1. Who we are (Data Controller)
The data controller of your personal data is:
- Company: Digital Energy EOOD
- Registered address:
- Bulgarian EIK: 206936790
- Spanish NIF: N0398374I
- Commercial name: Ibiza Amigo (ibizamigo.com)
- Contact: hello@ibizamigo.com
- Privacy contact: privacy@ibizamigo.com
- Data Protection Officer (DPO):
Digital Energy EOOD is a Bulgarian company providing a recommendation and digital marketing service for tourism businesses in the Balearic Islands (Ibiza and Formentera). We are tax-resident in Bulgaria and have no permanent establishment in Spain. Our activity as a tourism booking centre (Central de Reservas) is registered in the Balearic Tourism Registry (REAT — registration in progress).
2. What data we collect
When you interact with Ibiza Amigo via WhatsApp, website or partner platform, we process:
| Category | Data | Source |
|---|---|---|
| Identification | Phone number, first name | WhatsApp profile |
| Content | Messages you send, language preference | You |
| Technical | Timestamp, message ID, country code | WhatsApp Cloud API |
| Commercial | Subscription status (free / Amigo Pass / Season Pass), payment status | Stripe |
| Behavioural | Search queries, categories requested, recommendations shown, bookings requested | Generated during service |
We do not collect or process special categories of personal data (Art. 9 GDPR) intentionally. Please do not share health, religious, political or sexual-orientation data with the bot.
3. Purposes and lawful bases (Art. 6 GDPR)
| Purpose | Lawful basis |
|---|---|
| Respond to your WhatsApp messages and provide recommendations | Art. 6(1)(b) — performance of the service you requested |
| Process subscription payments (Amigo Pass / Season Pass) | Art. 6(1)(b) — contract |
| Relay booking requests to partner businesses (restaurants, clubs, boats, transfers) | Art. 6(1)(b) — contract / pre-contractual step |
| Comply with tax, accounting and consumer-law obligations | Art. 6(1)(c) — legal obligation (Bulgarian Accountancy Act; Spanish tax rules where applicable) |
| Security, fraud prevention, abuse detection | Art. 6(1)(f) — legitimate interest in protecting the service |
| Analytics and quality improvement (aggregated/pseudonymised) | Art. 6(1)(f) — legitimate interest |
| Marketing messages (promotions, offers) | Art. 6(1)(a) — consent (opt-in, revocable anytime) |
4. Automated processing and AI (Art. 13(2)(f) / 22 GDPR)
Your messages are processed by an AI model (Claude, provided by Anthropic, PBC) to understand your request and generate recommendations. This is not automated decision-making with legal or similarly significant effects. You can at any time request human support by writing "HUMAN" in the chat.
5. Sub-processors and international transfers
We use the following sub-processors. Each is bound by a data processing agreement:
| Sub-processor | Role | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Meta Platforms Ireland Ltd. (WhatsApp Cloud API) | Messaging infrastructure | Phone, name, messages | EU (Ireland); some processing in US | SCCs + EU-US Data Privacy Framework |
| Anthropic, PBC (Claude AI) | AI message processing | Message content (no phone number sent) | United States | Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR |
| Stripe Payments Europe Ltd. | Subscription billing | Name, email, payment token, IP | EU (Ireland) + US | SCCs + DPF |
| Twilio Ireland Ltd. | Backup SMS notifications | Phone, message content | EU + US | SCCs + DPF |
| Railway Corp. | Hosting / infrastructure | All operational data | Currently US — migration to EU region in progress (target Q2 2026) | SCCs |
| Google Ireland Ltd. (Maps API) | Location look-up | Place-name queries (no user identifier) | EU + US | SCCs + DPF |
Copies of SCCs and sub-processor agreements are available on request at privacy@ibizamigo.com.
6. Retention
| Data | Retention |
|---|---|
| WhatsApp messages and conversation logs | 12 months from last interaction, then deleted or anonymised |
| User profile (phone, name, language) | Until you request deletion or 24 months of inactivity |
| Subscription and payment records | 6 years (Bulgarian Accountancy Act + Spanish tax law where applicable) |
| Marketing consents | Until withdrawn + 3 years proof of consent |
| Support tickets | 24 months |
| Backups | Rolling 30-day window, then overwritten |
7. Your rights (Art. 15–22 GDPR)
You have the right to:
- Access (Art. 15) — a copy of your data
- Rectification (Art. 16) — correct inaccurate data
- Erasure / "right to be forgotten" (Art. 17)
- Restriction (Art. 18)
- Portability (Art. 20) — receive your data in a machine-readable format
- Object (Art. 21), including to direct marketing
- Withdraw consent (Art. 7(3)) at any time without affecting prior lawful processing
- Not be subject to solely automated decisions (Art. 22)
How to exercise: send "DELETE" on WhatsApp, or email privacy@ibizamigo.com. We respond within 30 days (Art. 12(3) GDPR).
Right to complain (Art. 13(2)(d) / 77 GDPR):
- Spain — Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es
- Bulgaria — Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg
- Or your local EU/EEA supervisory authority.
8. Children
Ibiza Amigo is available to users aged 14 and over (Art. 7 LOPDGDD — Spanish Organic Law 3/2018). Users under 14 must have parental/guardian consent. We do not knowingly process data of users under 14. If you believe we have done so, contact privacy@ibizamigo.com and we will delete the data promptly.
9. Cookies and tracking
Our website uses cookies. See our Cookie Policy for the full list and consent mechanism. The WhatsApp bot itself does not set cookies.
10. AI disclosure
You are chatting with an AI bot powered by Claude (Anthropic). The bot handles most queries. Human support is always available — write "HUMAN" and a person from our team will follow up.
11. Security (Art. 32 GDPR)
We apply technical and organisational measures including:
- TLS 1.3 in transit
- Encryption at rest (AES-256) for database and backups
- JWT-based authentication for partner portal
- Role-based access control and principle of least privilege
- Secret management via encrypted vault
- Regular backups with geographic redundancy
- Logging and monitoring of access to personal data
- Staff confidentiality commitments
12. Breach notification (Art. 33–34 GDPR)
If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where the risk is high, notify you without undue delay.
13. Changes
We may update this policy. Material changes will be communicated via WhatsApp broadcast and posted at ibizamigo.com/privacy. The "Last updated" date at the top reflects the current version. Continued use of the service after an update constitutes acceptance of the revised policy where consent is not required.
1. Quiénes somos (Responsable del Tratamiento)
El responsable del tratamiento de tus datos personales es:
- Empresa: Digital Energy EOOD
- Domicilio social:
- EIK (Bulgaria): 206936790
- NIF (España): N0398374I
- Nombre comercial: Ibiza Amigo (ibizamigo.com)
- Contacto: hello@ibizamigo.com
- Privacidad: privacy@ibizamigo.com
- Delegado de Protección de Datos (DPO):
Digital Energy EOOD es una sociedad búlgara que presta un servicio de recomendación y marketing digital para negocios turísticos en las Illes Balears (Ibiza y Formentera). Somos residentes fiscales en Bulgaria, sin establecimiento permanente en España. Nuestra actividad como Central de Reservas está inscrita en el Registro de Empresas, Actividades y Establecimientos Turísticos de las Illes Balears (REAT — inscripción en trámite).
2. Qué datos recogemos
| Categoría | Datos | Origen |
|---|---|---|
| Identificación | Número de teléfono, nombre | Perfil de WhatsApp |
| Contenido | Mensajes enviados, idioma | Tú |
| Técnicos | Fecha/hora, ID de mensaje, prefijo país | WhatsApp Cloud API |
| Comerciales | Estado de suscripción (gratis / Amigo Pass / Season Pass), estado de pago | Stripe |
| De comportamiento | Búsquedas, categorías, recomendaciones mostradas, reservas solicitadas | Uso del servicio |
No tratamos categorías especiales de datos (Art. 9 RGPD) intencionadamente. Te rogamos no compartir con el bot datos de salud, religiosos, políticos u orientación sexual.
