Privacy Policy

Information on the processing of personal data

General

Protecting personal data is a core value in how we do business. In this document, we provide all the information you need to understand how we protect your privacy and give you control over how we use your data.

This information notice concerns the processing of your personal data carried out:

Through our website www.getquipu.com (the “Website”)
carried out by other means:
- In connection with the purchase and use of products and services from Quipu App S.L.U. or when you contact us to request information.

Quipu App S.L.U. is part of the TeamSystem España group, which is made up of the following entities: the companies controlled by Software del Sol, S.A.U. pursuant to article 42 of the Commercial Code (in particular, Aplifisa, S.L.U., Marclamara, S.L.U., Distrito K Software, S.L.U., Golden Soft, S.L.U., Acumbamail, S.L.U., Quipu App, S.L.U., Asesoría Informática Gallega, S.L.U., Tyccil Digital, S.L.U., as well as the parent company, Software del Sol, S.A.U., My Expenses, S.L., Billin Facturas Electrónica, S.L.U. All the above entities and any others that become part of the group will be referred to as the “TeamSystem group”.

We process your data in accordance with Regulation (EU) No 2016/679 (General Data Protection Regulation, “GDPR”), and this information is provided pursuant to articles 13 and 14 of the GDPR.

This policy describes, clearly and in detail:

Who we are and how you can contact us
What types of personal data we process
Why we collect your personal data and how long we keep it
How and with whom we share your data
How we process your personal data
What your rights are and how you can exercise them
Changes and updates
Privacy contact details

Who we are and how to contact us

In this section we specify who you should contact if you wish to exercise your rights.

Data Controller
Data Protection Officer

Data Controller

The data controller is the natural or legal person that determines the purposes and means of processing your personal data, and puts in place the organizational and security measures to protect your privacy.

Quipu App S.L.U. is the Data Controller, with the following contact details:

Data Controller:
Quipu App S.L.U. (hereinafter, “Quipu”)
calle Alaba, 61, 5o-2a, 08005, Barcelona (Spain)
Email: support@getquipu.com

Remember to include your name, postal address or email, and/or phone number so that we can handle your request properly

Data Protection Officer (DPO)

Quipu has appointed a Data Protection Officer (DPO), responsible for overseeing compliance with data protection regulations and handling requests related to the exercise of your rights.

Data Protection Officer (DPO):
Grupo Adaptalia Legal-Formativo S.L. (Grupo Adaptalia)
C. Julián Camarillo Nº 26 4º Planta, 28037, Madrid
Email: privacy@getquipu.com

Remember to include your name, postal address or email, and/or phone number so that we can handle your request properly

What types of personal data we process

Personal data means any information that allows, directly or indirectly, your identification.

We collect and use your personal data in order to enter into and perform your contract with Quipu. In addition, we collect and use your personal data when you visit, search for, request or use any of Quipu's services and/or products (including those available on this website).

In some cases, we may also collect your personal data from other companies in the TeamSystem group, from distributors who collect it directly from you, or from public databases.

Categories of personal data we collect:

Identification, contact and access data

Refers to data such as: first name, last name, username, email address, postal address, phone number, username and password.

Product data

Refers to data relating to the products and/or services that have been -respectively- licensed to, or subscribed to by, users, including the information contained in documents managed and generated through those products or services. Such data may also include data generated through the processing of, and association with, data belonging to authorized third parties, or through the use of Artificial Intelligence Systems such as, without limitation, the AI Assistance available for certain Quipu services.

Billing and payment data

Means data such as: tax ID, taxpayer code, address and (where applicable) company name.

Browsing data

Data relating to your Internet connection, IP addresses, domain names and other parameters concerning users' browser and operating system.

Usage data

This refers to the data generated in connection with the use of the products or services purchased, such as: record inventories (logs), data relating to licenses, installations and configurations, data relating to recordings that have been made, interaction processes and transactions, performance indicators, data relating to browsing flows and page views, usage and statistics relating to specific features.

Voice

This refers to voice data. When you call or interact with Quipu by phone, conversations may be recorded for quality and service improvement purposes.

Why we collect your personal data and how long we keep it

In this section we explain why we use your data, in other words, the purposes of our processing activity.

We also specify whether you are required to provide us with your data, what happens if you decide not to provide it, and how long we keep it.

We process your data for the following purposes:

Contractual, pre-contractual, and legal purposes
Service improvement purposes and other purposes that do not depend on consent
Commercial purposes

1. Contractual, pre-contractual, and legal purposes

Are you required to provide us with your data?

Yes, without your data we cannot provide you with our services/products.

What happens if you don't provide us with your data?

We won't be able to fulfil the contract between you and us, nor provide you with the services or products you have requested.

