Back to home

Privacy Policy

This is a courtesy translation. In the event of any discrepancy, the Spanish version shall prevail. View in Spanish

At PLAMILY SYSTEM TECNOLOGÍA Y AYUDA A LA FAMILIA, S.L. (“PLAMILY SYSTEM” or the “Entity”), we want to explain to you clearly and transparently how we process the personal data you provide to us when you interact with us.

Accordingly, this privacy policy applies to all persons who provide or have provided us with personal data by any means, including, among others, the forms on the website https://enebrat.com/ (the “Website”), the Enebrat mobile application, owned by PLAMILY SYSTEM (the “Application”), as well as through email communications or any other channel made available by PLAMILY SYSTEM, including, in particular: (i) users who browse the Website (“Website Users”); (ii) users who register in the Application as administrators of the profile of a beneficiary of the services of PLAMILY SYSTEM (“Administrator Users”); (iii) persons whose data are managed through the Application by an Administrator User (“Beneficiaries”); and (iv) authorised third parties who access certain information about Beneficiaries within the Application, such as carers, nurses or day-centre staff (“Authorised Users”). All of them shall be regarded as a “Data Subject” or “Data Subjects” for the purposes of this privacy policy.

Your data are processed in accordance with Regulation (EU) 2016/679 of 27 April, the General Data Protection Regulation (“GDPR”), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (“LOPDGDD”).

Identity of the data controller

PLAMILY SYSTEM TECNOLOGÍA Y AYUDA A LA FAMILIA, S.L.

Tax identification number (NIF): B-26630301

Address: Gran Vía de les Corts Catalanes 645 CP 08010, Barcelona, Spain.

Contact: contact@plamilysystem.com

What types of personal data do we collect and process?

The personal data that PLAMILY SYSTEM collects and processes vary depending on the type of Data Subject and the relationship they have with us. The categories of data processed for each profile are set out below:

a) Website Users:

  • Identification and contact data: first name, surnames, email address and any other data that the user voluntarily provides through the contact or information request forms available on the Website.
  • Browsing and technical data: IP address, browser type and version, operating system, date and time of access, and other information collected automatically through server logs and the cookies strictly necessary for the technical operation of the Website and the Application, as set out in our Cookie Policy.

b) Administrator User:

  • Identification and contact data: first name, surnames, national identity document (DNI) number, email address, telephone number, and any other data provided during the registration process in the Application.
  • Access and authentication data: access credentials (email address and encrypted password), login data from external providers (e.g. Google or Apple ID), and Application access logs.
  • Financial and subscription data: subscription plan contracted (free or premium), data relating to the status of the subscription, payment and renewal history, and the necessary billing information.
  • Data relating to the Application settings: usage preferences, notification settings, management of permissions granted to Authorised Users, and preferences regarding commercial communications.
  • Application usage data: technical data of the device (model, operating system, app version), activity logs and logs of errors or technical incidents.

c) Beneficiary:

  • Identification and contact data: first name, surnames, national identity document (DNI) number, date of birth, age, sex, email address, telephone number and any other data provided during the registration process. As part of the dual-channel OTP identity verification process, both the telephone number and the email address are collected on a mandatory and simultaneous basis, for the sole purpose of sending the separate verification codes needed to complete that process.
  • Health data: medicines, doses, personalised dosing schedules and dose history. The processing of these data, as specially protected data, is based on the explicit consent of the Data Subject or, where applicable, of their legal representative or of the duly authorised Administrator User, in accordance with Article 9(2)(a) of the GDPR.
  • Data relating to the shared calendar: medical appointments, recurring events, reminders and any other information recorded in the Application’s shared calendar feature. To the extent that such data may reveal information about the Beneficiary’s state of health (in particular, medical appointments), the protection regime for health data set out in the previous paragraph shall apply to them.
  • Data relating to food: shopping lists and any other information recorded in the Application’s food feature.
  • Financial and accounting data: records of expenses and income, personal accounts, household accounts and, where applicable, accounting data managed by third parties through the Application.
  • Application usage data: activity logs within the Application associated with the Beneficiary’s profile (only to the extent that the Beneficiary interacts directly with the Application).

d) Authorised User:

  • Identification and contact data: first name, surnames, email address, telephone number and any other data provided during the registration process or the process of linking to a Beneficiary’s profile.
  • Access and authentication data: access credentials (email address and encrypted password), login data from external providers, and Application access logs.
  • Professional data: role or relationship with the Beneficiary (e.g. carer, nursing staff, family member, day centre).
  • Data relating to access permissions: details of the permissions granted by the Administrator User or the Beneficiary, the Beneficiary profiles to which they have access, level of access (read, edit, etc.) and date of activation and, where applicable, revocation of the permissions.
  • Application usage data: activity logs within the Application (features used, actions performed on the profiles of the Beneficiaries to which they have access, date and time of interactions).

