Financial data privacy policy

Data controller

• Owner: Arlenys Arocha Diaz
• Tax ID (NIF/CIF): 60842001D
• Address: Avenida Europa 121, 4A, 28341, Valdemoro, Madrid, España
• Contact: proyectos@azucar-estudio.com

Scope of this policy

This policy applies specifically to PackTrack Finanzas, the financial module of the PackTrack platform, and describes how we handle the bank account and transaction data that a customer chooses to connect through our bank-connectivity provider. It complements, and does not replace, our general privacy and cookies policy.

What bank data we collect

When a PackTrack Finanzas customer chooses to link a bank account, our provider's secure connection flow lets them authenticate directly with their bank or financial institution. Depending on what the customer authorizes, we receive from the provider:

• Account holder name and the connected financial institution.
• Account identifiers (account and routing/IBAN numbers) needed to identify the linked account.
• Account balances.
• Transaction history (dates, amounts, descriptions, and merchant information).

We never receive or store the customer's online banking username or password: authentication happens directly between the customer, their bank, and the bank-connectivity provider.

Why we collect it

To let the customer reconcile bank movements against their invoices and expenses, track cash flow, and avoid manually re-entering bank transactions inside PackTrack Finanzas.

Legal basis

The customer's explicit consent, given when they choose to connect a bank account (Article 6.1.a GDPR), and the performance of our contract with the customer for the Finanzas module (Article 6.1.b GDPR). Connecting a bank account is always optional.

Who we share it with

Bank and transaction data is processed by our bank-connectivity provider, acting as our data processor, strictly to provide the bank-connection service. Where data is transferred outside the European Economic Area, this is done under Standard Contractual Clauses or another GDPR-recognized transfer mechanism. We do not sell or share this data with any other third party.

How long we keep it

We retain bank account and transaction data obtained through the bank connection for 12 months from the date it is collected, after which it is securely deleted or anonymized, unless the customer requests earlier deletion or the law requires a longer period. See our data retention and disposal policy for details.

Security

Bank data is encrypted in transit and at rest, and access is restricted to authorized personnel who need it to operate the Finanzas module. We do not store banking credentials at any point.

Your rights

You can request access, rectification, erasure, objection, restriction of processing, and portability of your bank data, and you can disconnect a linked bank account at any time, by writing to proyectos@azucar-estudio.com. If you believe we haven't properly handled your request, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).