Privacy Policy

1. Data controller

Communications are handled exclusively via email and WhatsApp, during Madrid business hours (UTC+1/UTC+2), Monday to Saturday.

2. Personal data we process

• Contact data: your WhatsApp number and, if you provide it, your name or your business's name.
• Conversation content: the messages you exchange with us (or with our AI) via WhatsApp or email, including those needed to manage your booking or enquiry.
• Booking data: service, date, time, booking references and payment status, when you contract our services or those of a business using our technology.
• Technical data: minimal technical logs (date/time, operational identifiers) required for the security and operation of the service.

We do not use tracking cookies, advertising pixels or analytics tools that identify individuals (see our Cookie Policy).

3. Purposes and legal bases (GDPR)

1. Handling your enquiries and managing bookings — performance of a contract or pre-contractual steps (art. 6.1.b GDPR).
2. Providing the contracted services (ReservaLista, WebLista, FlujoLista) — performance of a contract (art. 6.1.b GDPR).
3. Security, fraud prevention and service improvement — legitimate interest (art. 6.1.f GDPR).
4. Subsequent commercial communications — only with your consent, which you may withdraw at any time by replying “STOP” (BAJA) or by writing to us (art. 6.1.a GDPR).

4. Retention periods

We keep contact data and conversations for a maximum of 24 months from the last interaction, unless there is a legal obligation to retain them for longer or an ongoing contractual relationship. Technical data is kept strictly for as long as necessary for security purposes.

5. Data recipients

We do not sell or rent personal data. We only share strictly necessary data with the providers that help us operate: messaging providers (WhatsApp Business / Meta), processing and storage infrastructure providers, and email providers. Each provider processes the data on our instructions and under appropriate contractual safeguards.

6. International transfers

Part of our processing and storage infrastructure is located outside the European Economic Area. When we transfer personal data outside the EEA, we do so under appropriate safeguards, in particular the Standard Contractual Clauses approved by the European Commission, together with supplementary technical and organisational measures.

7. Your rights (GDPR)

You can exercise the following rights at any time, free of charge, by writing to [email protected]:

• Access your data and obtain a copy (art. 15).
• Rectify inaccurate data (art. 16).
• Erase your data (“right to erasure”, art. 17).
• Restrict processing (art. 18).
• Portability of your data in a structured format (art. 20).
• Object to processing based on legitimate interest (art. 21).
• Withdraw consent at any time (art. 7.3).

You may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) if you believe we have not properly addressed your rights.

8. California residents (CCPA/CPRA) — Notice at collection

This notice applies to California residents, in compliance with the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Categories of information we collect

• Identifiers: WhatsApp number, name.
• Information you send us: the content of your messages and booking data.
• Technical information: operational and security logs.

Purposes

Handling enquiries, managing bookings, providing the services, ensuring security and complying with legal obligations. We keep this information for up to 24 months from the last interaction (unless a legal obligation applies).

Your rights

• Know and access the personal information collected about you.
• Delete your personal information.
• Correct inaccurate personal information.
• Opt out of unsolicited communications (reply “STOP” (BAJA)).

You can exercise your rights by writing to [email protected]. We will respond within the statutory period (45 days, extendable by a further 45) and we will never discriminate against you for exercising them.

9. CalOPPA (California)

In compliance with the California Online Privacy Protection Act: this policy is accessible from a visible link in the footer of every page of this site; any changes will be described on this same page with their effective date; and you can request the deletion or correction of your data by email.

10. Minors

Our services are aimed at businesses and adults. We do not knowingly collect data from children under 13 (nor do we process the data of children under 16 without the consent of the holder of parental responsibility, in accordance with art. 8 GDPR). If you believe a minor has given us their data, write to us and we will delete it.

11. WhatsApp messages

• When we initiate contact, we always identify our brand (“Todas Lista”).
• You can stop receiving messages by replying “STOP” (BAJA) in any conversation, or by emailing us.
• We comply with Meta's WhatsApp Business Policy: no unsolicited bulk messaging and no deceptive practices.

12. Changes to this policy

We will publish any changes here with their effective date. If a change materially affects your rights, we will also communicate it through our usual contact channels.

Questions about this policy? Write to [email protected] and we'll explain it without the jargon.