Privacy Policy

Important Notice: This is a courtesy translation of the original Privacy Policy in Spanish, which is the only legally binding one.

Lapsula, SL (EU VAT: ESB19784248) ("Lapsula") takes the protection of your personal data very seriously.

This privacy notice provides information about what data Lapsula collects through the online platform accessible under the domain lapsula.com ("online platform") and how we process and use this data.

This privacy notice is subject to change to reflect continuous improvements to our online presence and the implementation of new technologies to enhance our services.

We reserve the right to make changes to this privacy notice.

We recommend checking this privacy notice regularly to take into account any changes.

1. Information on the Collection of Personal Data

This privacy notice provides information on the collection of personal data when you visit our website.

Personal data comprises all information that can be used to identify you personally, for example, name, address, email addresses, user behavior.

The data controller for this website pursuant to Art. 4(7) GDPR is:

Lapsula, SL
EU VAT: ESB19784248
Carrer d'Espronceda, 63
Barcelona, Spain
Email: [email protected]

When you contact us by email or via a contact form, we will store the data you disclose to us (your email address, name, phone number, etc.) to respond to your inquiry.

The legal basis for this is Art. 6(1)(f) GDPR (our legitimate interest in responding to your request).

The data collected for this purpose will be erased as soon as storage is no longer necessary, or we will restrict its processing in case of legal retention obligations (for example, under commercial or tax law).

If we engage third-party service providers for individual functions of our website or would like to use your data for advertising purposes, we will notify you in advance and, where required by law, obtain your consent.

In this case, we would like to point out that you will still be able to use our services as usual even if you do not consent to the use of your data for other purposes.

We only process your data for the purpose for which it was collected and according to the applicable legal basis (in particular Art. 6(1)(a), (b), or (f) GDPR, see also Section 8 below).

We will be happy to provide you with further information regarding your rights in this respect at any time.

2. Your Rights

You have the following rights regarding your personal data stored by us:

• Right to information (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to data portability (Art. 20 GDPR)

You also reserve the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) regarding the processing of your personal data carried out by us.

3. Collection of Personal Data When Visiting Our Website

Informational use: In the case of a purely informational use of our website, i.e., if you do not register or otherwise transmit information to us, we will only collect the personal data that your browser transmits to our server.

If you wish to view our website, we collect the following data, which is technically necessary to display our website and ensure its stability and security (Art. 6(1)(f) GDPR):

• IP address
• Date and time of the visit
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific pages)
• Access status/HTTP status code
• Volume of data transmitted per visit
• Website from which the request originated
• Browser type and version
• Operating system and its interface
• Language and version of the browser software

Cookies: In addition to the data specified above, cookies will also be saved to your device when you visit our website.

Cookies are small text files assigned to your browser and stored on your hard drive, allowing the website setting the cookie (us, in this case) to receive certain information.

Cookies cannot execute programs or transfer viruses to your computer.

Their purpose is to make the website as user-friendly and effective as possible.

Transient cookies (for example, session cookies) are automatically deleted when you close your browser.

These store a session ID, which is used to assign various requests made during a session to your browser.

This allows future recognition of your device when you return to the website.

Session cookies are deleted when you log out or close your browser.

Persistent cookies are automatically deleted after a defined period, which varies from cookie to cookie.

You can clear cookies in your browser's security settings at any time.

You can configure your browser settings according to your preferences and, for example, block third-party cookies or all cookies.

We would like to point out that blocking cookies may prevent certain functions on this website from operating correctly.

If you create an account, we may use cookies to identify you on subsequent visits.

Otherwise, you would need to log in again on each visit.

The use of cookies for analytics or marketing (if applicable) is based on your consent under Art. 6(1)(a) GDPR.

You can withdraw your consent at any time via our cookie banner or by adjusting your browser settings.

4. Third Parties We Use on Our Website

Below, we describe the third-party tools and integrations that may be used on our website.

