Privacy

Last updated: 4 November 2026.

1. Data controller. This Privacy Policy explains how personal data is processed on the Balancy website and services when gran.data acts as controller. Owner: Rita Granāte. Trading name: Balancy (a gran.data product, grandata.es). NIE: Z0396123E. Address: Avenida Malvarrosa 70, 46011 Valencia, Spain. Privacy email: rita@grandata.es. Website: https://balancy.es. You may also use in-app Support or Instagram @data.valencia. Processing complies with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD), and other applicable law.

2. Scope. This policy covers processing for Balancy’s own purposes: use of the public site; account creation and administration; subscriptions; support; billing and administration; service-related communications where appropriate; security and maintenance.

Data that a business customer enters about their clients, bookings, or staff is generally processed on that customer’s instructions. The business customer is the controller; Balancy is the processor under the contract and Terms.

3. Categories of data. Depending on use, we may process: identity and contact data; business and tax profile data; access and authentication data (credentials protected technically); billing and subscription data; support communications; technical and security data (including IP and access logs for the periods below).

If you sign in with Google or Microsoft, we receive email, name, photo, and an account id from that provider only to authenticate you, link your account, and show your profile. We do not use provider data for advertising or sell Google or Microsoft user data. You can revoke access at https://myaccount.google.com/permissions or in Microsoft privacy settings.

Balancy does not ordinarily ask for special categories of data at signup. If a business user enters such data, they must meet their own obligations to data subjects.

4. Cookies and analytics. We use a minimal set of cookies where needed for proper operation of the public site balancy.es. For traffic analysis we use Google Analytics (Google LLC, USA), which collects data about how visitors use the site: page views, session duration, device type, and approximate geographic location. Data is sent to Google and processed under Google’s privacy policy. Analytical cookies and Google Analytics are activated only after you accept them in the cookie notice on the site. The Balancy app (separate domain) uses strictly necessary session cookies to keep you signed in; we do not use advertising cookies in this release. You can withdraw analytics consent by clearing site data for balancy.es in your browser or writing to rita@grandata.es.

5. Purposes and legal bases. (a) Accounts and service delivery - GDPR Article 6(1)(b) (contract or pre-contract steps). (b) Billing and legal obligations - Article 6(1)(c). (c) Support - Article 6(1)(b) or, where appropriate, legitimate interest in handling incidents. (d) Service security - legal obligations and legitimate interest in protecting systems. (e) Commercial communications about Balancy - only with consent or applicable legal exception for existing customers, with right to object.

6. Mandatory data. Data required to register and subscribe is necessary to provide the service. Optional fields are used only for the purposes explained when collected.

7. Recipients. We do not sell personal data. Hosting, database, email, backup, and technical support providers may access data only to provide those services, as processors under contract. We may disclose data to authorities when required by law. An updated summary of processor categories is available on request at rita@grandata.es.

8. International transfers. We aim to process data within the European Economic Area. If a provider accesses data from a third country, we apply GDPR Chapter V safeguards (adequacy decision or other valid mechanism). You may request information on safeguards at the contact email. Google Analytics may process data in the United States under appropriate safeguards.

9. Retention. Account data: for the contractual relationship and thereafter as required by law. Billing: applicable tax and accounting periods. Support: for handling the request and proving assistance, unless a longer legal period applies. Operational and security logs: 30 days, unless investigating an incident. Data processed for a business customer: per their instructions and processor terms. After a deletion request, we delete or anonymise except where legal blocking applies.

10. Your rights. You may request access, rectification, erasure, restriction, objection, portability, and withdrawal of consent where applicable by writing to rita@grandata.es. We respond within GDPR time limits. If your request concerns data entered by a business controller, we will tell you whom to contact and provide required assistance.

11. Complaints. You may lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es

12. Security. We apply technical and organisational measures appropriate to the risk (access control, encryption in transit where applicable, backups, activity logging). No system is completely secure.

13. Third-party data in business accounts. The business user must inform their clients and establish a legal basis. Balancy processes that data only on their instructions. This policy does not replace privacy information the business must give its clients.

14. Automated decisions. Balancy does not make decisions based solely on automated processing that produce legal or similarly significant effects under GDPR Article 22. Tax estimates shown are planning aids, not decisions about individuals.

15. Changes. The current version is at https://balancy.es/privacy with the update date. Material changes will be communicated in the product or by email when needed.