Privacy Policy

This Privacy Policy explains how Hola Money Sociedad Limitada (“Hola Money S.L.”, “Buzzmark”, “we”) handles personal data when you visit our websites, create an account and use the Buzzmark transactional email platform (the “Service”). We are committed to processing personal data in accordance with the EU General Data Protection Regulation (“GDPR”) and applicable Spain law.

1. Controller vs. processor

We wear two hats, and it matters which one applies:

• As a controller - for the personal data of our account holders and website visitors (your name, email, billing and usage data). This Policy governs that processing.
• As a processor - for the personal data contained in the messages and recipient lists you send through the Service. There, you are the controller and we act on your instructions under our Data Processing Agreement.

2. Who we are (the controller)

Hola Money Sociedad Limitada, NIF B26671347, Registro Mercantil de Almería, Hoja AL-66006, registered office C/ Granada 7, 04820 Vélez-Rubio, Almería, Spain. For privacy matters, contact privacy@buzzmarkapp.com or our data protection contact at dpo@buzzmarkapp.com.

3. What we collect

• Account data - name, email address, password (hashed), organisation and team-member details.
• Billing data - plan, billing contact and transaction records. Card details are handled by our payment processor, not stored by us.
• Usage & log data - IP address, device/browser information, API and dashboard activity, and message-event metadata (sends, opens, clicks, bounces) generated as you use the Service.
• Communications - support requests and correspondence.
• Cookies - essential cookies needed to run the dashboard and keep you signed in (see §7).

4. Why we use it, and our legal bases

Purpose	Legal basis (Art. 6 GDPR)
Provide, operate and secure the Service; authenticate you	Performance of a contract
Billing, accounting and tax records	Contract; legal obligation
Prevent abuse, fraud and spam; protect deliverability	Legitimate interests
Improve and troubleshoot the Service	Legitimate interests
Product or marketing emails to you	Consent or legitimate interests (you can opt out at any time)
Comply with legal requests and obligations	Legal obligation

5. Personal data in your messages

To deliver, track and log your email, the Service processes the recipient addresses, message content and engagement metadata you submit. For that processing we act as your processor, strictly on your documented instructions and under the DPA. We do not use your message content or recipient lists for our own purposes.

6. Sharing & sub-processors

We do not sell personal data. We share it only with:

• Sub-processors that help us run the Service - for example EU hosting/infrastructure, outbound mail transfer, content delivery and a payment processor. The current list is maintained in the DPA.
• Professional advisers and authorities where required by law or to protect our rights.
• A successor in the event of a merger, acquisition or reorganisation, subject to this Policy.

7. Data residency & international transfers

We host and process personal data in EU data centres located in Frankfurt (Germany) and Paris (France). We are an EU-owned company and do not transfer your account or message data outside the EEA in the ordinary course of providing the Service. The one necessary exception is email delivery itself: when you send a message to a recipient whose mailbox is hosted outside the EEA, the message is transmitted to that recipient’s mail server by design. Where any transfer of personal data outside the EEA would otherwise occur, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses. See our EU Data Residency page for details.

8. Cookies

Our dashboard uses strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. These are required for the Service to function and do not require consent. We do not use advertising cookies. If we introduce optional analytics, we will request consent first and update this Policy.

9. How long we keep it

We keep account and billing data for as long as your Account is active and then as required to meet legal, accounting and tax obligations (typically up to the limitation periods under Spain law). Message logs and event metadata are retained for the period associated with your plan (for example up to 90 days), after which they are deleted or anonymised. Message content is retained only as long as needed to provide the Service and then removed in line with the DPA.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS) and at rest, hashed credentials and API tokens, encrypted secrets, role-based access controls, network isolation and audit logging. No method of transmission or storage is completely secure, but we work continually to protect your data.

11. Your rights

Subject to the GDPR, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data (“right to be forgotten”);
• restrict or object to certain processing, including direct marketing;
• data portability;
• withdraw consent at any time, without affecting prior processing; and
• lodge a complaint with a supervisory authority.

To exercise your rights, email privacy@buzzmarkapp.com. You also have the right to complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, “AEPD”), www.aepd.es, or to the authority in your EU country of residence. Where your personal data appears in messages sent by one of our customers, please contact that customer (the controller) directly; we will assist them as their processor.

12. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 18.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new “last updated” date and, where changes are material, notify you by email or in-product.

14. Contact

Privacy: privacy@buzzmarkapp.com · Data protection contact: dpo@buzzmarkapp.com
Hola Money Sociedad Limitada, C/ Granada 7, 04820 Vélez-Rubio, Almería, Spain.