Whenever we process or allow the processing of personal data through these tools, it is:

• based on your consent (Art. 6(1)(a) GDPR),
• required for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR),
• or carried out in pursuit of our legitimate interests (Art. 6(1)(f) GDPR) in providing and optimizing our services.

We only integrate these third-party tools and services in compliance with applicable data protection rules. Below, we detail what types of data each provider may collect, how data is used, shared, or transferred, and the relevant legal bases under the GDPR.

Alphabet Inc. (Google Cloud, Google Calendar, Google Meet)

• Types of data collected: Contact details (e.g., name, email address), calendar details, usage data (e.g., IP address, device/browser information), and metadata. If you use our Google Calendar integration while logged into your Google account, certain data may be associated with that account.
• Purpose and use: We rely on Google Cloud for IT and cloud services (including hosting), and use Google Calendar and Google Meet for scheduling integrations. This allows us to provide a reliable infrastructure, streamline appointment bookings, and facilitate virtual meetings.
• How we share, transfer, or disclose Google user data:
  • We do not sell, rent, transfer, or disclose your Google user data to third parties for purposes beyond those necessary to provide our services or comply with applicable laws.
  • When sharing with third parties is necessary (e.g., for hosting or synchronization purposes), such sharing is strictly limited to service providers under contractual obligations to process data only on our behalf and according to our instructions.
  • We do not transfer or disclose your Google user data for marketing or advertising purposes. Any data shared with Google itself is governed by Google's own privacy policies (Google Privacy Policy).
  • If international transfers of your Google user data occur (e.g., if Google servers are located outside your country of residence), we rely on appropriate safeguards such as Standard Contractual Clauses, in compliance with the GDPR.
  • If the URL of this Privacy Policy changes, we will update our Google OAuth consent screen settings in the Cloud Console accordingly. Otherwise, we will respond directly to the relevant email notification from the OAuth verification team once required updates are completed.
• Legal basis: Art. 6(1)(b) GDPR if data processing is necessary for the performance of our contract with you (e.g., scheduling appointments), Art. 6(1)(f) GDPR (legitimate interest in providing stable services and a user-friendly platform), or Art. 6(1)(a) GDPR (consent) if analytics or certain optional integrations require explicit permission.

Supabase Inc.

• Types of data collected: Database records, user identifiers, usage logs (depending on the feature used, e.g., if you create an account or submit forms).
• Purpose and use: Supabase provides managed database and backend services, allowing us to store user account information, form submissions, and other data necessary to operate our platform.
• Sharing and transfer: We do not sell, transfer, or disclose your data. Data may be transferred to Supabase or its sub-processors for database hosting and management. Transfers may involve servers outside the EEA, with Supabase implementing adequate safeguards to ensure GDPR compliance (e.g., Standard Contractual Clauses).
• Legal basis: Depending on the feature, Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in safe and efficient database management). In certain cases, your consent (Art. 6(1)(a) GDPR) may apply (e.g., if you opt into specific features that store or process additional data).

Hetzner Online GmbH

• Types of data collected: Server logs, IP addresses, application data, and hosted files necessary for the operation of the service.
• Purpose and use: Hetzner provides physical hosting infrastructure and servers on which we operate and maintain our platform and web services.
• Sharing and transfer: We do not sell or disclose your personal data to third parties. Data stored or processed on Hetzner's infrastructure remains hosted within secure data centers in the European Union.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring secure, efficient, and stable web hosting) and Art. 6(1)(b) GDPR (performance of a contract to make platform features available to the user).

Cloudflare Inc.

• Types of data collected: IP addresses, security-related data (e.g., to detect malicious traffic), limited request logs, and application files/data stored via its object storage services (Cloudflare R2).
• Purpose and use: Cloudflare acts as a Content Delivery Network (CDN), provides security features (e.g., DDoS protection), and offers object storage services to store and serve media files and digital assets efficiently and securely.
• Sharing and transfer: We share traffic information with Cloudflare to enable these CDN, security, and storage services. We do not sell, transfer, or disclose your data. Cloudflare may process data in different regions; however, it implements safeguards such as Standard Contractual Clauses to comply with the GDPR.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring security, efficient object storage, and website performance).

