OteayaEspañol

Language notice: This English translation is provided for convenience. The Spanish version prevails in the event of any discrepancy.

Disclaimer: This document was prepared with AI assistance and is offered as a starting point only. It is not legal advice and does not create a lawyer-client relationship. Laws may change. A qualified legal professional in Spain should review it before publication or use. The tool's author accepts no liability for its use.

Draft: complete the highlighted fields, confirm the providers and publish the data processing agreement before using monitors.

Privacy policy

Last updated: .

1. Controller and contact

The controller of account, billing, security and business relationship data is Derek Sanz Chiorean, a self-employed professional with tax ID 47479047D and business address at Carrer De La Generalitat, 8, Alcanar, who provides Oteaya under the trade name Wakefold. Website: https://wakefold.com. Contact: [email protected].

2. Scope and roles

This policy applies to people who visit the website, create an account, receive a team invitation, use the application or API, purchase a plan, or contact us. Oteaya is intended for professionals and organisations.

For account, billing, security and platform-operation data, the provider acts as controller. For content a customer organisation enters or configures in its monitors, the organisation is the controller and Oteaya may act as processor only when processing that data on its documented instructions. Roles are determined by the specific processing and are not changed merely by the name of an agreement. Before enabling monitors that process personal data, the parties must complete and sign the data processing agreement template. The customer must determine and document its purposes and lawful basis, provide required notices and handle data-subject rights.

3. Data, purposes and legal bases

Data marked as required in the registration form is necessary to create an account or provide dependent features. We do not request special-category data; customers must not include it in monitor queries or content.

4. Providers and recipients

Data may also be received by customer-organisation members according to their permissions, platforms from which public posts are obtained (such as X and Telegram), news sources, and authorities where legally required. We do not sell personal data or use it for behavioural advertising.

5. International transfers

Some providers may process data outside the European Economic Area. In those cases, transfers will take place only under the mechanism applicable to the provider and destination, such as an adequacy decision or standard contractual clauses included in the provider's data-processing terms, together with any required supplementary measures. The region and safeguards for each provider account must be confirmed before the relevant service is enabled. You may request the applicable contractual information by emailing [email protected].

6. Retention and deletion

We retain account data while the account is active and afterwards for as long as needed to meet legal obligations and address liability or claims. You may request deletion at [email protected]. We retain data required by law or needed to establish, exercise or defend claims, and restrict it where appropriate.

Monitor content is retained according to plan history: currently 30, 90 or 180 days depending on the plan, and 30 days for the Incident pass. The period runs from an item's first collection, not from cancellation. When an organisation no longer has an active plan, a default maximum of 30 days from first collection applies, so older items may be deleted sooner. Content not associated with a monitor is purged sooner: news and X posts after 2 days, and public Telegram messages after 14 days. Account data is retained while the account is active and after a deletion request only for applicable legal or claims periods. The planned retention period for technical logs is no more than 30 days unless a longer period is justified; automatic deletion still needs to be configured and verified. Backups are retained for 7 days on the server and up to 30 days in the remote storage service when the documented task is active. Billing data is retained for applicable statutory periods.

7. Cookies and browser storage

Authenticated sessions use technical cookies needed to start and maintain a session. The application also stores notification preferences and identifiers for items marked as read locally in the browser. The current product code does not use analytics or advertising cookies; the deployed configuration must be reviewed before publication. If technologies not needed to provide a requested feature are introduced, the applicable prior consent will be requested.

8. Rights and complaints

Where applicable, you may request access, rectification, erasure, objection, restriction and portability by writing to [email protected]. We will respond within the legal period, normally one month. We may request reasonable information to verify your identity. If processing is based on consent, you may withdraw it at any time without affecting prior lawful processing. You may also complain to the Spanish Data Protection Agency at www.aepd.es. For data processed as controller by a customer organisation, contact that organisation; Oteaya will assist it under the data processing agreement and applicable law.

9. Security and changes

We apply reasonable technical and organisational measures to protect data, restrict access and manage incidents in light of service risks. No internet-connected system can guarantee absolute security. We will publish updates to this policy here with their effective date. If a change requires a new legal basis or prior information, we will provide it before starting that processing.

Items to complete before publication