Privacy Policy

1. Data controller

2. Personal data we collect

Depending on the type of user and how you interact with the platform, we may collect the following data:

2.1 Data from all users

• Full name
• Email address
• Phone number
• Date of birth (to verify you are of legal age and to wish you a happy birthday)
• Password (stored in encrypted form)
• Preferred language
• IP address (logged for security purposes)
• Profile photo (optional for clients, required for professionals)

2.2 Additional data from professionals

• Identity document (national ID, residence permit or passport)
• Biometric data (only if the professional voluntarily requests identity verification): facial image of the identity document and a selfie with a liveness check, processed using facial recognition for the sole purpose of verifying that the document belongs to the person presenting it. This processing is based on your explicit consent (Art. 9.2.a GDPR), requested when initiating verification and withdrawable at any time. Processing is carried out by a specialised provider located in the European Union (see section 5.1).
• Service categories offered
• Liability insurance details, if the professional holds a policy (policy number, expiry date)
• Subscription billing data (via the payment gateway, to charge the monthly plan fee; MyWishi does not process payment for the services)
• Geographic coverage area

2.3 Data generated through use

• Location of requested services (address, city, GPS coordinates)
• Chat messages between client and professional
• Photos of the work (before, during and after)
• Ratings and reviews
• Service request and job history

Note: MyWishi does not process or record payments for services. Payment is agreed and executed directly between the client and the professional outside the platform. The only billing data MyWishi collects relates to the professional's monthly subscription (managed by Stripe; MyWishi does not store card numbers).

2.4 Professional recruitment ("Join as a technician" form)

If you fill in the Join as a technician form without registering, we process your name, phone, email, trade, working area and, optionally, your message, for the sole purpose of contacting you to invite you to sign up as a technician. As proof of your consent we also record your IP address, browser identifier and the date and time of submission. The legal basis is your explicit consent (art. 6.1.a GDPR), given by ticking the form checkbox, which you may withdraw at any time by writing to [email protected]. We do not share this data with third parties nor use it for third-party advertising. We keep this data for a maximum of 12 months; if you do not register, it is deleted automatically.

3. Legal basis for processing

The processing of your data is based on the following legal grounds:

• Performance of a contract (Art. 6.1.b GDPR): Processing is necessary to provide the intermediation service you agreed to when registering on the platform.
• Legitimate interest (Art. 6.1.f GDPR): Fraud prevention, platform security, technical monitoring of the server, service improvement and birthday greetings to registered users (you can object at any time, see section 4).
• Legal obligation (Art. 6.1.c GDPR): Retention of tax and billing records as required by Spanish tax law.
• Consent (Art. 6.1.a GDPR): For sending commercial communications, both our own and third-party ones, optional usage analytics (Umami and Google Analytics) and browser error diagnostics (Sentry frontend). We only send you commercial communications if you expressly agree by ticking the corresponding box when you register (unticked by default). You can withdraw your consent at any time from your account settings or with the unsubscribe link in each communication, without affecting the lawfulness of prior processing. Service emails (account notices, quotes, invoices) and the birthday greeting are not commercial communications.

4. Purpose of processing

• Account registration and management
• Connecting clients with professionals for service delivery
• Billing and collection of the professional's subscription (MyWishi does not process payment for the services)
• Service-related communications (notifications, alerts, reminders)
• Sending you a greeting by email on your birthday, based on the date of birth you provide when registering. It contains no advertising or offers. You can stop receiving it at any time by turning off emails in the notification settings of the app or by writing to [email protected].
• Identity and qualification verification of professionals
• Handling queries and managing the relationship with the user
• Fraud prevention and platform security
• Continuous service improvement and anonymised statistical analysis
• Compliance with legal and tax obligations

5. Data recipients

5.1 Service providers

Your personal data may be shared with the following third-party data processors:

You may request the detailed list of specific providers by writing to [email protected].