Stripe Inc.

• Types of data collected: Payment details (e.g., credit card token), billing information (e.g., name, address), and transaction metadata.
• Purpose and use: Stripe enables secure payment processing for subscriptions or one-off purchases, managing billing cycles and payment confirmations.
• Sharing and transfer: We do not sell, transfer, or disclose your payment data. Payment information is transmitted securely to Stripe for processing, which may involve global transfers to banking partners. Stripe and its sub-processors adhere to PCI-DSS and GDPR compliance measures.
• Legal basis: Art. 6(1)(b) GDPR (performance of payment obligations under contract). Where financial regulations apply, Art. 6(1)(c) GDPR (legal obligations) may also be relevant.

Odoo SA

• Types of data collected: Billing details, invoicing records, and other financial information required to issue invoices.
• Purpose and use: We use Odoo to manage invoicing. Your data is processed to generate and manage invoices and related financial documents.
• Sharing and transfer: We do not sell, transfer, or disclose your personal data. Certain data may be stored on Odoo's servers or its sub-processors, potentially located outside your jurisdiction, under GDPR-approved safeguards.
• Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (compliance with accounting and tax obligations).

tawk.to Inc. / Alaio Inc. (Bitrix24)

• Types of data collected: Chat transcripts, contact information (e.g., name, email), and any additional details you voluntarily provide via chat.
• Purpose and use: These customer service tools enable real-time support and management of user inquiries.
• Sharing and transfer: We do not sell, transfer, or disclose your chat data. It is stored with tawk.to or Bitrix24 and may be transferred internationally, with contractual and technical safeguards ensuring GDPR compliance.
• Legal basis: Art. 6(1)(b) GDPR (to respond to customer requests under a contract) or Art. 6(1)(f) GDPR (legitimate interest in providing efficient support).

Resend Inc.

• Types of data collected: Email addresses, names, message content, email delivery logs, and interaction metrics (e.g., delivery confirmation and open status).
• Purpose and use: We use Resend for technical delivery and management of transactional emails (e.g., account confirmations, order notifications, password resets) as well as promotional communications and newsletters.
• Sharing and transfer: We do not sell or rent your email address or personal data. Information is shared with Resend solely to manage the dispatch and tracking of communications. For data transfers outside the EEA, Resend applies appropriate contractual safeguards such as EU-approved Standard Contractual Clauses.
• Legal basis: Art. 6(1)(b) GDPR (performance of a contract) for transactional emails essential to the service, Art. 6(1)(a) GDPR (consent) for marketing communications or newsletters, and Art. 6(1)(f) GDPR (legitimate interest in maintaining prompt and reliable communication with users).

Meta Platforms Inc. (WhatsApp Integration)

• Types of data collected:
  Phone numbers, message content, technical data (e.g., device information, timestamps), and any additional details you choose to share via WhatsApp. If you are logged into your WhatsApp account, certain data (e.g., your profile name or photo) may also be visible and linked to that account.
• Purpose and use:
  We integrate WhatsApp to facilitate efficient communication and customer support, allowing you to inquire about our services, receive timely updates, and address any questions or issues. When necessary, we may also send transactional information (e.g., confirmation messages regarding a booking or order).
• Sharing and transfer:
  We do not sell, transfer, or disclose your WhatsApp data to unrelated third parties. Message content, phone numbers, and other relevant data are transmitted through WhatsApp servers, which may be located globally. Meta may process and store this data under its own privacy policy. We only share or transfer your data as necessary to:
  • Provide the requested communication or service (e.g., responding to your inquiries via WhatsApp).
  • Comply with applicable laws or valid legal requests (e.g., a court order).
  In all cases, we require any third party (including Meta) receiving such data to maintain equivalent levels of protection and only use the data for the specific requested purposes. You may opt to avoid such data sharing by contacting us through an alternative communication channel (e.g., email).
• International data transfers:
  WhatsApp may route data through servers outside the European Economic Area (EEA). When this occurs, such transfers are governed by appropriate safeguards (e.g., Standard Contractual Clauses) in accordance with the GDPR. We recommend reviewing the WhatsApp Privacy Policy to understand how Meta manages your data.
• Legal basis:
  We rely on:
  • Art. 6(1)(b) GDPR (performance of a contract or steps taken at your request prior to entering into a contract) if WhatsApp is used to facilitate or finalize bookings, orders, or customer service inquiries linked to a contractual relationship.
  • Art. 6(1)(f) GDPR (our legitimate interest in providing effective customer communication) when you voluntarily choose to contact us via WhatsApp for information or support.
  You may withdraw consent to communicate via WhatsApp at any time or choose a different communication channel, without affecting your access to our services.

