Legal
Privacy Policy
This policy explains how MIDAS Business Group S.L. ("MIDAS") collects, uses and protects your personal data when you use midasbusiness.net, the MIDAS app at midasapp.net and the portals behind them, in accordance with the EU General Data Protection Regulation (GDPR) and Spanish data-protection law.
1. Data controller
The data controller is MIDAS Business Group S.L. (tax ID B13977913), registered office Calle Paraguay 36, 35109 El Tablero, San Bartolomé de Tirajana (Las Palmas), Spain. For any privacy matter contact support@midasbusiness.net.
2. What data we collect
- Account & profile - name, e-mail, password (hashed) if you set one, account type and membership tier, profile details, portrait and cover image, and preferences.
- Applications - if you apply as a business, representative or investor: what you apply as, your business name, area and anything you choose to tell us.
- Wallet & calendar - VIP cards, vouchers, tickets and booking passes held in your wallet, scans of those passes at venues, and the plans, reminders and invitations in your calendar.
- Social feed - posts, reels, stories, photos, videos, files, comments, likes, shares, saves, follows, tags and the people who viewed your stories.
- Dating (only if you use it) - your dating profile, photos, preferences, likes and matches, messages, and the area you choose to show.
- MIDAS Ascent (only if you use it) - your daily check-ins (energy, focus, recovery, growth, sleep) and the coaching sessions you book.
- Identity & verification - where you receive payouts, identity and KYC information is collected and verified by Stripe (we do not store full identity documents).
- Payment data - subscription status and billing metadata. Card details are processed and stored by Stripe, not by us.
- Transactional & commission data - bookings, QR/voucher activity, attributions, commissions and payouts.
- Reputation & quality signals - publicly available ratings and reviews about your business (for example on Google or TripAdvisor) that we assess to confirm eligibility for the network's quality standard. We assess only lawfully public information and never ask for third-party platform credentials.
- Usage & technical - log data, device and browser information, IP address, cookies and local storage (see our Cookie Policy).
- Communications - messages, reports and support requests you send us.
3. Sensitive data - only with your explicit consent
Some features can reveal information that the GDPR treats as special-category data (Article 9):
- Dating, including Duo and Swing, can reveal your sexual orientation or aspects of your sex life.
- MIDAS Ascent check-ins about sleep, energy and recovery can be health-related data.
We process this data only with your explicit consent, which you give when you first open Dating or make your first Ascent check-in, and only to provide that feature to you. It is never used for advertising, never sold and never shared outside the feature. Your Swing profile is only visible to other members inside Swing. You can withdraw your consent at any time by deleting your dating profile or your check-ins in the app, or by contacting us.
4. Who can see what
- Public posts on the social feed can be seen by other MIDAS users. Posts set to My network are seen only by your accepted connections. Stories disappear after 24 hours.
- Your dating profile is visible only inside Dating, to members who match your settings.
- Your wallet, calendar, check-ins and messages are private to you and, where relevant, to the venue that issued a pass or the people you invite.
- Venue staff see the passes their venue issued to you and the scans at their door.
5. Why we use it & our legal bases
| Purpose | Legal basis |
|---|---|
| Provide the Platform, your account, wallet, calendar and social features | Performance of a contract (Art. 6(1)(b)) |
| Dating and MIDAS Ascent | Explicit consent (Art. 9(2)(a)) |
| Review applications for business, representative and investor accounts | Steps prior to a contract (Art. 6(1)(b)) |
| Process subscriptions, payments and payouts | Contract · legal obligation |
| Calculate and pay commissions; maintain the ledger | Contract |
| Assessing eligibility from public ratings (the 3.5 standard) | Legitimate interests |
| Moderating content, handling reports and keeping members safe | Legal obligation (EU Digital Services Act) · legitimate interests |
| Security, fraud prevention and KYC/AML | Legal obligation · legitimate interests |
| Service e-mails (sign-in codes, receipts, confirmations, notices) | Contract · legal obligation |
| Product analytics and improvement | Legitimate interests · consent (where required) |
| Marketing communications | Consent (you can withdraw at any time) |
| Accounting, tax and legal compliance | Legal obligation |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
6. Who we share it with (processors and services)
We share data with trusted providers who process it on our behalf. Some services only receive your IP address when your device loads them:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication & file storage (accounts, wallet, calendar, feed, dating, messages) | EU / USA |
| Vercel | Website & application hosting, CDN | USA / global |
| Stripe | Payment processing & payouts (Stripe Connect) | USA / EU |
| Open-Meteo | Weather and sunset times in the calendar (receives your IP address only) | Switzerland / EU |
| CARTO / OpenStreetMap | Map tiles in the guest app (receives your IP address only) | EU / USA |
| jsDelivr & cdnjs (Cloudflare) | Delivery of open-source scripts (receives your IP address only) | Global |
| Google Fonts | Typography on midasbusiness.net (receives your IP address only) | USA / global |
Venues and businesses on MIDAS receive the data needed to serve you - for example your name and party size for a booking, or a pass you show at their door. We do not sell your personal data. We may disclose data where required by law or to protect our rights, users or the Platform.
7. International transfers
Some providers are located outside the EEA. Where data is transferred internationally, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.
8. How long we keep it
- Account data: for the life of your account.
- Stories: 24 hours. Deleted posts, comments and dating profiles are removed from the Platform straight away and from backups within their normal rotation.
- Applications that are not approved: up to 12 months, so a new application can be reviewed in context.
- Accounting and tax records: generally up to six (6) years under Spanish law, even after an account is closed.
- Some data is anonymised and retained for statistics.
9. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy;
- rectify inaccurate data;
- erase your data ("right to be forgotten"), subject to legal retention;
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time (without affecting prior processing); and
- lodge a complaint with the supervisory authority, the Agencia Española de Protección de Datos (AEPD) (www.aepd.es).
To exercise any right, e-mail support@midasbusiness.net. We respond within one month.
If your account is suspended or closed - including removal from the network under the quality standard - you do not lose your work. On request, and except where the law prevents it, we will package the personal data and business content associated with your account into a downloadable, machine-readable file so you can take it elsewhere, in line with your right to data portability and section 18 of our Terms of Service.
10. Cookies and local storage
We use cookies and similar technologies as described in our Cookie Policy.
11. Security
We apply appropriate technical and organisational measures - including encryption in transit, access controls and row-level security, so that each member can only read their own private data - to protect your data. No system is perfectly secure; if a breach affects your rights we will notify you and the authority as required by law.
12. Age
MIDAS is for people aged 18 and over. We do not knowingly collect data from anyone under 18 and delete it if we learn that we have.
13. Changes & contact
We may update this policy; the "last updated" date reflects the current version and material changes will be notified. Contact: support@midasbusiness.net.
Questions about this document? Contact us at support@midasbusiness.net.