Easypromos Privacy Policy

Last updated and effective from: 15 October 2026

PURPOSE AND SCOPE

This Privacy Policy explains how EASYPROMOS collects, uses, retains and protects personal data when acting as a data controller.

It applies to the personal data of:

Visitors to the Easypromos website.
People who create an account and people authorised to work with it, referred to as Agents.
Customers and customer contacts.
Prospective customers who request information, ask for a demo or contact the sales team.
People subscribed to marketing communications.
Users of the support service.
Attendees at webinars, events and other activities organised by EASYPROMOS; and
Suppliers, partners and other professional contacts.

This Policy applies globally. As a company established in Spain, EASYPROMOS processes personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 and other applicable Spanish and European data protection laws.

This Policy does not cover the personal data of participants that EASYPROMOS processes on behalf of its customers. In these cases, the customer acts as the data controller and EASYPROMOS as the data processor. This processing is governed by the Easypromos Data Processing Agreement and the privacy policy of each promotion.

DATA CONTROLLER

The data controller is:

EASYPROMOS, S.L.
Spanish Tax ID: B65576878
Registered office: C/ Bonastruc de Porta, 20, 17001 Girona, Spain
Privacy email: privacy@easypromosapp.com

EASYPROMOS has appointed a Data Protection Officer, who can be contacted at dpo@easypromosapp.com.

PERSONAL DATA WE PROCESS AND WHERE IT COMES FROM

Depending on a person’s relationship with EASYPROMOS and how they use our services, we may process the following categories of personal data:

Identity and professional data: information needed to identify and contact a person, such as first and last name, email address, telephone number, profile picture or social media username, as well as professional information relating to their company, role, industry, country or type of organisation.
Account data: information needed to create and manage an account, such as user and account identifiers, linked Agents, their roles and permissions, preferences and invitation status.
Usage and security data: information generated when using the website, platform or services, such as IP address, access date and time, device, browser, actions performed, features used, and technical and security logs.
Sales and business data: information needed to respond to enquiries and manage the commercial relationship, such as requested demos, interests, needs, communications and sales opportunity follow-up.
Billing and payment data: information needed to manage purchases, billing and payments, such as company name, billing address, tax ID, billing contact, purchased plan, amounts, transaction references and, where necessary, the bank account holder and account identifiers. EASYPROMOS does not access or retain full payment card details, which are processed by the payment gateway.
Support data: information needed to respond to enquiries and investigate issues, such as the content of conversations with the support team or chatbot, attachments and technical information related to the case.
Contract data: information related to entering into and performing the contractual relationship, such as proposals, contracts, signed documents, acceptance of the Terms of Use and evidence of such acceptance or signature.
Browsing data: information obtained through cookies and similar technologies on the public website, according to the preferences selected by the user in the cookie settings panel.

Personal data may be provided directly by the individual, by the customer or an account administrator, by providers used to sign in or configure SSO access, or generated through use of the website, platform and services.

Where there is an existing business relationship, EASYPROMOS may also enrich a contact’s professional information using publicly available information from their company, professional profile or equivalent sources. EASYPROMOS does not use these sources to obtain private information or special categories of personal data.

For the purposes covered by this Policy, EASYPROMOS does not need or request special categories of personal data or data relating to criminal convictions or offences. Users should avoid providing this type of information through forms, support enquiries or attachments unless it is strictly necessary and there is a valid legal basis.

Forms will indicate which information is required. If the necessary information is not provided, EASYPROMOS may be unable to respond to the request, create the account, complete the purchase or provide the relevant functionality. Any other information is optional.

