Data Controller
The Data Controller for your personal data is:
- Owner: Francisco Jacobo Sarmiento Pérez
- Tax ID (NIF): 78518437W
- Address: Calle Zurbarán, Carrizal, Ingenio, Spain
- Contact email: contact@qiklet.com
- Privacy contact: contact@qiklet.com
Personal Data We Collect
Depending on your interaction with the platform, we collect the following data:
Consumers
- Account data: name, email address and profile image when registering through Clerk.
- Usage data: tickets generated, turn status, position, wait times, cancellations, ticket transfers and optional feedback.
- Technical and security data: session identifiers, anonymous token stored in the browser, audit data where applicable and records needed to prevent abuse.
- Push notification data: browser subscription endpoint and keys, only if you grant explicit permission.
- Optional Pasaporte profile data: phone number and address. Your date of birth is only stored if you ask us to wish you a happy birthday, and it is deleted if you turn that off. We do not ask for your ID card or other identity documents.
- Record of acceptance of the terms: version accepted, date, moment (sign-up, sign-in or payment), declaration of legal age and browser used, as proof of the contract.
- Approximate location, only if you use the "Walking distance" filter of the search and allow it in your browser: it is sent rounded to about 1 km to find nearby businesses, and it is neither stored nor logged. The exact distance is worked out on your device.
Businesses
- Identification and tax data: trade name, legal name, tax ID, address, country, business type and contact details.
- Data about people linked to the Business: owner, administrators, invited workers, roles, work sessions and operational activity.
- Billing and subscription data: Stripe customer and subscription identifiers, payment status and contracted plan. Qiklet does not store full card numbers.
- Operational data: branch, service point, queue and schedule configuration, metrics, internal notes and service statistics.
Legal Basis for Processing (Art. 6 GDPR)
The processing of your data is based on the following legal grounds:
Contractual performance (Art. 6.1.b GDPR)
Data processing is necessary for the provision of the contracted service: queue management, ticket issuance, subscription payment processing and user account management.
Legitimate interest (Art. 6.1.f GDPR)
Qiklet has a legitimate interest in: improving the platform through aggregate usage analysis, ensuring platform security, preventing fraud and detecting unauthorized access.
Consent (Art. 6.1.a GDPR)
For sending commercial communications (including the birthday greeting, if you turn it on), installing non-essential cookies, and push notifications. Consent is freely given, specific, informed and unambiguous, and may be withdrawn at any time.
Legal obligation (Art. 6.1.c GDPR)
For compliance with tax and commercial obligations, such as issuing invoices and retaining accounting data.
Data Flow Between Parties
Qiklet acts as a technology provider between Consumers and Businesses. The data flow works as follows:
- The Consumer generates a ticket in the Business's queue (data: ticket code, time, status).
- Qiklet processes this data to manage the queue in real time.
- The Business receives the data necessary to serve the turn (code, position, channel).
- Qiklet generates aggregated and anonymized metrics for the Business (average wait times, volumes).
Note: Payment data is processed exclusively by Stripe Inc. as a data processor. Qiklet does not store or access complete bank card data.
Recipients and Data Processors
Your data may be communicated to the following recipients:
- Convex — Cloud database and serverless backend provider used to store and synchronize data in real time.
- Clerk — Authentication and identity provider for registration, sign-in and session management.
- Stripe, Resend and geocoding providers — Stripe processes payments and subscriptions; Resend may send transactional communications; Nominatim/OpenStreetMap or OpenCage may receive Business or branch addresses to obtain coordinates.
- The Businesses you interact with — Only the data necessary for queue management.
- Vercel — Hosting and content delivery provider for the web application. When you request a ticket, it also checks invisibly that the request comes from a real browser and not an automated program (Vercel BotID), without advertising cookies or profiling.
- Sentry — Error and performance monitoring service hosted in the European Union. IP addresses and other personal data are not sent to it by default. Only if you accept analytics cookies may it record usage sessions to diagnose errors, with all text and media masked.
- PostHog — Product usage analytics tool, with servers in the European Union. It is only enabled if you accept analytics cookies, and you can withdraw that consent at any time from "Cookie settings" at the bottom of the page.
- Cloudflare Turnstile (through Clerk) and browser push services — Turnstile checks, when you sign up or sign in, that you are a person and not an automated program. Push notifications, if you turn them on, are delivered through your browser's service (Google, Apple or Mozilla), which receives the encrypted notice and the subscription address, not your name or email.
Where these providers process data outside the European Economic Area, the available safeguards will be applied in each case, such as adequacy decisions, standard contractual clauses or other mechanisms recognized by the GDPR.
Data Retention Periods
Your data will be retained for the following periods:
- Account data: while the account remains active. If the account is deleted, the active record is removed and an anonymized reference may be retained for technical traceability.
- Tickets, queues and service history: 6 years from when the turn closes. Aggregated metrics that no longer identify anyone are kept without limit.
- Billing and subscription data: for the periods required by applicable tax, accounting and commercial regulations.
- Audit, security and system event records, feedback sent, withdrawals and closed accounts or businesses: 6 years. The record of acceptance of the terms is kept while the account exists and for up to 6 years afterwards.
- Aggregated or anonymized metrics: may be retained without a time limit when they no longer identify a natural person.
- Accounts without a Pasaporte or a role in any Business: they are deleted automatically if they are never used. Before deleting them we will notify you by email at least 7 days in advance. If your Business cancels its subscription, your account is kept for 90 days so you can come back.
- Short-lived technical data (notifications, ticket transfer links, invitations, anonymous identifiers without an active ticket, disabled push subscriptions and emails that could not be sent): 90 days.
Your Rights (GDPR)
Under the GDPR, you have the following rights regarding your personal data:
Right of Access
Obtain confirmation of whether your data is being processed and access a copy of it.
Right to Rectification
Request the correction of inaccurate or incomplete personal data.
Right to Erasure
Request the deletion of your data when it is no longer necessary for the purpose of processing, you withdraw consent, or other grounds provided by the GDPR.
Right to Restriction
Request the restriction of processing in certain circumstances (accuracy contested, unlawful processing, etc.).
Right to Data Portability
Receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller.
Right to Object
Object to the processing of your data on grounds relating to your particular situation.
To exercise any of these rights, send an email to contact@qiklet.com indicating your full name, registered email address and the right you wish to exercise. We will respond within the applicable legal period, generally one month from receipt of the request.
If you believe that the processing of your data violates the regulations, you may file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
Security Measures
Qiklet implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit through HTTPS/TLS and security measures provided by the infrastructure provider.
- Secure authentication via Clerk (no plain-text password storage).
- Role-based access control (RBAC).
- Continuous monitoring and access auditing.
- Backups, availability controls and recovery procedures according to the capabilities of the infrastructure provider.