1. Data Controller
Novitum Technologies OÜ, Narva mnt 5, 10117 Tallinn, Estonia · Reg: 17545241
Data Protection Officer email: privacidad@pulsecosta.es
2. Data We Collect
We collect the following data depending on the functionality used:Registration data: name, email, password (encrypted).Usage data: visited locations or places viewed, preferences, search history, device and operating system.Payment data: fully processed by Stripe. PulseCosta does not store card details.Location data: approximate, with your consent, to show nearby locations.For hotels: booking data (dates, language) linked to QR code, with signed DPA.
3. Purpose and Legal Basis
Your data is used for:
- Providing the contracted service (legal basis: contract performance)
- Processing payments and managing subscriptions (legal basis: contract performance)
- Improving the platform through aggregated analysis (legal basis: legitimate interest)
- Sending service communications, if you have given consent (legal basis: consent)
4. Data Sharing and Third Parties
We do not sell your data. We share data only with:Stripe: payment processor, with signed DPA. Stripe Privacy Policy →Firebase/Supabase: database infrastructure, with servers located in the EU where possible.Analytics services: anonymized and aggregated data, no personally identifiable information.
5. Your Rights (GDPR)
You have the right to: access, rectification, erasure, objection, data portability, and restriction of processing.To exercise these rights, send an email to privacidad@pulsecosta.es with subject "GDPR Rights Exercise" and attach a copy of your passport or other official identification. We will respond within the legal timeframe of 1 month.You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
6. Data Retention
We retain your data for the duration of your account. If you cancel, we delete or anonymize your data within a maximum of 30 days, except for legal retention obligations (invoices: 5 years according to Spanish tax law).
7. Security
We implement appropriate technical and organizational measures: encryption in transit (HTTPS/TLS), hashed passwords, restricted access to data, and 3D Secure authentication for payments.
8. Cookies
9. Automated Decision-Making and Artificial Intelligence
PulseCosta uses automated systems and Pepito, its app assistant, to organise and recommend locations based on visitor patterns and location, and your preferences. These decisions do not produce legal effects nor significantly affect the user within the meaning of Article 22 of the GDPR. Visitor data is processed in an aggregated and anonymous manner: we do not identify individuals or retain your location. You may request information about the decision-making logic by emailing privacidad@pulsecosta.es. Responses from Pepito, predictions, scores, and recommendations are advisory, may contain errors, and are not contractual; they should be cross-checked with official information from the venue.