Version v1.0 — 29/07/2026.
The controller for the processing operations described below is DATAAPPS & LEARNING, SLU, number L-720967-N, trading under the name SOLUCIONS DIGITALS JOA, whose registered office is located at Urb. Can Noguer, Ed. Celistia, Bloc C, 4-2, AD700 Escaldes-Engordany, Principality of Andorra.
General contact: support@climbexdata.com.
Personal data contact: privacy@joasolucions.com.
Telephone: +376 339 995.
Etaligo is a platform connecting customers and market sellers. For the processing operations necessary for the account and the operation of the platform, DATAAPPS & LEARNING, SLU determines the purposes and means and therefore acts as controller. Sellers are separate controllers for the use they make of their own customers' data: we process nothing on their behalf, and their obligations towards their customers are their own.
Depending on your use of the application, we may process:
We do not request any data falling within the special categories of Article 9 of the GDPR (health, political opinions, religion, biometrics, etc.). Users must not transmit such information in the chat, the descriptions, the photos or the free-text requests.
The location recorded for a market corresponds to a professional place chosen by the seller, and not to continuous tracking of the phone's position. If device geolocation is added later, it will be subject to specific information and a specific choice before activation.
| Purpose | Legal basis |
|---|---|
| Create the account, authenticate the user and provide the requested functions | Performance of a contract or pre-contractual measures |
| Manage seller applications and the customer-seller relationship | Pre-contractual measures and performance of a contract |
| Contract, invoice and administer the seller's professional subscription outside the app | Performance of a contract and accounting/tax obligations |
| Record and track orders, collections, exchanges and service notifications | Performance of a contract |
| Enable the seller to publish their catalogue, their markets and their time slots | Performance of a contract |
| Ensure security, prevent abuse, maintain an audit trail and defend our rights | Legitimate interests, subject to a balancing test; legal obligation where applicable |
| Comply with accounting or tax obligations or requests from the authorities | Legal obligation |
| Send optional push notifications | Consent/notification authorisation, revocable on the device |
| Display the Google map of a market, only after you click "Show the map" | Consent, given by that click and withdrawable by reloading the page |
| Respond to support and to GDPR requests | Legitimate interests and legal obligation |
Data that is essential is indicated in the interface. Without it, the account, the application or the order concerned cannot be processed.
The data is accessible, according to their needs and rights:
Sellers must only access the data necessary for the preparation and handover of their orders. They may not reuse it for marketing purposes without an appropriate legal basis and information.
Google generally acts as processor for the user data entrusted to the Firebase services. The Firebase Data Processing and Security Terms, incorporated into the contractual terms of the service, govern this processing even in the absence of a separately signed paper DPA. Certain Firebase services governed by the Google Cloud terms fall under the Cloud Data Processing Addendum. The contracting entity is Google Cloud EMEA Limited (Dublin, Ireland), as shown on the project's Cloud Billing invoices; its full contact details are in the legal notice. The publisher keeps a dated copy of the terms accepted by the owner account.
The application data is hosted in the European Union. The regions were
verified against the deployed configuration, not assumed: Cloud Firestore in
eur3 (Belgium and the Netherlands), Cloud Functions and Cloud Storage in
europe-west1 (Belgium). Not all services are exclusively European for all
that: Firebase states that Firebase Authentication is operated from data
centres located in the United States, and Cloud Messaging relies on a global
infrastructure.
Our email service is hosted by Zoho in its European infrastructure (Amsterdam and Dublin): the emails you send us are stored in the European Union. Zoho states, however, that its Indian entity may, for the purposes of technical support, access this data.
| Destination | Why | What governs it |
|---|---|---|
| Andorra — Etaligo itself and its accounting firm | The publisher is established there; the accounts are kept there | Adequacy decision of the European Commission (2010/625/EU): no additional safeguard required |
| United States — Firebase Authentication (data centres located in the United States), as well as Google or Apple sign-in if you choose it | The service is not exclusively European | Google's/Apple's data processing terms and the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) for certified entities |
| India — access by Zoho's Indian entity, for technical support only | Support from the email provider | Standard contractual clauses — India does not benefit from any adequacy decision |
India is, as at the date of this version, the only destination without an adequacy decision that Zoho has confirmed to us, and the only transfer that relies on standard contractual clauses rather than on adequacy. Depending on the region, our contract with Zoho allows other entities of its group to be involved for support purposes only, under the same contractual framework.
The other transfers are governed by Google's data processing and security terms and, where necessary, by standard contractual clauses and supplementary measures. A copy of, or information about, the applicable safeguards may be requested at the personal data contact address.