3. Finalidades y bases jurídicas (Art. 6 RGPD)
| Finalidad | Base jurídica |
|---|---|
| Responder a tus mensajes y ofrecer recomendaciones | Art. 6.1.b — ejecución del servicio |
| Cobrar las suscripciones (Amigo Pass / Season Pass) | Art. 6.1.b — contrato |
| Trasladar solicitudes de reserva a los negocios partners | Art. 6.1.b — contrato / medida precontractual |
| Cumplir obligaciones fiscales, contables y de consumo | Art. 6.1.c — obligación legal |
| Seguridad, prevención de fraude y abusos | Art. 6.1.f — interés legítimo |
| Analítica y mejora de calidad (agregada/seudonimizada) | Art. 6.1.f — interés legítimo |
| Comunicaciones comerciales | Art. 6.1.a — consentimiento (opt-in revocable) |
4. Procesamiento automatizado e IA (Art. 13.2.f / 22 RGPD)
Tus mensajes son procesados por un modelo de IA (Claude, de Anthropic, PBC) para interpretar tu petición y generar recomendaciones. No se trata de decisiones automatizadas con efectos jurídicos o similares. En cualquier momento puedes pedir atención humana escribiendo "HUMAN" en el chat.
5. Encargados del tratamiento y transferencias internacionales
| Encargado | Rol | Datos | Ubicación | Mecanismo |
|---|---|---|---|---|
| Meta Platforms Ireland Ltd. (WhatsApp Cloud API) | Mensajería | Teléfono, nombre, mensajes | UE (Irlanda); algún tratamiento en EEUU | SCC + EU-US DPF |
| Anthropic, PBC (Claude AI) | Procesamiento IA | Contenido de mensajes (sin teléfono) | EEUU | Cláusulas Contractuales Tipo (SCC) Art. 46.2.c RGPD |
| Stripe Payments Europe Ltd. | Cobros | Nombre, email, token de pago, IP | UE + EEUU | SCC + DPF |
| Twilio Ireland Ltd. | SMS de respaldo | Teléfono, contenido | UE + EEUU | SCC + DPF |
| Railway Corp. | Hosting | Todos los datos operativos | Actualmente EEUU — migración a región UE en curso (Q2 2026) | SCC |
| Google Ireland Ltd. (Maps) | Geolocalización | Consultas de lugares (sin identificador de usuario) | UE + EEUU | SCC + DPF |
Copias de las SCC disponibles a petición en privacy@ibizamigo.com.
6. Conservación
| Datos | Plazo |
|---|---|
| Mensajes y conversación | 12 meses desde la última interacción |
| Perfil (teléfono, nombre, idioma) | Hasta solicitud de borrado o 24 meses de inactividad |
| Suscripciones y pagos | 6 años (Ley de Contabilidad de Bulgaria + normativa fiscal española aplicable) |
| Consentimientos marketing | Hasta retirada + 3 años de prueba |
| Tickets de soporte | 24 meses |
| Copias de seguridad | Ciclo de 30 días |
7. Tus derechos (Arts. 15–22 RGPD)
Acceso, rectificación, supresión, limitación, portabilidad, oposición, retirada del consentimiento, y no ser objeto de decisiones automatizadas. Para ejercerlos: "DELETE" por WhatsApp o privacy@ibizamigo.com; respondemos en 30 días (Art. 12.3).
Reclamaciones (Arts. 13.2.d / 77): AEPD (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), CPDP (Bulgaria) o tu autoridad de control.
8. Menores
Servicio para mayores de 14 años (Art. 7 LOPDGDD). Entre 14 y 17 requiere consentimiento paterno/tutor. Si detectamos datos de un menor de 14, los eliminaremos.
9. Cookies, IA, seguridad, brechas, cambios
- Cookies: la web usa cookies — véase Política de Cookies. El bot de WhatsApp no usa cookies.
- IA: interactúas con un bot basado en Claude (Anthropic). Escribe "HUMAN" para atención humana.
- Seguridad (Art. 32): TLS 1.3, cifrado AES-256 en reposo, JWT, control de accesos por rol, gestión cifrada de secretos, backups redundantes, monitorización y compromisos de confidencialidad.
- Brechas (Arts. 33–34): notificación a la autoridad en 72 h y a ti sin dilación si el riesgo es alto.
- Cambios: se publicarán en ibizamigo.com/privacy; los sustanciales se comunican por WhatsApp.
- Confirm full Bulgarian registered address
- Confirm DPO appointment is not required (Art. 37 GDPR) given current processing volume
- Confirm retention of messages at 12 months vs current 90-day setting — align with tech implementation
- Confirm AEPD vs CPDP lead supervisory authority (likely AEPD because main establishment effect in Spain via REAT activity)
- Review whether WhatsApp broadcast counts as sufficient notice for material changes under Spanish consumer law