Privacy Policy

1. Data controller

The Weko service is provided by Weko (the "Controller"), with a professional address in Spain. Full identifying details (tax ID, postal address and commercial registry where applicable) will be added to this version once the operating company is formally incorporated. Data protection contact: [email protected]. General contact: [email protected].

2. Data we process

• Account and business data: name, email, hospitality establishment details, employees, suppliers, invoices, items, sales and inventory entered or imported by the user.
• Banking data via open banking (PSD2): if the user connects their bank, we access the list of accounts and transactions in read-only mode, solely to automatically reconcile outstanding invoices. Access is provided by the authorised aggregator Enable Banking through a consent the user grants on their own bank website and which can be revoked at any time from Weko or from their bank. Weko never stores banking credentials.
• Usage and technical data: access logs, IP address and application events, necessary for security and operation. While you are signed in we also record, on our own servers, which screens and features you use, so we can provide the service and improve it. For this we use a session identifier that is kept in your browser tab and deleted when you close it (it is listed in the cookie policy table); it is technical and necessary to provide you with the service, and nothing is sent to third parties. It is based on our legitimate interest (art. 6.1.f GDPR) and you can object by writing to the data protection address in section 1.
• Session recording (only if you accept analytics): we record your journey through the website and the app — screens, clicks and interface texts — to improve the product. What you type into forms is not recorded; tables, record sheets and lists with customer or employee data appear covered; and the browser's internal messages are not recorded. While you are signed in, the recording is tied to your account number. If you reject analytics or withdraw your consent, recording stops. More detail in the cookie policy.

3. Purpose and legal basis

We process data to provide the contracted hospitality management service (performance of the contract, Art. 6.1.b GDPR), for bank reconciliation when the user activates open banking (the user’s explicit consent, Art. 6.1.a GDPR, revocable), to comply with legal and tax obligations (Art. 6.1.c GDPR) and for platform security (legitimate interest, Art. 6.1.f GDPR).

4. Processors and third parties

We share data only with the providers needed to deliver the service, acting as data processors: the open banking aggregator Enable Banking (access to account information authorised by the user), the payment processor Stripe Payments Europe, Ltd., and the hosting and infrastructure providers. We do not sell or transfer personal data to third parties for advertising purposes.

5. Retention

We keep the data while the account is active and, afterwards, for the periods required by tax and commercial regulations. Bank transaction data obtained via open banking is kept only for the time needed for reconciliation and is deleted or anonymised when no longer necessary or when the user revokes consent.

6. Rights

The user may exercise their rights of access, rectification, erasure, objection, restriction and portability by writing to [email protected]. They may also withdraw consent for open banking at any time, without affecting the lawfulness of prior processing, and lodge a complaint with the Spanish Data Protection Agency (aepd.es).