The periods below are applied. The purges marked "automatic" are carried out by a scheduled server-side task, with no manual intervention:
| Data | Period |
|---|---|
| Active account and profile | Lifetime of the account |
| Inactive account with no order or pending obligation | Alert then deletion after 2 years of inactivity — automatic |
| Seller application refused or abandoned | 12 months after the decision/last contact, save in the event of litigation — automatic |
| Customer-seller access request refused/withdrawn | Deletion 12 months after closure — automatic |
| Orders, items of evidence, incidents and associated chat | 5 years after the last operation |
| Accounting data and invoices issued by Etaligo | 5 years, the period applicable under Andorran law |
| FCM tokens | Until revocation, invalidation or deletion of the account, and at the latest after 270 days without use (about 9 months) — automatic |
| Security logs | 12 months — automatic |
| Support tickets | Handling time then 3 years in the event of follow-up/potential litigation |
| Backups | We operate no separate application backup: the data relies on Google Cloud's own durability and replication. Nothing is therefore kept in a copy that would outlive the deletion of the active data |
Deletion of the account must promptly disable access and then delete or anonymise the data that is no longer necessary. Certain data may be archived separately where a legal obligation or the defence of legal claims so requires.
From the "Account > My data" area, the user can obtain a JSON export and request the deletion of their account. The request is refused as long as orders are in progress. After confirmation, the profile, contact details, notification tokens, access relationships, media, messages and free-text notes are deleted. Completed orders may retain the market, the period, the products, quantities, amounts and statuses in a form that no longer includes the identity of the customer or the seller. No stable identifier specific to the deleted person is kept in the aggregated statistics.
Identifying elements may exceptionally be placed in intermediate archiving where their retention is necessary for an accounting obligation, fraud prevention or a dispute. They are then separated from the active data, accessible only to authorised persons and deleted at the applicable term.
Under the conditions provided for by the regulation, you have the rights of access, rectification, erasure, restriction of processing, to object and to data portability, as well as the right to withdraw your consent at any time without affecting prior processing. You may also request not to be subject to a decision based solely on automated processing producing significant legal effects. Etaligo does not currently provide for any such automated decision.
To exercise your rights, write to privacy@joasolucions.com or support@climbexdata.com, stating the account concerned. Proof of identity will only be requested in the event of reasonable doubt and only the information necessary for verification will be used. We reply in principle within one month, a period which may be extended in the cases allowed.
You may lodge a complaint with the supervisory authority of your country of residence, in particular the CNIL (French data protection authority) in France, the AEPD (Spanish data protection authority) in Spain, or the APDA (Andorran data protection authority) in Andorra.
DATAAPPS & LEARNING, SLU is established in Andorra, outside the European Union and the European Economic Area. Etaligo is aimed at sellers and customers located on both sides of the border, including in France: the GDPR therefore applies to this processing under Article 3(2).
A representative in the Union becomes mandatory as soon as the service is offered to persons located there. The exception provided for in Article 27(2) covers occasional processing; Etaligo's processing is continuous and constitutes the very object of the service, so that it does not apply.
You will be able to contact the representative directly with any question relating to the processing of your personal data and in order to exercise your rights (access, erasure, objection…). Supervisory authorities will also be able to address it. The representative will further keep our records of processing activities available to them and present them, on our behalf, upon request. Its contact details will be published here as soon as a representative is designated, which will happen when the service opens to persons located in the Union.
*The representative is not a data protection officer (DPO): we are not required to appoint one, and have not appointed one.*
⚠️ The adequacy decision from which Andorra benefits does not remove this obligation. Adequacy concerns the lawfulness of transfers of data to Andorra; Article 27 concerns the existence of a point of contact in the Union. These are two distinct questions, and confusing them is a common mistake.
We implement access controls, Firestore and Storage rules, server-side validation, App Check, encryption in transit and at rest provided by Firebase, logging and restriction of administrative access. No system, however, offers absolute security.
Any personal data breach is characterised, recorded in an internal register and, where the risk requires it, notified to the competent supervisory authority within 72 hours and also to the data subjects in the event of a high risk to their rights and freedoms.
Etaligo is reserved for adults (18 years of age or over), in accordance with the Terms of Use. The service is not directed at minors and does not knowingly collect their data. If a minor's account is reported to us, it is deleted and the associated data erased.
The policy may change along with the functions of the service or the regulation. The update date will be indicated at the top of the document and significant changes will be brought to the attention of users.