PURPOSES, LEGAL BASES AND RETENTION

EASYPROMOS processes personal data for the purposes and retention periods set out below:

Purpose	Legal basis	Retention
Create and manage the account, identify its users, and manage Agents, roles, permissions, invitations and access.	Performance of a contract or steps taken before entering into a contract.	While the account remains active. When it is deleted, data associated with its use will be deleted, except where it must be retained in restricted form to comply with legal obligations or address potential liabilities.
Provide the purchased services and manage subscriptions, renewals, plan changes and communications necessary for the operation of the service.	Performance of a contract.	For the duration of the contractual relationship and afterwards for the applicable statutory retention periods.
Manage billing and payments, including charges, transfers, direct debits, refunds, and accounting and tax obligations.	Performance of a contract and compliance with legal obligations.	Accounting and tax records will be retained for six years, without prejudice to any other retention periods required by applicable law.
Handle support enquiries through the ticketing system, chat, chatbot and human support team, and investigate and resolve issues.	Performance of a contract, steps taken before entering into a contract, and EASYPROMOS’s legitimate interest in providing support and improving the service.	Support tickets and conversations will be retained for up to two years after they are closed. They may be deleted earlier when the account is deleted or the individual requests erasure, unless retention is necessary to address potential liabilities.
Respond to sales enquiries, organise demos and follow up with prospective customers who have previously contacted EASYPROMOS.	The individual’s consent. Where there is an existing contractual relationship initiated by registering on the platform and accepting the Terms of Use, EASYPROMOS may also send communications about its own similar products or services, in accordance with applicable law.	For as long as the data is needed to respond to the request and carry out sales follow-up. It will be deleted when the individual requests erasure or objects to the processing, unless it must be retained to comply with a legal obligation or address potential liabilities.
Send newsletters and marketing communications about EASYPROMOS content, updates, recommendations and services.	The individual’s consent. For customers, EASYPROMOS may also send communications about its own products or services similar to those purchased, in accordance with applicable law.	For as long as consent remains valid or the relationship justifying the communication continues. The individual may unsubscribe at any time. EASYPROMOS may retain the minimum data needed to demonstrate consent and prevent further communications.
Send operational communications relating to the account, security, payments, renewals, incidents or material changes to the service.	Performance of a contract and, where applicable, compliance with legal obligations or legitimate interests.	While the account or contractual relationship remains active and for as long as necessary to evidence the communication. These communications are not marketing messages and cannot be disabled when they are necessary to provide the service.
Analyse use of the platform, prevent abuse, protect accounts, investigate incidents and improve the product’s security, stability and performance.	EASYPROMOS’s legitimate interest in protecting and improving its services.	For as long as necessary for each purpose. Activity and security logs will be retained for up to five years from the date they are generated.
Provide proactive assistance, identify possible configuration issues and recommend features or plans related to account usage.	EASYPROMOS’s legitimate interest in helping customers use the service correctly and improving the commercial relationship.	While the account remains active or a business relationship exists. Personal data relating to participants will not be used for this purpose.
Manage contracts and retain evidence of their acceptance or signature.	Performance of a contract and EASYPROMOS’s legitimate interest in evidencing the contractual relationship and defending itself against potential claims.	For the duration of the contractual relationship and, once it ends, retained in restricted form for up to five years.
Organise webinars, events, satisfaction surveys, testimonials and customer success stories.	Consent, performance of the requested relationship or legitimate interests, depending on the activity. Testimonials and customer success stories will only be published with authorisation.	For as long as necessary to organise the activity and manage its results. Testimonials and customer success stories will be kept until authorisation is withdrawn or they are no longer used.
Analyse use of the public website and measure the effectiveness of marketing activities using cookies and similar technologies.	Consent, where required.	For the periods indicated in the cookie settings panel or until the individual withdraws consent.
Manage sign-in and authorised integrations, including access through Google, Facebook or SSO and connections with external services.	Performance of a contract. The connection is initiated voluntarily by the user or account administrator.	While the connection remains active. When it is disconnected or permissions are revoked, EASYPROMOS will delete connection data that is no longer necessary, without affecting any records that must be retained for security purposes.
Comply with legal obligations and respond to audits, requests and claims, including cooperation with authorities, courts, advisers and certification bodies.	Compliance with legal obligations and EASYPROMOS’s legitimate interest in demonstrating compliance and defending its rights.	For the periods required by applicable law or for as long as necessary to deal with the relevant procedure or claim.
Manage relationships with suppliers, partners and other professional contacts.	Performance of a contract, steps taken before entering into a contract, compliance with legal obligations and legitimate interests in managing the professional relationship.	For the duration of the professional relationship and afterwards for the applicable statutory retention periods.