Is your consent required to process your data?

No, your consent is not required.

What is the legal basis for processing your data?

The processing is necessary to fulfil the contract you have entered into with us, respond to your requests, or carry out the activities needed to perform the contract between you and us, and to comply with the obligations imposed on us by law.

How long do we keep your data?

For as long as the requested services are provided and for the following ten years (that is, the length of the statute of limitations applicable to our contractual liability).

This is without prejudice to retention for longer periods to the extent that such retention is necessary in the context of pending litigation, or to respond to a request made by a competent authority, or in accordance with applicable legislation.

You will also find a more detailed description of the aforementioned contractual and legal purposes below:

Enabling navigation on the Website
Creating and managing the user account (including possible account verification and credential recovery) and using account-related features.
Carrying out the activities needed to perform and fulfil the contract for the services/products requested or purchased by users, whether on the Website or not.
To send you operational communications, such as changes to our terms and conditions, updates to our prices, or information about service interruptions, through traditional communication channels, such as postal mail, or through remote communication systems, such as email, instant messaging systems (WhatsApp or others), chat, chatbot, AI assistant, phone, SMS, banners, notification systems and other remote communication channels.
Handling requests to take part in webinars or events, newsletter subscriptions, receiving pricing quotes, and processing orders.
Handling and following up on recently made requests, when you have requested information about a product/service, asked us for a quote, or used or downloaded any of our product/service trial versions, through traditional communication channels, such as postal mail, or through remote communication systems, such as email, instant messaging systems (WhatsApp or others), chat, chatbots, AI assistants, phone, SMS, banners, notification systems and other remote communication channels.
Handling complaints (if any), whether through traditional communication channels, such as postal mail, or through remote communication systems, such as email, chat, phone, SMS, banners, notification systems and other remote communication channels.
Provide assistance, support, and training to users of our products and services. To assist users, we may also process product-related Usage Data. For example, reviewing users' navigation flows may allow us to identify the causes of any issues that arise when using certain product features.
Comply with obligations arising from national or European legal, regulatory, or statutory provisions (for example, tax and accounting obligations), or handle and respond to requests made by judicial, administrative, and tax authorities.
Manage AI Systems when users activate chatbots or other services or products based on AI Systems, in order to deliver the service and respond to their requests (for example, AI Assistants).

2. Service improvement purposes and other purposes that do not depend on consent:

Is your consent required to process your data?

No, your consent is not required.

Can you object to these processing activities?

You have the right to object to processing activities, on grounds relating to your particular situation, in accordance with the formalities specified in the "What are your rights and how can you exercise them" section. In such cases, we will not process your data for this purpose unless we can demonstrate compelling legitimate grounds, or unless we are exercising or defending a legal claim in accordance with Article 21 of the GDPR.

What is the legal basis for processing your data?

The processing is based on the legitimate interest of the data controller, in accordance with Article 6(1)(f) of the GDPR. In compliance with the GDPR, we have carried out a thorough balancing of interests aimed at ensuring the protection and respect of users' privacy and fundamental rights.

How long do we keep your data?

For as long as the requested services are provided and in accordance with the data minimization principle, except in the following cases:

Phone recordings made for quality and service improvement purposes will be kept for a period of six months.
In the event of legal claims and/or complaints, Quipu needs to retain your personal data in order to ensure legal defense (letter i) for a period of 10 years (corresponding to the statute of limitations applicable to Quipu's contractual liability), or in the case of pending litigation, retention is determined by the duration of the pending proceedings or by specific requests made by the competent judicial authority.

You will also find a more detailed description of the various service improvement purposes and other purposes that do not depend on consent:

When you call or interact with Quipu by phone, conversations may be recorded for quality and service improvement purposes.
Carry out analysis and research activities on the products and services we offer, and on how you use them, in order to improve and develop our products and services. In compliance with the data minimization principle, these activities will only be carried out with your personal data to the extent necessary, ensuring that such activities are conducted fairly and correctly. Furthermore, whenever possible, we will anonymize or aggregate personal data before using it.
Measure satisfaction with the products and services you have purchased from Quipu, for example through surveys, or address problems or issues related to the use of the products or services (for example, initiatives that help promote better use of the products or services, also to prevent subscription cancellations/refunds and improve the experience of users and customers).
Carry out potential mergers, asset transfers, business transfers, transfers of a going concern, or financial operations, by disclosing and transferring your data to the interested third parties.
Perform customer segmentation based on non-invasive categories such as, among others, professional category, city/province/region of residence, the type of product/service you have purchased, or one about which you have requested information through the Website. Segmentation may also be carried out on third-party provider platforms, by matching data with such third-party platforms. In any case, communications made for Marketing Purposes will only be sent in accordance with the express consent you have granted and with the provisions set out in this policy. In this context, we may also use personal data to identify similar customer profiles.
Manage Quipu's information resources including infrastructure, websites and technology equipment, to ensure service continuity and guarantee IT security (for example, to prevent cyberattacks or carry out checks in the event of cyberattacks).
Training and improvement of AI Systems, in order to develop the technologies on which the AI Systems are based and/or improve the functioning of said AI Systems, within the framework of the services requested by the Customer or made available by Quipu and/or other companies of the TeamSystem group.

