Privacy policy

1. Data controller

The controller of personal data provided through youwonline.com is:

• Company name: BeachValencia Luxury SL
• Spanish tax ID (CIF): B56843402
• Address: Avenida Mare Nostrum, 40, 46120 Alboraya, Valencia, Spain
• Email: info@youwonline.com

2. Purposes of processing

Personal data is processed for the following purposes:

• Managing the user's account on the YouWon platform.
• Providing the contracted services: brand identity generation, campaign design, content creation, scheduled social media publishing and reporting.
• Invoicing and collecting payment for the contracted services.
• Sending service communications required to perform the contract (confirmations, publishing notifications, reports, incidents and changes to the service terms).
• Sending commercial communications about new features, promotions and recommendations, provided the user has given express consent, which may be withdrawn at any time.

3. Legal basis

Data processing is based on the following legal grounds under the General Data Protection Regulation (GDPR):

• Performance of the service contract entered into with the user (art. 6.1.b GDPR).
• Compliance with legal obligations applicable to the controller, in particular tax and accounting obligations (art. 6.1.c GDPR).
• The data subject's express consent for commercial communications and, where applicable, for the use of non-essential cookies (art. 6.1.a GDPR).

4. Data we collect

While providing the service we may collect the following categories of data:

• Registration data: name, email address and password (always stored encrypted).
• Billing data: name or company name, billing address, tax ID and country of residence.
• Customer business data: information about the customer's industry, products or services, target audience, marketing goals and any other information voluntarily provided in the onboarding questionnaire.
• Generated creative materials: logos, colour palettes, texts, images and advertising assets. These materials belong to the customer and are stored solely to deliver the service.
• Usage data: technical access logs, IP addresses, browser type, platform interactions, publishing logs and campaign metrics.

5. Retention period

Data will be retained for the duration of the contractual relationship with the user. Once that relationship ends, data will be kept blocked for the periods required by applicable law, in particular the five-year period required by Spanish tax and accounting rules. After those periods, data will be securely deleted.

6. Recipients and processors

To deliver the service, the controller shares certain data with the following providers, who act as processors under contract in accordance with article 28 GDPR:

• Supabase Inc.: database and authentication (servers in Frankfurt, European Union).
• Vercel Inc.: website hosting and delivery (global infrastructure with a signed DPA).
• Anthropic PBC: Claude API for text content generation (United States; covered by the Standard Contractual Clauses approved by the European Commission).
• Replicate Inc.: AI image generation (United States; covered by the Standard Contractual Clauses).
• Paddle.com Market Ltd.: payment processing and invoicing as merchant of record (United Kingdom and European Union).
• Resend Inc.: transactional email delivery (United States; covered by the Standard Contractual Clauses).
• Meta Platforms Inc.: publishing content on Facebook and Instagram, only when the user voluntarily connects their account and exclusively for authorised actions.

7. International transfers

Some of the providers listed are established outside the European Economic Area. In such cases, international transfers are covered by the Standard Contractual Clauses (SCC) approved by the European Commission through Implementing Decision (EU) 2021/914, which guarantees an adequate level of protection for the transferred data.

8. User rights

The user may at any time exercise the following rights over their personal data:

• Access to their personal data.
• Rectification of inaccurate data.
• Erasure when, among other grounds, the data is no longer needed for the purposes for which it was collected.
• Objection to processing on grounds related to their particular situation.
• Restriction of processing.
• Portability of data to another controller.
• Withdrawal of consent given for specific purposes, without affecting the lawfulness of previous processing.

9. Complaint to the supervisory authority

To exercise any of these rights, the user may contact the controller at info@youwonline.com, stating the right they wish to exercise and, where appropriate, attaching a copy of an identification document.

If the user considers that the processing of their data does not comply with applicable law, they may lodge a complaint with the Spanish Data Protection Agency (AEPD), whose contact information is available at www.aepd.es.

10. Security measures

The controller applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including password encryption, mandatory HTTPS, Row Level Security in the database, restricted data access for authorised staff only and continuous monitoring of security incidents.

11. Minors' data

The services offered through youwonline.com are not directed to minors under 18 years of age. The controller does not knowingly collect personal data from minors. If we detect that a minor has provided data, it will be deleted immediately.