Once the relevant retention period ends, the data will be deleted or anonymised. If it must be retained to comply with a legal obligation or address potential liabilities, it will be kept in restricted form and not used for other purposes.

RECIPIENTS AND SERVICE PROVIDERS

EASYPROMOS does not sell or rent personal data or provide contact lists to third parties for their own marketing purposes.

To provide its services and operate its business, EASYPROMOS uses specialised providers that may access only the data needed to perform the relevant function. Using a provider does not mean that the provider receives all categories of data described in this Policy.

The main providers currently used are:

Category	Providers used	Purpose
Infrastructure and technology services	Google Cloud and Ackstorm	Data hosting, platform delivery and management of the technology infrastructure.
Billing, banking and payments	Chargebee, Adyen and the banking institutions used by EASYPROMOS	Subscription management, billing, charges, transfers, direct debits, refunds and fraud prevention.
Sales management and lead generation	HubSpot, Pipedrive, Unbounce and Calendly	Management of forms, information requests, demos, meetings and sales opportunities.
Communications	Mailchimp	Sending and managing newsletters and marketing communications.
Support and artificial intelligence	Zendesk, eesel AI and OpenAI	Management of enquiries, tickets and support conversations, as well as operation of the chatbot.
Authentication and authorised connections	Google, Meta and WorkOS	Sign-in through external services, account connections and SSO access management.
Internal management	Asana, Notion and Google Workspace	Management of email, documents, internal knowledge, tasks, projects, requests and incidents.
Public website analytics	Plausible Analytics and Hotjar	Measurement of website usage and analysis of usability, in accordance with cookie preferences.
Digital advertising	Google, Meta, LinkedIn and other advertising platforms used by EASYPROMOS	Conversion measurement, audience creation and advertising, only where the individual has accepted the relevant cookies.
Electronic signature	DocuSign	Execution, signature and retention of contractual documents and related evidence.

Providers acting as data processors are subject to contractual obligations relating to data protection, security and confidentiality. Other providers, such as banks, payment gateways, authentication services or advertising platforms, may act as independent controllers for processing carried out to meet their own obligations or provide their services. In these cases, the processing is also subject to their own privacy policies.

EASYPROMOS may also disclose personal data:

to legal, tax and accounting advisers, auditors, insurers, security consultants and certification bodies, where necessary to provide their services, manage a claim or verify compliance with obligations;
to public authorities, regulatory bodies, courts and tribunals where there is a legal obligation or valid request;
to entities involved in a merger, acquisition, reorganisation, transfer of assets or other corporate transaction, with appropriate measures applied to protect personal data; and
to the public where the individual has authorised publication of a testimonial, customer success story or other identifying content.

Provider access to participants’ personal data processed on behalf of customers is governed by the Easypromos Data Processing Agreement.

INTERNATIONAL DATA TRANSFERS

EASYPROMOS uses providers located both inside and outside the European Economic Area. In particular, some sales management, communications, support, artificial intelligence, authentication and electronic signature services may involve processing personal data in the United States or accessing it from other countries.

Even where a provider primarily hosts data in Europe, international access may still take place through its affiliated companies, support teams or sub-processors.

EASYPROMOS will only transfer personal data internationally where a valid mechanism is available under applicable data protection law. Depending on the circumstances, transfers may rely on:

an adequacy decision adopted by the European Commission;
the recipient’s participation in the EU-US Data Privacy Framework, where applicable;
the Standard Contractual Clauses approved by the European Commission; or
any other mechanism recognised under applicable data protection law.

EASYPROMOS reviews the safeguards offered by its providers and, where necessary, applies additional measures to protect personal data.

Individuals may request information about international transfers and the safeguards applied by writing to privacy@easypromosapp.com.

MARKETING COMMUNICATIONS

7.1. Voluntary subscription

People who subscribe to the newsletter through EASYPROMOS forms will receive content, updates, recommendations and marketing communications.

