Privacy policy

Data controller

• Controller: RENTATOP TECH, S.L.
• Tax ID (NIF): B26742510
• Address: Calle José Antonio Coderch, 50, 28055 Madrid, Spain
• Contact: [email protected]

We apply the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Spain's Organic Law 3/2018 on Personal Data Protection (LOPDGDD).

What data we process

Cobote is designed to handle as little data as possible. We don't ask for an email, a phone number or an account, and there is no sign-up.

• What the group writes in its trip: the trip's name, dates, house or place, the names (or nicknames) of the people going, the shopping list, expenses, games and payments marked as done. Please don't write data that isn't needed, such as surnames, phone numbers or bank details.
• Technical data: the IP address and the details of each request are kept in the server logs for a limited time, for security and to prevent abuse (for example, creating trips in bulk).
• Where the trip came from: when it is created we keep the website you arrived from (for example, google.com) and, if the link carried one, the campaign (the utm parameters). It does not identify you.
• On your own phone: Cobote stores in your browser who you are in each trip and the trips you've opened, so it doesn't have to ask every time. That never leaves your device. More in the Cookie policy.

We use no advertising or profiling, and we never sell or share data. To know how many visits the site gets we use Cloudflare Web Analytics, which counts visits without cookies, without storing anything on your device and without identifying you.

Why, and on what legal basis

We process this data only to provide the service you ask for: storing the trip and working out the group's balance (performance of the service, Art. 6(1)(b) GDPR), and to keep it secure and prevent abuse (legitimate interest, Art. 6(1)(f) GDPR).

We count how many trips are created, where they come from and how much they are used (how many people, expenses, games and payments they have), without looking at what the group writes or at any names, to know whether the service works (legitimate interest).

Who can see a trip

Anyone who has its link. The link is the only key: share it only with your group. If you pass it to someone, they will be able to see and edit the trip.

If the trip was created from the “Your stay” page of a property that uses Amplistay (another RENTATOP TECH product), Amplistay sent Cobote the property's name, the dates of the stay and the first names of the guests, and keeps the link in the booking to show it to the guests. The property's host does not see the trip or its link.

Providers (processors)

• Railway Corporation: hosting of the app and its database, on servers in the European Union (Amsterdam).
• Cloudflare, Inc.: DNS, content delivery, attack protection and cookieless visit statistics (Web Analytics); requests go through its network.

Where any of them may process data outside the European Economic Area, they do so with GDPR safeguards (the European Commission's standard contractual clauses or the EU-US Data Privacy Framework).

How long we keep it

A trip is kept while it's in use. We may delete trips with no changes for more than 12 months. If you'd like us to delete one sooner, email [email protected] with its link. Server logs are deleted automatically within a few weeks.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to [email protected]. As there are no accounts, we'll need the trip's link to know which one you mean; we'll never ask for more data than needed.

If you believe we haven't handled your rights properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Children

Cobote is not intended for children under 14.

Changes

If anything important changes in how we handle data, we'll update this page and its date.