In compliance with the Personal Data Protection regulations and in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, "GDPR") and with Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (hereinafter, "LOPDGDD"), ORAIN TECHNOLOGIES S.L. (hereinafter referred to as "ORAIN" or "Entity" interchangeably) hereby provides you with information regarding the processing of your personal data in our mobile application (hereinafter, "Application").
The Application allows users (hereinafter, "User") to make payments at self-service machines through their devices (hereinafter, "Devices").
We may modify this Privacy Policy from time to time, and if we introduce material changes, we will notify you so that you can review the changes before continuing to use our services. The act of continuing to use our services after we publish or communicate any modifications to this Privacy Policy will signify your agreement to the changes. If you do not agree with any of the changes, you may close your account, if you have created one, by sending a written request to [email protected].
You can also consult the privacy policy of our website here.
1. Who is the Data Controller for your data?
Identity: ORAIN TECHNOLOGIES, S.L.
C.I.F.: B-66.611.773
Postal address: Carretera de Molins, 79A, Nave 3, 08191 Rubí, Barcelona
Email: [email protected]
Telephone: 938 09 76 29
Contact details of the DPO (Data Protection Officer): Xavier Sans Serra - [email protected]
2. What data do we collect from your device?
We may collect information from the device you use to access your profile. Among the data we collect:
- Device Characteristics: Information about the operating system, battery, available storage space, etc.
- Device Identifier
- Geolocation: This is data we may collect when you enable us to do so.
- Device Signals: Bluetooth signals and information about beacons, mobile phone masts, and nearby Wi-Fi access points.
- Phone number, IP address, mobile network operator or internet service provider, connection speed, device language, and time zone.
3. For what purpose and on what legal basis do we process your personal data?
If you are a User of the Application, you should know that the Data Controller may process your data based on the following purposes and legal bases:
Installation of the Application
For the correct installation and functioning of the Application on the mobile phone or device chosen by the User, it is necessary to collect and process certain technical information, such as the installed operating system or the available storage space.
Legal basis: The processing of the User's personal data will be carried out based on legitimate interest.
Registration and management of the User in the Application
For the User to access the Application, it is necessary to provide the required data for registration.
Once the User account is created, the data will be used to manage the profile, which may involve adding, modifying, or deleting data while the User remains active. In this regard, the User will have access to a record of all their purchases at self-service machines, including the date, time, and payment method used for the transaction.
Legal basis: The processing for the management of the User's registration will be carried out for the performance of a contract to which the User is a party (Article 6.1.c) of the GDPR).
Management of queries and incidents related to the Application
If you contact us to raise a query or submit a complaint related to the Application, your personal data will be used to respond to and manage, where applicable, the query or complaint.
Legal basis: Any processing of personal data related to a query or complaint will be carried out based on the User's consent granted when making the query, complaint, or claim, or based on the performance of a contract, if it is related to the service received.
Compliance of legal obligations
The processing of the User's personal data may be carried out to comply with legal obligations imposed on the Data Controller, including, where applicable, communication to competent authorities.
Legal basis: The processing of the User's personal data will be carried out based on a legal obligation imposed on the Data Controller.
Commercial communications
Whenever there is a legal basis that permits it, the User's data will be used to send them information about the Application and commercial communications, both from us and from third parties, informing them of updates or offers that may be of interest.
Legal basis: The processing of the User's personal data will be carried out based on the consent provided or on legitimate interest, as applicable.
Geolocation
Whenever you have activated and consented to the geolocation technology on your device, ORAIN will collect and process data related to the location of the User's device, for the exclusive purpose of locating self-service machines.
Legal basis: The processing of the User's personal data will be carried out based on the consent provided.
Satisfaction and quality surveys
From time to time, ORAIN may contact you to assess your level of satisfaction with the use of the Application and to improve the quality of our products and services.
Legal basis: The processing of the User's personal data will be carried out based on legitimate interest
4. How long will we retain your personal data?
Personal data will be processed for the period necessary to fulfil the purposes described in this Privacy Policy and to comply with the obligations imposed by applicable laws, statutory limitation periods, and for the formulation, exercise, or defence of claims (in such cases, the personal data will be duly blocked).
5. What if the data belongs to a minor?
The Application is intended for adults interested in our services. Therefore, it is not expected that minors will contact or contract with us through the Application. In any case, if you are a parent, guardian, or legal representative and believe that your child or ward has provided us with personal data, please contact us by sending an email to [email protected].
6. To which recipients may your data be disclosed?
Depending on the purposes for which the personal data has been collected, the following third parties may have access to it:
- Public administrations, when there is a legal obligation.
- Competent bodies and/or authorities, including relevant law enforcement agencies, in cases where there is a legal requirement or where we consider there are sufficient indications or suspicions of an offence or criminal act.
- Collaborators and third-party service providers who process information as data processors. We have entered into the corresponding data processing agreements with all our providers in accordance with personal data protection regulations.
- Employees and/or collaborators authorised by ORAIN, always subject to applicable data protection standards
- Companies owning the self-service machines, provided we have obtained your prior consent.
We do not transfer personal data to countries located outside the European Economic Area. Any international data transfers that ORAIN may carry out will be conducted with an adequate level of protection in accordance with data protection regulations.
7. Automated data processing
We will not use automated decision-making processes, including profiling, unless you have explicitly authorised us to do so. In such a case, we will inform you about the logic used in the decision-making process, as well as the significance and intended consequences of such processing for you.
8. What are your rights when you provide us with personal data?
If we process your data, you should know that your rights are as follows:
- Right to request access to personal data: You may ask whether ORAIN is processing your data and, if so, access it.
- Right to request rectification if the data is inaccurate or to complete any incomplete data we hold.
- Right to request the erasure of your data.
- Right to request the restriction of processing: In this case, ORAINS will only retain the data for the exercise or defence of claims.
- Right to object to processing: We will stop processing your personal data, except where we need to continue processing for legitimate reasons or for the exercise or defence of potential claims.
- Right to data portability: If you wish for your data to be processed by another data controller, we will facilitate the transfer of your data to the new controller.
- Right not to be subject to a decision based solely on automated processing of your personal data.
If you have given us your consent for any specific purpose, you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise your rights, send us an email to [email protected] or to ORAIN's postal address.
If you are not satisfied with the exercise of your rights, you may file a complaint with the Spanish Data Protection Agency (https://www.aepd.es/).
9. Security
ORAIN maintains the levels of security for the protection of your data required by current personal data protection regulations and has implemented all technical means at its disposal to prevent the loss, misuse, alteration, unauthorised access, and theft of the data provided by the User through the Application.
In any case, ORAIN will implement appropriate technical and organisational measures, both when designing the data processing system and during the processing itself, to preserve security and prevent unauthorised processing. However, despite the diligent implementation of such measures, the User should be aware that security measures on the Internet are not impregnable.
10. Personal data of third parties
If the personal data provided belongs to a third party, you guarantee that the third party has been informed of the aspects contained in this Privacy Policy and that you have obtained their consent to provide their data to the Entity for the purposes set out in this Policy.
11. Modifications
We will only use your personal data in accordance with this Privacy Policy, which is in effect at the time we collect your information. In the event of any modification to the processing of your data, you will be informed in a timely manner.
Last updated: 30/05/2025