Subscription is voluntary and may be cancelled at any time. Accepting this Privacy Policy does not, by itself, subscribe a person to the newsletter.

7.2. Communications to account holders and Agents

People who create an account on the platform or are Agents of an account may receive communications about the product, new features, training, recommendations, events and other Easypromos-related services, even where the account does not have a paid subscription.

These communications are based on the contractual relationship established by registering on the platform and accepting the Terms of Use, as well as EASYPROMOS’s legitimate interest in informing users and helping them use its services.

The individual may object to receiving these communications when providing their data and at any later time, without affecting use of the account or any purchased services.

7.3. Personalisation of communications

EASYPROMOS may tailor its communications based on information such as language, country, industry, company type, purchased plan, account activity or demonstrated interests.

This segmentation will not be used to make automated decisions that produce legal effects or similarly significantly affect an individual.

7.4. Unsubscribing

All marketing communications will include an unsubscribe mechanism. Individuals may also unsubscribe by writing to privacy@easypromosapp.com.

When a person unsubscribes, EASYPROMOS will stop sending marketing communications and may retain the minimum data needed to record the opt-out and prevent further messages.

7.5. Operational communications

Communications relating to security, account access, billing, renewals, incidents or material changes to the service are not marketing communications.

EASYPROMOS may send these communications for as long as they are necessary to manage the account, meet its obligations or properly provide the services. They are not affected by unsubscribing from the newsletter or other marketing communications.

META INTEGRATIONS

8.1. Connecting accounts

EASYPROMOS allows users to sign in to the platform with Facebook and connect professional Facebook and Instagram accounts to access certain features.

When a person authorises a connection, EASYPROMOS accesses only the data and permissions needed to identify them, validate the account and provide the requested functionality.

EASYPROMOS retains access tokens only where necessary to maintain or run the authorised functionality. These tokens are stored encrypted, with restricted access, and are deleted when they are no longer needed, the integration is disconnected or permissions are revoked.

Meta may process information relating to authorisation and use of its services in accordance with its own terms and privacy policies.

8.2. Features for promotions

Customers can connect their professional Facebook or Instagram accounts to use features such as:

giveaways among Facebook or Instagram comments;
promotions based on Instagram mentions or hashtags;
giveaways among Instagram Stories participants; and
Instagram messaging automations.

In these cases, the customer determines the purpose of the processing and acts as the data controller. EASYPROMOS accesses only the data needed to provide the functionality and acts as a data processor under the Easypromos Data Processing Agreement.

8.3. Participant login

When a promotion organiser enables participant access through Facebook Login, EASYPROMOS may receive data from Meta such as the Facebook identifier, first name, last name, email address and profile picture.

This data is processed on behalf of the organiser and in accordance with the permissions authorised by the participant. The processing is governed by the promotion’s privacy policy and the applicable data processing terms.

8.4. Retention and deletion

Data obtained through Facebook Giveaway, Instagram Comment Giveaway and Instagram Stories Giveaway applications will be retained for a maximum of 90 days. Customers may delete it earlier using the tools available on the platform.

Data processed through other Meta features will be retained according to the feature configuration, the customer’s instructions and the retention periods set out in the Easypromos Data Processing Agreement.

When a customer disconnects a Facebook or Instagram account, or revokes permissions through Meta, EASYPROMOS will delete data used exclusively to maintain that connection.

Disconnecting an account does not necessarily result in the immediate deletion of participant data that has already been added to a promotion. This data will be deleted in accordance with the retention periods and conditions described above.

Permanent deletion of the Easypromos account will result in the deletion of personal data obtained from Meta that remains associated with the account, subject to the applicable backup retention period.

8.5. Revoking permissions

Users can withdraw permissions granted to Easypromos from their Facebook or Instagram account settings. When Meta notifies EASYPROMOS that permissions have been revoked, EASYPROMOS will delete the corresponding connection data.

Individuals who wish to request deletion of data related to a Meta integration may also write to privacy@easypromosapp.com.

