Data processing agreement
November 2026
This is a translation of the Spanish original. If the two differ, the Spanish version prevails.
This agreement, under Article 28 GDPR, forms part of the OnlyTap terms of service and you accept it with them, with no need to sign it separately.
1. The parties
Controller: you, the business that uses OnlyTap, with your account details.
Processor: Miguel Monterrey Varela, trading as Volcano MKT, tax ID 42192719R, Av. Carlos Francisco Lorenzo Navarro, 56, 38760 Los Llanos de Aridane (Santa Cruz de Tenerife), Spain. Email: hola@onlytap.es.
2. What it covers
The personal data we process on your behalf to provide OnlyTap: storing and displaying what you publish, opening your links and your pages, recording taps and scans, calculating your statistics and handling support.
It does not cover your account or billing data, of which we are the controller, as the privacy policy explains.
3. What data and whose
- People who open your links, QR codes, plaques or pages
- Date and time, link, approximate country, device type, system, browser and the page they came from. The country is obtained from the IP address at that moment, without storing it with the visit.
- People who appear in what you publish
- The data you decide to include in your pages, files and contact blocks, such as names, telephone numbers or emails.
- People who appear in a support screenshot
- A screenshot can show data of your business’s customers. Support processes it on your behalf and only to resolve that query.
OnlyTap is not designed for special categories of data, such as health data. If you publish them, the responsibility is yours.
4. Duration
It lasts while your account exists and until the data is deleted. When the account is closed we keep the data for 12 months and it is then deleted, including from backups within 30 days at most. Before closing it you can take your statistics in CSV.
5. What we undertake to do
- Process the data only on your instructions, which are these terms and what you set up in OnlyTap, unless the law requires otherwise. We will tell you if we think an instruction breaks the law.
- Make sure that those who access the data are bound by confidentiality.
- Apply appropriate security measures (Article 32 GDPR), such as those in the privacy policy.
- Help you respond to people who exercise their rights and pass on to you any requests we receive.
- Notify you without undue delay if we suffer a security breach affecting this data, and help you with what applies under Articles 32 to 36 GDPR.
- Give you the information needed to show that we comply with this agreement and allow reasonable audits, agreed in advance.
- Enter your account only to resolve a query or an incident. Each entry is recorded.
6. Sub-processors
You authorise us to use sub-processors to provide the service, with the same obligations as this agreement:
- Hosting and email: Arsys.
- Payments: Stripe.
- Artificial intelligence, only if you use it: it receives the description you write, the business type and the language.
- Associated technology infrastructure providers.
If we add or replace a sub-processor, we will notify you by email at least 15 days in advance. If you object for a reasonable cause and we find no solution, you can close the account.
7. International transfers
As a rule, we do not transfer this data outside the European Economic Area, but some technology providers may have entities outside it. In that case, the transfer relies on adequacy decisions, such as the EU-US Data Privacy Framework where it applies, or on standard contractual clauses and the other safeguards of Articles 44 et seq. GDPR.
8. What is up to you
- Having a legal basis for the data you entrust to us and informing the people concerned.
- Publishing only data you are allowed to publish.
- Handling the rights of those who open your links and your pages.
9. Google or Meta measurement on your pages
If you activate Google or Meta measurement on a page, the decision and the responsibility are yours: you choose to measure, you are the controller of that data and your relationship with Google or Meta is your own. You must inform your visitors and have your own privacy and cookie policy.
OnlyTap gives you the means: a notice on the page that does not load those tools until the person accepts and that allows them to change their mind. The redirects of links never load them.
10. Liability and law
The liability limit, the law and the courts of the terms of service apply to this agreement.