers. Such transfers rely on the appropriate safeguards set out in Chapter V GDPR (European Commission Standard Contractual Clauses and/or the EU–US Data Privacy Framework).

We do not sell or share your data with third parties for commercial or advertising purposes unrelated to Puncheo.

Where the data protection law of your country of residence (for example, Argentina, Ecuador or Mexico) requires an additional basis or safeguard for these international transfers, that basis is your express consent, given when you register for and use the platform, without prejudice to our also relying on contractual clauses or other mechanisms recognised by the relevant data protection authority.

6. Cookies and tracking technologies

Puncheo uses first-party cookies that are necessary for the platform to work, functional and security cookies, and — only if you give your consent — third-party analytics and advertising cookies.

First-party necessary, functional and security cookies (no consent required):

• pjwt (first-party, necessary): keeps you securely signed in. Essential for the service to function.
• puncheo-locale (first-party, functional): remembers the language you have chosen.
• puncheo-geo (first-party, functional): stores the detected country, language and approximate location to personalise your experience.
• puncheo-consent (first-party, necessary): stores your cookie decision for 6 months, so you are not asked again on every visit.
• puncheo_attr (first-party, functional): stores for 90 days the link, campaign or ad you arrived through (the utm_source, utm_medium, utm_campaign, utm_content, utm_term and fbclid parameters, along with the landing page and the date). It lets us know which campaigns work and, if you register, it is associated with your account. It is our own cookie and that information is only ever transmitted to Puncheo's own systems, never to a third party. You can delete it at any time from “Cookie preferences”.
• _GRECAPTCHA (Google, security): set by reCAPTCHA to tell humans from bots and protect forms.

Third-party analytics and advertising cookies (only with your consent):

• Google Tag Manager: the container through which the tags below are loaded. It is not loaded until you accept analytics or advertising; if you decline, it is not loaded at all.
• Google Analytics 4 (“Analytics” category): measures which pages are visited and how the platform is used, using the _ga and _ga_* cookies.
• Meta Pixel and Google Ads / DoubleClick (“Advertising” category): measure how our ads perform on Facebook, Instagram and the Google network, using the _fbp, _fbc and equivalent cookies.

Necessary, functional and security cookies are exempt from the consent requirement under Article 22.2 of the Spanish LSSI. Analytics and advertising cookies are loaded only after your express consent, which we request through a banner on arrival and apply using Google Consent Mode v2: until you accept, the default state is “denied” for ad storage, ad user data, ad personalisation and analytics storage.

You can change or withdraw your consent at any time from the “Cookie preferences” link in the page footer. Withdrawing is as easy as giving it and has no effect on your use of the service. Withdrawal stops data being sent from that moment on; cookies a third party has already set in your browser can be removed through your browser settings.

7. Data collected through retailers

If a retailer registers you as a customer by entering your phone number to create your loyalty card, we process that data to provide the service. In that case, we inform you through this policy and you may exercise the rights described below at any time, including objection and erasure.

8. Your rights

Under the GDPR, you have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten").
• Object to processing or request restriction.
• Request data portability.
• Withdraw consent at any time.

To exercise any of these rights, write to us at support@puncheo.com. If you are not satisfied with our response, you may lodge a complaint with the data protection authority of your country of residence — for example, in Spain the Agencia Española de Protección de Datos (www.aepd.es), in Argentina the Agencia de Acceso a la Información Pública (www.argentina.gob.ar/aaip), in Ecuador the Superintendencia de Protección de Datos Personales (www.spdp.gob.ec), or in Mexico the Secretaría Anticorrupción y Buen Gobierno (www.gob.mx/buengobierno) — or, where the law of your country allows it, bring the judicial action it grants you.

9. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure, including encryption in transit (TLS) and at rest.

10. Changes to this policy

We may update this policy periodically. The date of the last update is shown at the top of this document. We will notify you of material changes via a notice on the platform or by email.