ARTIFICIAL INTELLIGENCE AND AUTOMATED DECISION-MAKING

EASYPROMOS uses an artificial intelligence-based chatbot as the first line of support. The chatbot identifies itself as an AI system and uses official Easypromos documentation to answer enquiries. Conversations may be reviewed by the support team and, where available, users may request human assistance.

Providers used to deliver this service are not permitted to use conversations to train their models. Chatbot responses may contain errors and do not produce legal effects or determine access to the services.

EASYPROMOS does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals. Security mechanisms may automatically block suspicious access or actions. Affected users may contact the support team to request a review.

INDIVIDUAL RIGHTS

10.1 Exercising your rights

EASYPROMOS recognises the rights described in this section for all individuals whose personal data it processes, regardless of their country of residence and without prejudice to any other rights available under applicable law.

Individuals may request:

access to their personal data and information about how it is processed;
rectification of inaccurate or incomplete data;
erasure of their data where it is no longer necessary or another legal ground for erasure applies;
restriction of processing in the circumstances provided for by law;
objection to processing based on legitimate interests and to receiving marketing communications;
data portability, where applicable;
withdrawal of consent at any time, without affecting the lawfulness of processing carried out before consent was withdrawn; and
not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect them.

These rights can be exercised by writing to privacy@easypromosapp.com and stating the request together with the information needed to identify the individual.

EASYPROMOS may request additional information where there are reasonable doubts about the identity of the person making the request. Identification documents will not be required where identity can be verified by other means.

Requests will be handled free of charge and within the applicable legal time limit. As a general rule, EASYPROMOS will respond within one month. This period may be extended by up to two additional months where the request is particularly complex or there is a high volume of requests, with prior notice to the individual.

Where a request is manifestly unfounded, excessive or repetitive, EASYPROMOS may charge the corresponding administrative costs or refuse to act on the request, explaining the reasons.

10.2 Participant data

Where a request relates to data processed within a promotion organised by a customer, the individual should contact the organiser, who acts as the data controller.

If EASYPROMOS receives the request directly and can identify the organiser, it will forward the request and provide the necessary assistance in accordance with the Easypromos Data Processing Agreement.

10.3 Complaints

If an individual believes that their personal data has not been processed correctly, they may lodge a complaint with the Spanish Data Protection Agency (AEPD) or the competent data protection authority in their place of residence.

SECURITY AND CONFIDENTIALITY

EASYPROMOS applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. These measures include access controls, permission management, encryption where appropriate, activity logging and monitoring, backups, vulnerability management and incident response procedures.

Access to personal data is limited to people and providers who need it to perform their duties. All authorised persons are subject to confidentiality obligations.

If a security breach affecting personal data occurs, EASYPROMOS will follow its incident response procedures and notify the relevant authorities and affected individuals where required by law.

CHILDREN AND MINORS

Easypromos services are intended exclusively for businesses and professionals. People under the age of 18 may not create an account, act as Agents or purchase the services.

EASYPROMOS sales forms, newsletter and content are also not specifically directed at minors.

If EASYPROMOS becomes aware that it has collected personal data from a minor without a valid legal basis, it will delete that data.

CHANGES TO THIS POLICY

EASYPROMOS may update this Privacy Policy to reflect legal, technical or organisational changes, or changes relating to its services and providers.

The current version will always be available on the Easypromos website and will indicate the date of the latest update.

Where a change materially affects the processing of personal data, EASYPROMOS will communicate it through the website, platform, email or another appropriate channel.

If a change requires renewed consent, EASYPROMOS will request it before starting the relevant processing.

COOKIES AND SIMILAR TECHNOLOGIES

The public Easypromos website uses cookies and similar technologies to enable its operation, remember preferences, analyse usage and, where applicable, measure the effectiveness of advertising activities.

Necessary cookies may be used without consent. Analytics and advertising cookies are activated only when the individual accepts them through the cookie settings panel.

Individuals can accept, reject or change their preferences at any time through the cookie settings panel available on the website. The panel provides information about the categories of cookies used, their purposes, providers and duration.

These technologies are used on the public website and not within the Easypromos platform, except for those strictly necessary for its operation and security.