How do we obtain your data?

Your personal data may come from the following sources:

  • Directly from you, when you register in the Application, fill in forms, contact us or use the features of the Application.
  • From the Administrator User, when they provide data relating to a Beneficiary for the management of the Beneficiary’s profile within the Application, or for the sending of two separate one-time verification codes (OTP) – one by SMS and the other by email – intended to verify the identity and wishes of the Beneficiary in relation to the delegation of the management of their profile. In the first case, the Administrator User declares that they have the authorisation of the Beneficiary or act as the Beneficiary’s legal representative, as established in this Privacy Policy. In the second case, the Administrator User must provide both the mobile telephone number and the email address of the Beneficiary, for the sole purpose of enabling PLAMILY SYSTEM to send the Beneficiary the corresponding verification codes through both channels, and such data shall not be used for any purpose other than that described. This dual-channel verification ensures that only a person who simultaneously controls both means of contact can complete the authorisation process.
  • From mutual insurance societies or insurance companies, under collaboration agreements by virtue of which those entities provide PLAMILY SYSTEM with the identification data of those of their policyholders who wish to benefit from a free or premium subscription to the Application. In such cases, the data provided shall be limited to those strictly necessary for activating and managing the subscription (identification and contact data), and under no circumstances shall the mutual insurance societies or insurance companies disclose special categories of data, including health data, to PLAMILY SYSTEM.

For what purposes do we process your personal data and on what legal basis?

PLAMILY SYSTEM uses, retains and processes the personal data it collects for the purposes indicated below. The following list sets out the purposes for which we process your personal data, grouped according to the legal basis applicable to each category of processing:

a) Performance of a contract or taking of pre-contractual steps (Art. 6(1)(b) GDPR): The following processing operations are necessary for the performance of the contractual relationship between you and PLAMILY SYSTEM or, where applicable, in order to take pre-contractual steps at your request. The provision of the personal data associated with these purposes is a contractual requirement or a requirement necessary to enter into a contract with PLAMILY SYSTEM, and the Data Subject is therefore obliged to provide them. Refusal to provide them will prevent PLAMILY SYSTEM from formalising the contractual relationship and/or providing the services requested through the Website or the Application:

  • Management of contact forms, in order to respond to requests for information, queries or support requests made by users of the Website and the Application.
  • Registration of users on the platform, in order to create and manage user accounts and allow access to the features of the Application.
  • Customer and user management, for the purposes of providing the contracted services and administrative management.
  • Subscription management, including the management of sign-ups, cancellations, invoicing and collection of the subscription.
  • Management of incidents and technical support, in order to resolve technical problems and ensure the proper functioning of the service.

b) Compliance with a legal obligation (Art. 6(1)(c) GDPR): The following processing of data is also necessary for compliance with the legal obligations applicable to PLAMILY SYSTEM:

  • Tax and accounting management, in connection with the management of customer subscriptions.

c) Consent of the Data Subject (Art. 6(1)(a) GDPR): The following processing operations are carried out on the basis of consent freely given by the Data Subject, which may be withdrawn at any time without affecting the lawfulness of processing prior to its withdrawal. The provision of the personal data associated with these purposes is voluntary, and the Data Subject is therefore not obliged to provide them. Refusal to provide them or withdrawal of consent will have no negative consequences for you, although it will prevent certain features from being provided:

  • Sharing of data with Administrator Users and/or Authorised Users.
  • Sending of push notifications with alerts relating to the care of the Beneficiary.
  • Sending of commercial communications by electronic means, including newsletters, news and promotional communications about the products and services of PLAMILY SYSTEM.