Since this purpose involves processing the Customer's data, but also the data of the data subjects incorporated into the products and services, that is, the Customer's clients, employees and suppliers, the Customer undertakes to provide said data subjects with this privacy policy, so that Quipu can effectively and adequately comply with the applicable data protection regulations. In any case, You may object to this processing at any time from the “Privacy” section of your Private Area.

3. Commercial purposes

Are you required to provide your data?

No, you are not required to provide your data.

Can you object to the processing?

At any time, you will have the right to object to processing for direct marketing purposes, including objecting to profiling insofar as it is related to direct marketing.

What happens if you don't provide us with your data?

We will not process your data for these purposes, without prejudice to the contractual relationship with us and the provision of our services.

Is your consent required to process your data?

Yes, your consent is required, except for the purpose mentioned in letter t.

What is the legal basis for processing your data?

We process your data based on the prior consent you have given us. The only exception concerns the purpose mentioned in letter t): in this case, the processing is carried out in accordance with Article 6 (1), letter f) of the GDPR and Article 21.2 of Law 34/2002, of 11 July, on information society services and electronic commerce (hereinafter, “LSSI”), without prejudice to your right to object to the processing.

Changing preferences and withdrawing consent

If you change your mind, you can modify your consent to the processing of your personal data for marketing purposes at any time, in accordance with the formalities specified in the section “What are your rights and how can you exercise them”.

If you no longer wish to receive commercial communications from us, you can unsubscribe by following the special link available at the end of the commercial communications sent by email. In such cases, we will limit the storage of personal data solely to the minimum data necessary to record your unsubscription and prevent us from contacting you again.

How long do we keep your data?

The data will be kept until you request the revocation of consent or exercise the right to object to the sending of commercial communications.

Here are some other details about the various marketing campaign purposes:

Send you updates and commercial offers about Quipu's products and services, also after associating Usage Data and Browsing Data and analysing your behaviour, whether with regard to browsing the Website and, more broadly, the use of Quipu's products and services (provided that the consents expressed when collecting said data are respected), or send invitations to participate in events, conduct market research or carry out other commercial initiatives.

All of the above may be carried out either through traditional communication channels, such as postal mail or a phone call from an operator, or through automated communication channels such as email, chat, messages (SMS and other instant messages) and other remote communication channels.

Disclose your personal data to other companies of the TeamSystem group and/or to its network of commercial partners, to send marketing communications and carry out other promotional initiatives for the purposes, and through the communication channels, specified in letter r) above.
Send marketing communications, through the communication channels specified in letter r) above, relating to products or services similar to those that are the subject of the contract between you and us. You may unsubscribe from these communications at any time.

How and with whom we share your data

We may share your data with other individuals or entities that carry out service activities necessary for the provision of our products or services. When sharing your data, we comply with the principles of purpose limitation and data minimisation established in the GDPR.

The recipients of your data will process it acting as independent controllers or as processors. If you would like to receive the list of all processors that carry out processing operations, please contact us at the address privacy@getquipu.com.

We disclose your data to the following recipients:

Third-party providers of support and consulting services in areas including (without limitation) technology, accounting, administration, legal and insurance;
Third-party providers of infrastructure, software and functionalities (for example, chatbots) in the event that AI Systems are activated;
Companies within the TeamSystem group (identified in the header of this Policy), if you agree to receive commercial communications; as well as the parent company - TeamSystem S.p.A. - based in Italy (these last communications will only be made for internal administrative purposes, compliance with legal or contractual obligations, and to respond to legitimate requests for information);
If business partners are involved in the performance of the contract, we may disclose part of your personal data to our distributors, retailers and other partners involved in the distribution chain of Quipu products/services;
Banks and financial institutions;
Debt collection agencies;
Public entities and authorities whose right to receive personal data is expressly granted by legal or regulatory provisions or by an act issued by a competent authority;
Potential buyers and other entities arising from a merger, or any other corporate restructuring or conversion;
Credit information systems.

With your prior consent, we may also disclose your personal data for marketing purposes to other third parties and business partners tasked with carrying out marketing campaigns on our behalf.