5.2 Data shared with other users

For the proper functioning of the service, we share limited data between the parties involved:

5.3 Sharing for legal reasons

MyWishi may disclose your personal data to third parties when required by applicable law, a court order or a request from the competent authorities. In particular:

• Judicial, tax or administrative authorities in compliance with legal obligations.
• Law enforcement agencies in the context of investigations.
• Insurance companies, in the event of claims related to services provided through the platform.
• In the event of a merger, acquisition or asset sale, data may be transferred to the resulting entity, which will remain subject to this privacy policy.

6. Automated processes

MyWishi uses automated processes to facilitate the operation of the platform. These processes do not produce decisions with legal effects on you without human intervention. In particular:

• User matching: We notify professionals who operate in the area and category of each service request. The professional freely decides whether to submit an application.
• Automatic chat translation: If two users communicate in different languages, the system translates messages automatically. The original message is always preserved and the user can view both versions.
• Writing assistant (optional): We offer an artificial intelligence tool that helps draft service descriptions and estimates. Its use is voluntary and the user reviews and edits the content before submitting it.
• Fraud detection: We apply automated rules to prevent fraudulent behaviour, such as self-application or rating manipulation.

7. International transfers

Some of our service providers are located outside the European Union. These international transfers are carried out with appropriate safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission, included in contracts with each provider.
• Data Privacy Framework (DPF) for providers certified under the EU-US framework.
• Transfer Impact Assessments (TIAs) carried out in accordance with EDPB guidelines.

8. Data retention periods

• Active account data: For as long as the account remains active and for 30 days after a deletion request.
• Chat messages: 12 months from the last message in the conversation.
• Tax and billing records: 6 years in accordance with Spanish General Tax Law.
• Security data (logs, IP): 12 months.
• Complaints and queries to the platform: 3 years from closure.
• Anonymised statistical data: No time limit (once anonymised, they no longer constitute personal data).

9. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: Obtain confirmation of whether we process your data and access it. You can request a full export of your data from the platform (GDPR Export feature).
• Right to rectification: Correct inaccurate or incomplete data from your profile or by request.
• Right to erasure (“right to be forgotten”): Request the deletion of your data when it is no longer necessary for the purpose for which it was collected.
• Right to data portability: Receive your data in a structured, commonly used and machine-readable format (JSON).
• Right to object: Object to the processing of your data in certain circumstances.
• Right to restriction of processing: Request the restriction of processing in the cases provided by law.
• Right not to be subject to automated decisions: We do not make decisions based solely on automated processing that produce legal effects concerning you.

10. How to exercise your rights

You can exercise any of the above rights by:

• Email: [email protected]
• From the platform: “My Account” → “Export my data” section (for access and portability).

You must adequately identify yourself (name, registered email, copy of ID if requested). We will respond within a maximum of one calendar month of receipt, as required by Article 12.3 GDPR (extendable by two further months in cases of special complexity, in which case we will inform you).

11. Cookies and local storage

MyWishi uses strictly necessary technical cookies (session, security, language preference), anti-fraud cookies from the subscription payment gateway, and — only with your consent — anonymous usage analytics hosted on our own servers and error diagnostics. We do not use advertising, retargeting or social media tracking cookies.

The full inventory (name, purpose and duration of each cookie) and how to manage your consent are available in the Cookie Policy.

12. Data security

We implement technical and organisational measures to protect your data:

• Encryption in transit (HTTPS/TLS) and at rest in the database.
• Secure authentication with periodic credential rotation.
• Perimeter protection against attacks (DDoS, injection, etc.).
• Advanced security headers in all communications.
• Role-based access control with verification on every request.
• Activity logging with traceability for audits.
• Sensitive data sanitisation in all system responses.

13. Minors

MyWishi is not intended for persons under 18 years of age. Registration requires date of birth verification. If we detect that a user is a minor, we will immediately delete their account and personal data.

14. Complaints to the supervisory authority

If you believe your data is not being processed in accordance with regulations, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD):