Privacy policy
Who processes your data
The controller is Diego Manuel Béjar Santiago (Wandary), tax ID 10880184B, at C/ Cardenal Benlloch, 74, esc. izq., 1-1, 46920 Mislata (Valencia), Spain. Write to befoo@wandary.com about anything related to your data.
What we process and why
| Data | Why | Legal basis |
|---|---|---|
| Email address | Create your account, send your login code and essential notices | Performance of the contract (art. 6.1.b GDPR) |
| Name and photo (optional) | So the shop recognises you when stamping your card | Performance of the contract |
| Birthday day and month (optional) | To wish you a happy birthday and so shops that enable it can set aside an offer or a gift for that day. We don’t store the year. No shop sees the date | Your consent (art. 6.1.a) |
| Cards, stamps, visits and rewards | Keeping track of your loyalty at each shop | Performance of the contract |
| Notices we send you (push, email) | Telling you about a stamp, a reward or stamps about to expire | Performance of the contract |
| A shop's promotions and messages (email and push notifications) | Sending you their promotions and automatic messages (birthday, “we haven't seen you in a while”), by push notification and by email, only if you accept them for that shop | Your consent (art. 6.1.a GDPR and art. 21 of the Spanish LSSI), withdrawable on each card, in Settings → Notices and with the unsubscribe link in every email |
| Review requests (email and push notifications) | Asking you, on behalf of a paying shop where you have a card, for a Google review, with nothing in return and at most once per location (if you dismiss it, it isn't repeated for six months) | Legitimate interest (art. 6.1.f); you can object in Settings → Notices and with the unsubscribe link in every email |
| IP address (hashed), user agent | Security, rate limits and consent records | Legitimate interest (art. 6.1.f) |
| Billing details (shops) | Charging the subscription and issuing the invoice | Contract and legal obligation |
What the shop sees
When you join a shop's card, that shop sees your name, your photo (if you added one) and your card activity (stamps, visits and rewards). It does not see your email, your phone, your birthday or your activity at other shops. If it wants to reach you, it does so through Befoo and only if you accepted its promotions.
Who else processes your data
Only the providers we need, under data processing agreements:
- Amazon Web Services (servers and backups, Paris region, EU).
- Twilio SendGrid (email delivery).
- Stripe (shop payments; we never store card details).
- Google (only if you log in with Google, and for the map and reviews).
- Google Wallet (only if you save your QR to it; see the next section).
We don't sell your data or share it for advertising.
Your QR in Apple Wallet or Google Wallet (optional)
If you ask for it, we give you your Befoo QR as a pass for your phone's wallet. It's up to you and you don't need it to use Befoo.
- Apple Wallet: we don't send Apple any data. The pass is generated on our server and delivered to your device; it carries your name and your QR, and it stays there.
- Google Wallet: so you can save it, we create a pass at Google with your QR (your account code) and generic Befoo texts, without your name or email. Google links it to your Google account under its own privacy policy. If you delete your Befoo account, we deactivate it: Google doesn't allow deleting it completely, but it stops being valid and your code no longer identifies anyone.
Legal basis: performance of the contract, at your request (Art. 6(1)(b) GDPR).
How long
While you have an account. If you close it, we delete your account, cards and stamps immediately and permanently, except a minimal pseudonymised record of the deletion and shops' billing data, which the law requires us to keep (4 years).
Inbox notices are deleted after 180 days.
Your rights
You can access, rectify, erase, restrict, object and request portability by writing to befoo@wandary.com, or straight from My account (change your details, your photo and close your account). You can also complain to the Spanish Data Protection Agency.
To withdraw consent for a shop's promotions, open its card and switch them off. To choose how each type of notice reaches you (push notification, email or both), go to Settings → Notices; to stop a type of notice by email, you can also use the unsubscribe link in every email.
Children
Befoo is not aimed at children under 14.
Last updated: 2026-10-07.