SUXESS.ME · Privacy policy

Draft for legal review before production. This policy does not replicate the payment, licence-plate or geolocation processing carried out by Paymeter: it describes only the actual processing performed by SUXESS.ME. The Spanish version prevails until this translation is legally validated.

Last updated: August 2026.

1. Controller and contact

• Controller: TECNOLOGIA CAPITAL, S.L.
• NRT (tax ID): L-712868-Z
• Address: Centre de Negocis ANDBANK, Carrer Manel Cerqueda i Escaler, 6 — Oficina Planta Cero, Despatx 3, AD700 Escaldes-Engordany, Andorra.
• Contact: info@suxess.me · +57 311 201 9349
• Data Protection Officer: dpo@paymeter.io

Processing is carried out under Andorra's Law 29/2021 of 28 October on the protection of personal data (LQPD) and, where applicable, under Regulation (EU) 2016/679 (GDPR).

2. Our data-protection roles

TECNOLOGIA CAPITAL, S.L. acts as controller with respect to:

• enquiries received by email or WhatsApp;
• access, security and administration accounts of the Control Room;
• commercial contacts, contracting, billing and support;
• technical records needed to protect and maintain the service.

For personal data contained in incidents, PQRSF requests, messages, case logs and attachments entered by an operator, the operator is normally the controller and TECNOLOGIA CAPITAL, S.L. acts as processor, following its instructions and the applicable data-processing agreement.

If you need to exercise rights over a specific case, we may refer you to the responsible operator or work with it to answer your request.

3. Data processed

Depending on how the service is used, we may process:

• Professional account: name, email, identifier, company, role, operator and authorised sites.
• Operator configuration: name, country, sites, hours, channels and owners.
• Cases: identifier, site, status, priority, channel, subject and description.
• Case contact data: name and, where needed, phone, email or reference provided by the operator.
• Case log: notes, actions, communications, status changes, author and date.
• Evidence: images, PDFs, videos or other files relevant to the case.
• Technical data: IP address, device, session, access logs, errors and events needed for security and operation.
• Enquiries: content the person chooses to send by email or WhatsApp.

We do not request special categories of data. Users should avoid including them unless strictly necessary, authorised and supported by an adequate legal basis.

4. Purposes and legal bases

SUXESS.ME does not make decisions with legal effects based solely on automated processing. Automated tools may assist with organisational tasks; the response, resolution and closing of cases are performed by authorised people.

5. Recipients and providers

Data may be processed by providers necessary to deliver the service, subject to confidentiality and data-protection obligations:

• Supabase: authentication, database, private storage and real-time features of the Control Room; project hosted in a European region (Paris).
• Amazon Web Services and CloudFront: hosting and distribution of the static websites once deployment is completed.
• Email providers: sending and receiving communications and invitations.
• WhatsApp/Meta: only when a person chooses to use that channel.

We may also disclose information where there is a legal obligation or a valid request from an authority. We do not sell personal data.

The list of sub-processors applicable to the contracted service must be kept up to date and made available to the operator.

6. International transfers

We prioritise providers and hosting regions in Europe. Where a provider processes data outside the European Economic Area or Andorra, we use a valid mechanism, such as an adequacy decision, standard contractual clauses or other enforceable safeguards.

7. Retention

• Enquiries not turned into a contractual relationship: for as long as needed to respond and, as an initial reference, up to 12 months from the last communication.
• Account and contractual data: while the relationship exists and thereafter for the applicable legal periods.
• Cases, logs and attachments: for the period indicated by the operator in the contract or processing agreement. On termination of the service they will be returned, anonymised or deleted per its instructions, unless a legal retention or blocking obligation applies.
• Security logs: for the proportionate period needed to investigate incidents and evidence access.

Final pilot retention periods must be set in the contract and in the data-processing agreement with the operator.

8. Your rights

You may request access, rectification, erasure, restriction, objection and portability, where applicable, by writing to dpo@paymeter.io. We will respond within the applicable legal period and may ask for information to verify your identity.

You may also lodge a complaint with the Andorran Data Protection Authority (APDA): https://www.apda.ad.

Where the request concerns a case managed by an operator, please indicate this so we can identify the relevant controller.

9. Security

We apply measures proportionate to the risk, including authentication, logical separation by operator and site, role-based permissions, private storage of attachments, encrypted communications, an action log and access reviews. No system is infallible; we will handle any incident in line with applicable law and contractual commitments.

10. Minors

SUXESS.ME is a professional service aimed at operators and authorised staff, not at minors. Cases should not include data about minors unless necessary, lawful and handled per the operator's instructions.

11. Changes

We will publish the current version and its date. If a change materially affects the contracted processing, we will inform the operator through an appropriate channel.