Legal
Privacy Policy
This policy explains how Midas Business Group S.L. (“MIDAS”) collects, uses and protects your personal data when you use MIDAS Business Ecosystem, in accordance with the EU General Data Protection Regulation (GDPR) and Spanish data-protection law.
1. Data controller
The data controller is Midas Business Group S.L. (tax ID B13977913), registered office Calle Paraguay 33, 35109 El Tablero (Las Palmas), Spain. For any privacy matter contact support@midasbusiness.net.
2. What data we collect
- Account & profile — name, email, password (hashed), role, company details, profile information and preferences.
- Identity & verification — where you receive payouts, identity and KYC information is collected and verified by Stripe (we do not store full identity documents).
- Payment data — subscription status and billing metadata. Card details are processed and stored by Stripe, not by us.
- Transactional & commission data — bookings, QR/voucher activity, attributions, commissions and payouts.
- Reputation & quality signals — publicly available ratings and reviews about your business (for example on Google or TripAdvisor) that we assess to confirm eligibility for the network's quality standard. We assess only lawfully public information and never ask for third-party platform credentials.
- Usage & technical — log data, device/browser information, IP address and cookies (see our Cookie Policy).
- Communications — messages and support requests you send us.
3. Why we use it & our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Platform, your account and its features | Performance of a contract |
| Process subscriptions, payments and payouts | Contract · legal obligation |
| Calculate and pay commissions; maintain the ledger | Contract |
| Assessing eligibility from public ratings (the 3.5 standard) | Legitimate interests |
| Security, fraud prevention and KYC/AML | Legal obligation · legitimate interests |
| Service emails (receipts, confirmations, notices) | Contract · legal obligation |
| Product analytics and improvement | Legitimate interests · consent (where required) |
| Marketing communications | Consent (you can withdraw at any time) |
| Accounting, tax and legal compliance | Legal obligation |
4. Who we share it with (processors)
We share data with trusted providers who process it on our behalf under data-processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication & file storage | EU / USA |
| Vercel | Website & application hosting, CDN | USA / global |
| Stripe | Payment processing & payouts (Stripe Connect) | USA / EU |
We do not sell your personal data. We may disclose data where required by law or to protect our rights, users or the Platform.
5. International transfers
Some providers are located outside the EEA. Where data is transferred internationally, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.
6. How long we keep it
We keep personal data only as long as necessary for the purposes above: for the life of your account and, after closure, for the periods required by law — in particular accounting and tax records, which under Spanish law are generally kept for up to six (6) years. Some data is anonymised and retained for statistics.
7. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy;
- rectify inaccurate data;
- erase your data (“right to be forgotten”), subject to legal retention;
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time (without affecting prior processing); and
- lodge a complaint with the supervisory authority, the Agencia Española de Protección de Datos (AEPD) (www.aepd.es).
To exercise any right, email support@midasbusiness.net. We respond within one month.
If your account is suspended or closed — including removal from the network under the quality standard — you do not lose your work. On request, and except where the law prevents it, we will package the personal data and business content associated with your account into a downloadable, machine-readable file so you can take it elsewhere, in line with your right to data portability above and section 14 of our Terms of Service.
8. Cookies
We use cookies and similar technologies as described in our Cookie Policy.
9. Security
We apply appropriate technical and organisational measures — including encryption in transit, access controls and row-level security — to protect your data. No system is perfectly secure; if a breach affects your rights we will notify you and the authority as required by law.
10. Children
The Platform is not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes & contact
We may update this policy; the “last updated” date reflects the current version and material changes will be notified. Contact: support@midasbusiness.net.
Questions about this document? Contact us at support@midasbusiness.net.