Twilio Inc. / Celerity Systems (Pty) Ltd.

• Types of data collected: Phone numbers, SMS message content, delivery/receipt metadata.
• Purpose and use: These providers power SMS gateway services for notifications, two-factor authentication, and other verification needs.
• Sharing and transfer: We do not sell, transfer, or disclose your phone number or SMS content. Data is transmitted to Twilio or Celerity Systems solely to deliver SMS messages. They may route data globally under GDPR-approved mechanisms for cross-border transfers.
• Legal basis: Art. 6(1)(b) GDPR (performance of a contract) if the SMS is necessary for a service you requested, or Art. 6(1)(f) GDPR (legitimate interest in secure and timely notifications).

Zoom Communications Inc.

• Types of data collected: Audio/video streams, names, email addresses, and any other personal data you share during videoconferences (e.g., chat messages).
• Purpose and use: Zoom is used for videoconferencing and virtual appointments, supporting remote communication and collaboration.
• Sharing and transfer: We do not sell, transfer, or disclose your meeting or conference data. It is shared with Zoom solely to establish and maintain the session. Zoom may store or process data on servers located worldwide, but it implements security measures and contractual provisions to ensure GDPR compliance.
• Legal basis: Art. 6(1)(b) GDPR if the videoconference is necessary to perform a contract (e.g., scheduled session) or Art. 6(1)(f) GDPR (legitimate interest in providing remote communication).

Zapier Inc.

• Types of data collected: Relevant data from integrated services (e.g., form submissions, contact details, or other information you provide) depending on the configured automated workflows.
• Purpose and use: Zapier automates workflows between multiple applications (e.g., syncing form submissions to a CRM or sending you notifications) to streamline data flows and reduce manual handling.
• Sharing and transfer: We do not sell, transfer, or share your data with unrelated third parties. Data may transit or be stored on Zapier's servers, which might be located outside the European Economic Area (EEA). When international transfers occur, Zapier implements contractual and technical safeguards (such as Standard Contractual Clauses) to ensure GDPR compliance.
• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in efficient process automation). If an automated workflow is necessary for the performance of a contract with you (e.g., processing your order data), Art. 6(1)(b) GDPR may also apply.

5. Social Media Presence

Lapsula maintains a presence on social media networks or platforms (e.g., Facebook, Instagram, LinkedIn) to communicate with prospective and current customers and provide information about our services.

If you visit our official page on these platforms, the operators of the social networks process personal data under their own responsibility.

We may receive statistical data (e.g., via "Page Insights") regarding the use of our page.

These statistics may contain aggregated demographic and interaction data.

Such data is usually anonymized for us, and we process it based on our legitimate interest (Art. 6(1)(f) GDPR) in evaluating the reach and effectiveness of our social media presence.

For details on how social media providers handle personal data (including any profiling activity), please consult the privacy policies of the respective platform operators.

You may also assert your rights as a data subject directly with these operators.

6. Use of the Booking Platform (Registration and Account Management)

Our website features an online booking platform.

As a user, you can register for an account or book specific services.

When you do so, we collect only the data necessary to process your booking or account setup (e.g., name, email address, payment details, booking preferences).

Data storage: We store this data on secure servers.

If you have an account, you can review, edit, or request the deletion of your account data.

When we are legally required to retain certain data (e.g., for tax or accounting reasons), we will restrict its processing instead of deleting it.