Do we transfer personal data abroad?

At Quipu, part of the processing of personal data may take place outside the European Union. For example, our customer support team uses tools that in certain cases may involve international data transfers to countries that have not been declared adequate by the European Commission (such as the United States).

However, all of these tools have appropriate safeguards in place to ensure compliance with data protection regulations, including the signing of standard contractual clauses approved by the European Commission and other additional safeguards as established in articles 45 and 46 of the General Data Protection Regulation (GDPR).

We always act in compliance with the applicable regulations, adopting the necessary measures to guarantee an adequate level of protection of personal data.

If you would like more information about the safeguards in place, you can contact our Data Protection Officer (DPO) by email at: privacy@getquipu.com.

How we process your personal data

Quipu processes your personal data using electronic and manual systems, in accordance with the principles of fairness, honesty and transparency, and protecting your privacy by applying appropriate technical and organisational measures to ensure an adequate level of security.

Processing activities are carried out on Quipu's premises and/or on the premises of the Processors that carry out the processing on Quipu's behalf.

Personal data may also be processed using AI Systems if you request a product or service that uses AI-based technology or when you do not object to the processing of your personal data by such means.

With regard to Usage Data and Navigation Data, in fulfilment of the aforementioned purposes and on the basis of your explicit consent (where necessary), we may carry out analytical activities, including through the linking of data relating to the various products and services purchased by you from the TeamSystem group companies, by collecting Usage Data and Navigation Data relating to products installed on the user's device ("on-premises" products) or to "in-cloud" products, that is, by collecting data during the online use of such services. As for usage statistics, we use tools that allow us to collect Usage Data.

These tools may require the collection of data generated locally, within the product you use, through communication with your systems, or by accessing such data. With specific reference to the collection of Usage Data "in the cloud", Quipu uses, among others, analytics tools to collect, measure and analyze Usage Data and Browsing Data in order to understand, optimize and improve the use of the Website and our products (for example, web analytics, customer analytics, queries and dashboards).

In addition, in fulfillment of the purposes indicated above and based on the consent given by you, we may associate the data relating to your browsing on the Website with the data provided by you when filling out a form on the same Website.

For more information about the cookies and other tracking technologies used on the website, and the subsequent processing of your Browsing Data, please see our Cookie Policy.

What your rights are and how you can exercise them

You are in control of your own personal data. Here you'll find a list of your rights regarding the processing of your personal data:

Right of access

You have the right to obtain confirmation of the existence of personal data concerning you and to access its content.

Right to rectification

You have the right to obtain the updating, modification and/or rectification of your personal data, including that which is used to train the AI Systems offered to you, or that you request, within the framework of Quipu's services.

Right to erasure and to restriction of processing

You have the right to obtain the erasure or restriction of the processing of personal data that has been processed unlawfully, including when it is no longer necessary to retain it in relation to the purposes for which it was collected or otherwise processed.

All of this without prejudice to any overriding public interest or legal obligation to retain the data in question.

Right to object

You have the right to object to the processing, including profiling or the use of personal data to train the AI Systems offered to you, or that you request, within the framework of Quipu's services.

All of this without prejudice to any compelling legitimate grounds that allow Quipu to continue the processing.

Right to withdraw consent

You have the right to withdraw your consent to marketing activities, if you have previously given it.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority of the Member State in which you have your habitual residence, where you work, or where the alleged infringement took place. In Spain, the competent supervisory authority is the Spanish Data Protection Agency.

All of this without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to receive a copy in electronic format of the personal data concerning you.

You have the right to transfer such data to another service provider, when Quipu is processing the personal data based on your consent or on the need to carry out the processing to provide services at your request, and when the processing is carried out by automated means.

If you wish to exercise the rights mentioned above regarding the protection of personal data, you can contact the Data Protection Officer at any time and free of charge by sending an email to the following address: privacy@getquipu.com.

To do so, you must prove your identity and, if you are acting on behalf of a third party, also provide valid proof of representation.

When you contact us, remember to include your name, email address, postal address and/or phone number so we can properly handle your request.

Changes and updates

We may modify this privacy policy to adapt it to legislative changes, industry practices or legitimate interests of the organization, always respecting the rights of users.

In the event that the modifications are substantial or affect the purposes of the processing, users will be informed through a notice on the website or, where applicable, through the available contact channels. We recommend that you review this policy periodically to stay informed about how we protect your data.

Privacy contact details

If you would like more information about the processing of your personal data or wish to raise any query related to this Privacy Policy, you can contact the points of contact indicated in the "Who we are and how to contact us" section.

Remember to include your name, email and/or postal address, and phone number so we can handle your request properly

Effective date: 02/09/2026