Privacy Policy
Last updated: August 31, 2026
1. Data Controller
The controller responsible for the personal data collected through the Senda Exacta mobile application and web services is:
- Name: Senda Exacta S.L.
- Spanish tax ID (CIF): B93923282
- Address: Plaza América 2, Floor 2, Door A1 — 36211 Vigo, Spain
- Email: info@sendaexacta.es
- WhatsApp: Open a chat
- Website: https://sendaexacta.es
2. Data We Collect
Depending on how you use the app, we may collect the following data:
Account data
Your name, email address, company name, and phone number provided when you register or update your profile.
Uploaded documents
Images (taken with the camera or selected from your gallery) and PDF files of invoices and receipts that you upload for processing. These documents may contain personal data of third parties (suppliers, customers, etc.).
Device permissions
The app may request access to the camera (to photograph documents) and storage/gallery (to select existing files). These permissions are optional and can be revoked at any time in your device settings.
Usage data
In-app activity logs, features used, errors, and app performance metrics.
Technical data
IP address, device type and version, operating system, device identifiers, and language settings.
3. Purpose and Legal Basis for Processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service (document data extraction, treasury forecasting, ERP export) | Performance of a contract (Art. 6.1.b) |
| Managing your user account | Performance of a contract (Art. 6.1.b) |
| Service-related communications (incidents, important changes) | Legitimate interest (Art. 6.1.f) |
| Service improvement and analytics | Legitimate interest (Art. 6.1.f) |
| Compliance with legal obligations | Legal obligation (Art. 6.1.c) |
4. Data Retention
Account data and documents are retained for as long as your account is active. After account cancellation, data is deleted within 90 days, unless a longer retention period is required by law (for example, accounting records for 6 years under Spanish tax regulations).
5. Data Sharing with Third Parties
We do not sell your personal data. We may share it only with:
- Cloud infrastructure providers (for document storage and processing), acting as data processors under a data processing agreement.
- AI / OCR service providers used to extract data from uploaded documents, subject to the same contractual guarantees.
- ERP / accounting systems to which you choose to export processed data (e.g. SAP, Holded, A3).
- Public authorities when required by law.
6. International Transfers
If any service provider processes data outside the European Economic Area, we ensure adequate safeguards are in place (European Commission standard contractual clauses or equivalent mechanisms).
7. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, or destruction — including encryption in transit (TLS) and at rest, role-based access control, and regular security reviews.
8. Your Rights
Under the GDPR, you have the right to:
- Access: know what data we process about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion of your data ("right to be forgotten").
- Restriction: ask us to suspend processing in certain circumstances.
- Portability: receive your data in a structured, commonly used format.
- Objection: object to processing based on legitimate interest.
To exercise any of these rights, email us at info@sendaexacta.es. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or with the supervisory authority in your country of residence.
9. Cookies and Website Analytics
This website does not set any cookie until you allow it. The first time you visit, a banner asks whether you accept analytics cookies; nothing is loaded from Google before you answer, and refusing leaves the site fully functional.
If you accept, we use Google Analytics 4 (Google Ireland Limited) to measure aggregated traffic: pages visited, approximate location by country or city, device and browser, and how visitors arrived. IP addresses are anonymised, we do not enable advertising features or Google Signals, and we never use the data to identify you personally or to show you ads. The cookies involved are _ga and _ga_<id>, which last up to 24 months.
- Legal basis: your consent (art. 6.1.a GDPR and art. 22.2 LSSI-CE).
- Transfers: Google may process the data in the United States under the EU-US Data Privacy Framework and standard contractual clauses.
- Withdrawing consent: click "Cookie settings" in the footer of any page to change or withdraw your choice at any time. You can also delete the cookies from your browser.
Beyond this, the site stores only your language and cookie preference in your own browser; that information never leaves your device.
10. Children
The app is intended for professionals and businesses. We do not knowingly collect data from children under 16. If you believe a child has provided data without consent, please contact us so we can delete it.
11. Changes to This Policy
We may update this privacy policy periodically. When changes are significant, we will notify you by email or via a prominent notice in the app. The "last updated" date at the top always reflects the current version.
12. Contact
If you have any questions about this policy or how we handle your data, please contact us at: