Privacy Policy

Last updated: 3 May 2026

1. Data Controller

Controller: Jose Santiago Mateos
Tax ID (NIF): 43565896D
Address: Martorell (Barcelona), Spain
Email: proyectos@asesmarket.com
Phone / WhatsApp: +34 644 55 14 08
Service: CartasQR (cartas.asesmarket.com)

2. Data We Process and Why

2.1 Demo request form (Landing page)

When you fill in the contact form at cartas.asesmarket.com, we collect:

• Your name
• Venue / business name
• Email address
• Phone number
• Free-text message
• IP address of the request (anti-spam security)

Purpose: to handle your request and contact you with information about CartasQR.
Legal basis: pre-contractual measures at the data subject's request (Art. 6.1.b GDPR).
Retention: up to 3 years from the last contact, or until you exercise the right to erasure.

2.2 Management panel (tenant clients)

If you subscribe to CartasQR, we process your account data (venue name, tax ID, address, phone, administrator email) to deliver the service and issue invoices.

Legal basis: performance of a contract (Art. 6.1.b GDPR).
Retention: for the duration of the contract and 5 years thereafter for tax obligations.

2.3 Anonymous analytics (diners scanning the QR)

When a diner scans the QR code, the system records:

• Device type inferred from User-Agent (mobile / tablet / desktop) — the full UA string is not stored
• Language selected
• Menu ID scanned
• Date and time (UTC)
• Referrer domain (if present)

The diner's IP address is never stored. Rate-limiting uses a daily rotating HMAC hash that is destroyed on rotation (irreversible; re-identification is not possible).
Legal basis: legitimate interest of the service provider (Art. 6.1.f GDPR) to improve the service. Processing is anonymous and does not require prior consent.
Retention: 24 months from the date of the record.

3. Recipients (data processors)

We do not share your data with third parties for advertising purposes.

4. Your Rights

You may exercise your rights of access, rectification, erasure, objection, restriction, and portability by writing to proyectos@asesmarket.com with the subject "GDPR Rights Request" and a copy of your identity document.

If you believe our processing infringes data protection law, you may lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es.

5. Cookies

The public menu ({slug}.cartas.asesmarket.com) uses no cookies of any kind. The administration panel uses a strictly necessary session cookie to authenticate the administrator — no tracking or advertising.

6. Security

All communications are encrypted with TLS 1.2/1.3. Passwords are stored with bcrypt (cost 12). Database access is local and not exposed to the internet.