1. Who we are
This platform — ecoxtrem.app and its subdomains (the “Platform”) — is operated by Blueway Mobility S.L. (“Ecoxtrem”, “we”), VAT ESB67503227, Carrer Llinars 12, 08480 L’Ametlla del Vallès, Barcelona, Spain. We are the data controller for the personal data described in this policy. You can reach us at [email protected].
2. What the Platform is
The Platform is Ecoxtrem’s internal company operating system: a set of private, invite-only applications used by our staff and by the distributors and business customers we work with — product catalogue, orders, shipments, logistics and after-sales. It is not a consumer service and there is no public sign-up; accounts are created by an Ecoxtrem administrator.
We also operate a Meta developer app, “Ecoxtrem App”, which connects our WhatsApp Business number (and, in future, our Facebook and Instagram business presence) to these tools. This policy covers that app as well.
3. What data we collect
- Account data. Your name, work e-mail address, phone number, role and the company you belong to. This is entered by an administrator when you are invited.
- Business partner data. For the company you represent: company name, tax ID, addresses, contact people, commercial terms, orders, shipments, invoices and after-sales cases.
- Security and usage data. One-time login codes (sent by e-mail or WhatsApp), session identifiers, IP address, browser type, time of access and an audit trail of access changes.
- Documents you upload. For example delivery notes or order photos. These may be processed by AI services to extract order details.
- WhatsApp. If you write to our WhatsApp number, or we send you a WhatsApp message (a login code, or — with your consent — news for distributors), we keep your WhatsApp phone number, the user ID WhatsApp assigns to our business for you, the messages you send us, the delivery and read receipts of the messages we send you, and your choice to stop or resume marketing messages.
- Facebook and Instagram. We do not offer Facebook Login and keep no Facebook account identifiers. We do not currently receive messages through Facebook or Instagram, and we do not collect data from Meta about people who have not contacted us.
4. Why we use it
- To run the Platform and serve your company — performance of a contract, or steps taken at your request before entering one.
- To keep the Platform secure — preventing abuse and auditing access, on the basis of our legitimate interest.
- Invoicing, accounting and tax — compliance with our legal obligations.
- Anything we ask your permission for (for example marketing messages) — your consent, which you can withdraw at any time.
5. Who we share it with
We do not sell personal data. We share it only with providers who process it on our behalf under contract: hosting (OVH, European Union), network and security (Cloudflare), transactional e-mail (Resend, EU region), AI document processing (Google, Anthropic, OpenAI), business messaging (Meta Platforms Ireland), shipment tracking services and carriers, and the marketplaces through which orders are placed. Some of these providers may process data outside the European Economic Area, in which case transfers rely on an adequacy decision or the EU Standard Contractual Clauses. We disclose data to authorities where the law requires it.
6. How long we keep it
- Account data: while your account is active and for up to 12 months after it is closed.
- Commercial and accounting records: 6 years from the end of the financial year, as required by Spanish commercial and tax law.
- Security logs: up to 12 months.
- WhatsApp messages and receipts: as long as needed to handle your enquiry or our messages to you, and no longer than 24 months — sooner if you ask us to delete them.
7. Your rights
Under the GDPR you may ask to access, rectify, erase, restrict or object to the processing of your personal data, and to receive it in a portable format. Write to [email protected]; we reply within one month. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).
8. Deleting your data
You can ask us to delete your personal data at any time. The data deletion page explains how, what is deleted, what we are legally required to keep, and how to check the status of a request. WhatsApp records are filed under your phone number, so to have them deleted write to us with that number: a request sent from your Facebook settings carries only a Facebook account ID, which we cannot link to them.
9. Security
Data is stored on servers in the European Union, encrypted in transit, accessible only to authorised staff through invite-only accounts, and backed up regularly.
10. Changes to this policy
We will update this page when our practices change and revise the date at the top. Significant changes are notified to account holders by e-mail.