Privacy policy

• Owner: SCOPEX TECHNOLOGIES SL
• Tax ID (NIF): B88730429
• Registered office: Calle Pablo Casals 10, 1.º A, 28011 Madrid (España)
• Email: hola@aforoapp.com
• Phone: 647 937 259

We have not appointed a data protection officer: given our size and the kind of processing we carry out, art. 37 GDPR does not require one. For any privacy question, write to us at hola@aforoapp.com.

When we are the controller and when we are the processor

We are the controller of the data you give us yourself: on the website, in the demo request, in the sign-up and in your relationship with us as a customer. That is what this policy describes.

When a business uses Aforo to manage its own customers (their bookings, their payments, their contact details), the controller is that business and we act as its processor: we process that data only on its behalf and following its instructions, as set out in the data processing agreement included in the terms of service. If you booked with a business that uses Aforo and want to exercise your rights, contact that business; if you write to us, we will pass your request on to it.

2.1 If you ask for a demo

• Data: your name, your email, your phone number if you give it, the name of your business and the message you write.
• Purpose: to handle your request, show you Aforo and follow up on that conversation.
• Legal basis: taking the pre-contractual steps you ask for (art. 6(1)(b) GDPR).

2.2 If you start the sign-up

• Data: the name and type of your business, your country, your phone number and your email, and what you answer next: what you offer, how you work, what interests you and the plan you choose.
• Purpose: to prepare your Aforo account and contact you by phone or email to activate it with you.
• Legal basis: taking the pre-contractual steps you ask for when you start the sign-up (art. 6(1)(b) GDPR).

To check that the person filling in the sign-up is a human we use Cloudflare Turnstile. If you book the call, the calendar belongs to Cal.com, and we pass it your email, your phone number and your business details so you do not have to type them again.

2.3 If you subscribe to Aforo

• Data: details of your business and of the person who represents it, billing and payment details, and whatever you write to us when asking for help.
• Purpose: to provide the service, charge and invoice it, give you support and tell you about anything that affects your account (changes to the service, the terms or the price).
• Legal basis: performance of the contract (art. 6(1)(b) GDPR) and, for invoicing and accounting, compliance with legal obligations (art. 6(1)(c) GDPR).

2.4 If you browse the website or the sign-up

• Server logs: like any website, the server records the IP address, the date and the page requested. We use them to keep the website working and to protect it against abuse (legitimate interest, art. 6(1)(f) GDPR).
• Analytics, only if you accept it: we use PostHog, with servers in the European Union, to learn which pages help and where people get stuck. This includes recording your journey through the page: where you click, how far you scroll and how you move the mouse. What you type into the forms is masked before it leaves your browser, so it does not travel in the recording. Legal basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time.

We do not build a profile of people who just browse without leaving their details. What is stored in your browser is explained in the cookie policy.

2.5 If we have written to you without you asking us to

• What data: the name of your business, its sector, its town, its phone number and its website, and an email address published on that website. We do not buy lists, we do not use third-party databases and we do not guess addresses.
• Where it came from: Google’s public directory and your own website.
• Purpose of the emails: to introduce Aforo to you, on the basis of our legitimate interest (art. 6(1)(f) GDPR and art. 19 of Spanish Organic Law 3/2018).
• Opting out and retention: you can object by writing “baja” to hola@aforoapp.com. We keep your address until we delete it or you opt out; after that, only so that we never write to you again.

2.6 What we do not do

• We do not sell your data or pass it to third parties for their own purposes.
• We do not send you advertising without your consent.
• We do not take automated decisions that produce legal effects on you or affect you in a similar way (art. 22 GDPR): anything that matters about your account is decided by a person.

When a period ends, we delete or anonymise the data. If a law requires us to keep it longer, or we need it to defend ourselves against a claim, we keep it blocked, without using it for anything else, until that obligation ends.

We work with these providers, which process data only on our behalf, as processors and under a contract in line with art. 28 GDPR:

• Contabo GmbH (Germany): hosting of the website, the sign-up and our internal tools (CRM and automations).
• PostHog (servers in the EU): usage analytics, only if you accept it.
• Google Workspace: the email we reply to you from.
• Cloudflare: the network the website and the sign-up run through, and the check that the person filling in the sign-up is a human (Turnstile).
• Cal.com (servers in the EU): the calendar where you book the sign-up call.
• Brevo (Sendinblue SAS, France): the commercial emails we sent in the past.

We may also disclose data to public authorities when a law requires it, for example to the Spanish Tax Agency.

Transfers outside the European Economic Area

Our data is hosted in the European Union. Google and Cloudflare are US companies and may process some data outside the European Economic Area. In that case the transfer is covered by the EU-US Data Privacy Framework (Adequacy Decision (EU) 2023/1795), to which they have signed up, and by the European Commission’s standard contractual clauses included in their contracts. You can ask us for more information at hola@aforoapp.com.

• The whole website and the sign-up run encrypted (HTTPS).
• The data is hosted on servers in the European Union.
• Only the team members who need it for their work have access, under a duty of confidentiality.
• Analytics recordings mask what you type.

If we suffered a security breach that put your data at risk, we would notify the Spanish Data Protection Agency within 72 hours and, if the risk were high, we would tell you without delay (arts. 33 and 34 GDPR).

• Access: find out whether we process data about you and get a copy.
• Rectification: correct anything that is wrong or incomplete.
• Erasure: ask us to delete your data when it is no longer needed or there is no basis for keeping it.
• Objection: object to our using your data on the basis of our legitimate interest. For commercial communications, just ask, with no need to give reasons.
• Restriction: ask us to stop using your data while a complaint of yours is being resolved.
• Portability: receive the data you gave us in a commonly used format, to take it to another service.
• Withdraw your consent at any time, without affecting what was done before. You withdraw analytics consent in «Cookie settings», in the footer of the website, or in «Cookies», in the footer of the sign-up.

To exercise them, write to us at hola@aforoapp.com saying which right you want to exercise. If we cannot confirm it is you, we will ask for some extra detail. We reply within one month; if the request is complex, we may extend that by two more months and will let you know.

If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD):

• Address: C/ Jorge Juan, 6, 28001 Madrid (Spain)
• Phone: +34 900 293 183
• Electronic office: sedeaepd.gob.es
• Website: aepd.es

Before you do, please write to us: it is almost always solved sooner and better that way.

Aforo is a service for businesses and professionals. We do not knowingly collect data from children under 14. If we find that some has reached us, we delete it.

When something relevant changes, for example a new provider, we will update this page and its review date. If the change affects Aforo customers, we will also tell them by email.