Log data: When you use our booking platform, log files may be temporarily stored for IT security and error analysis. These logs are regularly erased or anonymized unless longer retention is necessary for evidentiary purposes (Art. 6(1)(f) GDPR).

7. Data Protection for Bookings and Other Transactions

If you make a booking or transaction through lapsula.com, we process your personal data (e.g., contact details, payment data, booking details) to fulfill our contractual obligations (Art. 6(1)(b) GDPR).

We also maintain records to satisfy legal obligations (Art. 6(1)(c) GDPR), such as tax and commercial laws, which may require the retention of transaction data for statutory periods.

If the contractual relationship is concluded or if you withdraw from it, your data will be deleted or restricted unless the law requires further retention or legitimate interests exist (Art. 6(1)(f) GDPR), such as defending legal claims.

8. General Terms: Legal Basis

Whenever we obtain consent for a specific processing purpose, Art. 6(1)(a) GDPR serves as the legal basis.

If the processing of personal data is necessary for the performance of a contract to which you are a party, such as for billing or providing our booking services, Art. 6(1)(b) GDPR is the basis.

This also applies to pre-contractual measures, for example, responding to your inquiries about our services.

If we are subject to a legal obligation requiring the processing of personal data (e.g., retention obligations under tax law), the basis is Art. 6(1)(c) GDPR.

Processing may also be based on Art. 6(1)(d) GDPR if necessary to protect your vital interests or those of another natural person (rare emergency scenarios).

Processing may take place on the basis of Art. 6(1)(f) GDPR if necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by your fundamental rights and freedoms.

9. Newsletter

If you provide your consent (Art. 6(1)(a) GDPR), you can subscribe to our newsletter to receive information about our latest offers and services.

The services and offers we promote in the newsletter are specified in the consent form.

We use a triple opt-in process: after registering, we send you an email asking you to subscribe to a plan.

If you do not confirm within a reasonable time, we send a reminder;

if no response is given, your data is blocked and automatically deleted after one month.

The only mandatory information for receiving the newsletter is your email address.

Providing additional information (e.g., your name) is optional and serves to address you personally.

You can withdraw your consent to receive the newsletter at any time and unsubscribe.

To do so, click the link in any newsletter email or send an email to [email protected].

We analyze your user behavior regarding our newsletters (e.g., opens, link clicks) in a pseudonymized manner.

The legal basis for this analysis is also Art. 6(1)(a) GDPR (consent).

You can opt out of tracking by unsubscribing from the newsletter.

10. Social Media Plugins

We may use social media plugins (e.g., from Instagram, Twitter, LinkedIn, YouTube) on our website.

We use the "double-click solution," meaning your personal data is not transferred to plugin providers until you click the plugin button.

Once activated, the plugin provider receives the information that you have accessed the corresponding page on our website.

In addition, the data mentioned in Section 3 of this notice is transmitted to them.

This occurs regardless of whether you have an account with the plugin provider or are logged in.

If you are logged into your account with the plugin provider, the data we collect will be associated directly with your existing account.

If you click the activated button and link to the page, for example, the plugin provider will also store this information in your user account and share it publicly with your contacts, depending on your account settings.

We have no influence over the data collected or the processing and do not know the full extent of data collection, the purpose of processing, or storage periods.

For more information, please consult the privacy notices of the respective plugin providers.

We offer these plugins to enable you to interact with social networks and other users, helping us improve our platform.

The legal basis for using such plugins is typically Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest in offering an interactive website).

Further Information and Contact

We retain personal data only as long as necessary for the relevant purpose or if legally required to do so.

Subsequently, we erase or anonymize the data in accordance with statutory provisions.

If you have any questions or concerns about this privacy notice, or wish to exercise your rights as a data subject, please contact us at:

Lapsula, SL
EU VAT: ESB19784248
Carrer d'Espronceda, 63
Barcelona, Spain
Email: [email protected]

We will respond to your inquiry promptly, in compliance with the GDPR and other applicable data protection regulations.