For these purposes, we inform you that, in order to withdraw your consent, you may click on the link included in each communication to unsubscribe from electronic commercial communications, or send your request to support@plamilysystem.com.

d) Legitimate interest of the controller (Art. 6(1)(f) GDPR): The following processing operations are based on the legitimate interest of PLAMILY SYSTEM. The provision of the personal data associated with these purposes is neither a statutory nor a contractual requirement, although the data are necessary for the purposes indicated:

  • Web analytics and technical cookies, in order to carry out a statistical analysis of the use of the Website and the Application and to improve the user’s browsing experience through the use of strictly necessary cookies. The legitimate interest on which this processing is based lies in the Entity’s need to ensure the proper technical functioning of its website, optimise its performance and ensure the security of electronic communications.
  • Verification of the Administrator User’s legal representation, in order to check that an Administrator User who declares that they act as the legal representative of the Beneficiary holds a valid and sufficient instrument of representation to manage the Beneficiary’s profile in the Application. To this end, when the Administrator User selects the option to register as a legal representative, PLAMILY SYSTEM will require them to provide documentation evidencing such representation (a court order, a notarial deed or another legally valid document), the validity and scope of which will be verified by PLAMILY SYSTEM before the delegation is activated. The legitimate interest on which this processing is based lies in the need for PLAMILY SYSTEM to act with due diligence to ensure that the management of a Beneficiary’s profile by a third party invoking an instrument of legal representation is effectively covered by that instrument, this being a measure to protect the Data Subject themselves and to comply with the principle of accountability.
  • Verification of the identity and wishes of the Beneficiary by sending two separate verification codes by SMS and email, in order to check that the Beneficiary expressly and knowingly authorises the Administrator User to manage their profile in the Application. To this end, the Administrator User must provide both the mobile telephone number and the email address of the Beneficiary. PLAMILY SYSTEM will generate two separate one-time verification codes (OTP) and send them simultaneously: one by SMS (Code A) to the telephone number indicated and the other by email (Code B) to the address provided, without including in either message the identity of the Administrator User or any information about the subject of the request. Once the Beneficiary accesses the Application and correctly enters both codes in the fields provided for that purpose, they will be presented with full information on the scope of the delegation, the powers conferred on the Administrator User and the processing of their personal data. The legitimate interest on which this processing is based lies in the need for PLAMILY SYSTEM to verify that the delegated management of a Beneficiary’s profile by a third party genuinely reflects the Beneficiary’s wishes, this being a measure to protect the Data Subject themselves and to prevent unauthorised uses of their personal data.
  • Fraud prevention and security of the Application, in order to detect, prevent and investigate possible fraudulent activities and improper or unauthorised uses of the Application, and to ensure the security of the services provided through it. The legitimate interest on which this processing is based lies in the need for PLAMILY SYSTEM to protect its interests and those of its users against possible fraudulent conduct, preserving the integrity and reliability of the services offered.
  • Conducting satisfaction and service evaluation surveys, in order to ascertain the level of satisfaction of users and customers with the services provided by PLAMILY SYSTEM and to identify areas for improvement. The legitimate interest on which this processing is based lies in the Entity’s interest in continuously evaluating and improving the quality of its products and services, which is also to the benefit of the users themselves.

Data Subjects may exercise their right to object by writing to support@plamilysystem.com.

How long do we keep your personal data?

The data provided through the contact form available on our website will be kept for as long as necessary to respond to your request and, if you have consented to receiving commercial communications, until you withdraw your consent to that effect. In any event, we will carry out a periodic review every 2 years from the collection of your data or from the last active contact. If, once that period has elapsed, there is no activity or active interest on your part, the data will be erased, unless legal liabilities of any kind may arise, in which case they will be kept duly blocked until the limitation periods for any actions that may arise have expired.

As regards the Beneficiary’s contact data provided by the Administrator User solely for dual-channel OTP identity verification (telephone number and email address), such data will be kept only for as long as strictly necessary to complete the verification process. Once the verification has been completed or, where applicable, once the validity period of the OTP codes has expired without the verification having been completed, those contact data will be blocked until the limitation periods for any actions that may arise have expired.

PLAMILY SYSTEM will keep the Data Subjects’ data for as long as their relationship with the Entity continues. Once those periods have ended, the data will be kept duly blocked for the time necessary to deal with any liabilities that may arise from the processing, and will be made available only to the competent public authorities, judges and courts where they so request or where necessary to defend the interests of PLAMILY SYSTEM.

To whom will we disclose your personal data?

In the course of the processing carried out, PLAMILY SYSTEM may disclose personal data to the following categories of recipients:

  • Banks and payment institutions, for the management of payment for the premium plan of the Application.
  • Public authorities, regulatory bodies and competent authorities, where required under the legislation in force at any given time.
  • Judges and courts, where necessary for the defence of the Entity’s interests or in compliance with a court order.
  • Authorised Users (such as carers, nursing staff or day centres), who may access certain data of Beneficiaries where the Administrator User or the Beneficiary has granted the corresponding permissions through the system provided in the Application.

In addition, in order to provide our services we need to work with companies that process your data on our behalf (providers of subscription management services, cloud services, etc.), with whom we sign the corresponding data processing agreements and whom we require to comply with personal data protection regulations. You may request further information about these providers by writing to contact@plamilysystem.com.

Do we carry out international data transfers?

In order to provide the services offered through the Application, PLAMILY SYSTEM may carry out international transfers of personal data to countries outside the European Economic Area, including the United States and any other country in which Google or its sub-processors have facilities.

To this end, PLAMILY SYSTEM guarantees that such transfers are covered by appropriate safeguards, such as adequacy decisions, including the “EU-U.S. Data Privacy Framework”, or, where applicable, by entering into the corresponding standard contractual clauses approved by the European Commission with the recipients, in order to ensure an adequate level of protection for your personal data. You may request further information about the safeguards adopted by writing to contact@plamilysystem.com.

How do we keep your data safe?

PLAMILY SYSTEM undertakes to comply with its duty of secrecy with respect to personal data and its duty to safeguard them, adopting at all times the measures necessary to ensure their integrity, confidentiality and availability, in compliance with the GDPR and the LOPDGDD.

To this end, PLAMILY SYSTEM has implemented the technical and organisational security measures necessary to prevent the alteration, loss, and unauthorised processing of and/or access to your personal data, taking into account the state of the art, the nature of the data stored and the risks to which they are exposed, whether arising from human action or from the physical or natural environment. However, please note that no internet security system is completely impregnable.

What are your rights when you provide us with your data?

We inform you that you may exercise the following rights:

  • Right of access to your personal data, to find out which of your data are being processed.
  • Right to rectification of any inaccurate personal data concerning you.
  • Right to erasure of your personal data, where possible.
  • Right to request the restriction of the processing of your personal data where the accuracy, lawfulness or necessity of the processing of the data is in doubt, in which case we may retain the data for the exercise or defence of claims.
  • Right to object to the processing of your personal data, where the legal basis enabling us to process them is legitimate interest. PLAMILY SYSTEM will stop processing your data unless it has compelling legitimate grounds or the processing is necessary for the establishment, exercise or defence of claims.
  • Right to data portability, where the legal basis enabling us to process your data, among those indicated, is your consent.

These rights may be exercised free of charge by the Data Subject and, where applicable, by their representative, by means of a written request sent to support@plamilysystem.com.

In addition to the above rights, the Data Subject shall have the right to withdraw the consent given at any time, without such withdrawal affecting the lawfulness of the processing carried out prior to its withdrawal.

PLAMILY SYSTEM does not carry out profiling or take automated individual decisions that produce legal effects concerning you or similarly significantly affect you. Notwithstanding the foregoing, should features involving this type of processing be implemented in the future, the Entity will inform Data Subjects in advance and, where appropriate, obtain the necessary consents.

Likewise, if you consider that the processing of your data does not comply with the regulations in force, you have the right to lodge a complaint with the Spanish Data Protection Agency (“AEPD”) through its website: www.aepd.es.

Links to third-party websites

The PLAMILY SYSTEM website may include hyperlinks to other sites that are not operated or controlled by PLAMILY SYSTEM. Therefore, PLAMILY SYSTEM neither guarantees nor accepts responsibility for the lawfulness, reliability, usefulness, accuracy or currency of the content of such websites or for their privacy practices. Before providing your personal information to these websites not belonging to PLAMILY SYSTEM, please bear in mind that their data protection practices may differ from ours.

Changes to the Privacy Policy

PLAMILY SYSTEM may amend its Privacy Policy in accordance with the legislation applicable at any given time. In any event, any amendment to the Privacy Policy will be duly notified to the Data Subject so that they are informed of the changes made to the processing of their personal data. The new Privacy Policy will be effective from the time of its publication.

PLAMILY SYSTEM Privacy Policy last updated: [-]