Privacy Policy
Effective date: 15 May 2024
This Privacy Policy describes how Fortis Financial Technologies S.L. ("Fortis", "we", "our", “us”) collects and processes personal data about you ("you" or "your"), how we use and protect that data, and your rights in relation to it when you use the website https://bduro.com / (or its successor) and any related service (the "Service(s)") related to the brand name and the Wallet application El Duro.
The Service is a rewarding loyalty program that allows you to earn rewards for purchases made between you and the affiliated stores listed in the Service ("Affiliated Stores"). We call this reward "Cashback". The amount of remuneration (generally speaking, but not always) depends on the amount of the purchase, and this percentage may vary. Fortis also offers you the option to withdraw the accumulated Cashback rewards to your bank account or any other type of account we provide or convert them into ‘Duro’. 'Duro' is the reward currency of bDuro. Duros are granted at the discretion of bDuro under a set of guidelines that are subject to change without notice.
This Privacy Policy applies to all personal data we collect or process about you. Personal data is any information about you, as well as a combination of information that can reasonably identify you or your household.
WHO CONTROLS MY DATA?
The data processing controller of any data you provide to us through your use of the Service is Fortis Financial Technologies, S.L., located at Gran Vía de les Corts Catalanes, 583, 5º F, Barcelona, with NIF B-67461152, registered in the Mercantile Registry of Barcelona. Wallet El Duro is part of Fortis Financial Technologies S.L., which includes the subsidiaries and affiliates of our parent company Fortis Financial Technologies S.L.
For information about Data and Privacy, please send an email to hola@bduro.com.
THE DATA WE COLLECT
We collect and store certain data as a result of your interactions with our Service:
• Your name;
• Your login ID and password;
• Your email address;
• The amount of accumulated cashback rewards that you can choose to convert into cash or Duros;
• The number of Duros you receive and that you can use on bDuro services or that you can convert into gift cards and vouchers from Partners, if offered in your market;
• Any offer from the Affiliated Stores that you have viewed or searched for;
• Information about your interaction, communication, and connectivity data;
• The Internet Protocol (IP) address used to connect your computer or mobile device to the Internet;
• Your computer or mobile device and connection information, such as the type and version of your browser, your operating system, and platform;
• The complete clickstream of Uniform Resource Locators (URLs) to, through, and from the corresponding Service (including the date and time);
• The campaign UTM parameters;
• Information about your activity on the Internet or other electronic networks, such as information about your online browsing behavior, preferences, and purchase history. Some of this information is collected automatically from you, for example, data collected via cookies and other device identification technologies ("Cookies and Tracking Technologies");
• For the redemption of cashback rewards: obfuscated IBAN to which cashback is transferred and the token from our corresponding payment provider for your account;
• A record of cash reward withdrawal transactions you have made, including the amount transferred, the time when the transfer was made, and a transfer identifier;
• User segmentation to personalize your experience (in newsletters and offers on the website);
• If you use the functionality of our toolbar, your member UUID (in a cookie);
• If you choose to participate in our Invite and Earn referral Programs as a referrer (you invite your friends), we collect the invitation code we generate for you, when it is generated, and for which campaign.
• If you decide to participate in our Invite and Earn referral Program as a referee (because a friend invited you to join bDuro), we will link the invitation code you use, when you use it, and for the campaign used to your account, only after you create an account with us.
You can find more information about our use of cookies and tracking technologies in our Cookie Policy.
We collect the following information from other sources:
When you register or sign up for our Services using third-party services, we collect personal data about you from third parties, at your request, to enable your registration and authentication in our Services. The categories of information we collect about you from these sources are:
Apple: email, first name, last name
Google: email, first name, last name, language preferences, profile picture
Facebook: email, first name, last name, profile picture
When you register or sign up for our Service using third-party services, this data will be shared with bDuro ID Services for account creation. We will not share any data without first obtaining your written consent. If that happens, subsequent use of your data by these third parties is governed by their own Terms and Conditions and Privacy Policy.
We may combine your data with data obtained legally from other sources and use it for the mentioned purposes. This is the case when we receive information about what you purchased in our Affiliated Stores, to allocate your Cashback.
It is your responsibility to update and maintain accurate contact information in your Fortis account. You can make changes by visiting your account page and entering the necessary corrections.
Please note that we may be legally obligated to collect certain personal data about you, or as a result of any contractual relationship we have with you. Failing to provide this information may prevent or delay compliance with these obligations. We will inform you at the time we collect your data about the mandatory nature of certain data and the consequences of failing to provide it.
HOW WE USE YOUR DATA
We collect and store this data as a result of your interactions with our Services for the following purposes:
· Identification and authentication: we use your identifiers to verify your identity when you access your bDuro ID account and to ensure the security of your personal data. The Fortis ID also allows you to use other services provided by other companies in the Fortis Group (as explained below);
· Service Provision: we process your personal data to provide you access to the Service, in particular to grant you and enable you to withdraw your cashback.
· Service Improvement: we analyze the information about how you use the Service to provide a better experience to all users and improve Fortis services, and for business development;
· Personalizing your experience and recommendations: when you use the Service, we may use your personal data to enhance your experience, for example, by providing interactive or personalized elements and providing recommendations based on your interests;
· Communicating with you: we may use your personal data to communicate with you, for example, if we provide information about changes to terms and conditions, if you contact us to ask questions, and to provide you with a summary of your cashback and points available by email;
· Marketing: we may use your personal data to create a profile about you and place you in specific marketing segments, to better understand your preferences and appropriately personalize the marketing messages we send you. We may also use your identifiers to send you marketing communications about the Service and other products or services that may interest you;
· Managing programs you may choose to invite a friend to participate in.
· Exercising our rights: we may use your personal data to exercise our legal rights when necessary, for example, to detect, prevent, and address claims of fraud, claims of intellectual property infringement, or violations of the law or our terms and conditions;
· Complying with our obligations: we may process your personal data to comply with legal or regulatory requirements when the law explicitly requires it, such as in response to court orders or to comply with financial or privacy regulations;
· Protection against harm: we may use personal data as necessary to protect the rights and safety, of you or others, and particularly to identify and combat fraudulent behaviors. In certain identified fraudulent cases, we reserve the right not to grant you cashback rewards.
We must have a legal basis to process your personal data. In most cases, the legal basis will be one of the following:
1. To fulfill our contractual obligations to you, for example, to provide the Services and to ensure that the refund is granted correctly. Failing to provide this information may prevent or delay the fulfillment of these contractual obligations;
2. To fulfill our legal obligations;
3. To satisfy our legitimate interests, for example, to understand how you use our products and services and to allow us to gain insight from it, which in turn allows us to develop new products and services. When we process personal data to satisfy our legitimate interests, we establish strong measures of security to ensure the protection of your privacy and ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.
4. We may obtain your consent to collect and use certain types of personal data when the law requires us to do so (for example, regarding our direct marketing activities). If we request your consent to process your personal data, you may withdraw it at any time by contacting us at the details found at the end of this Privacy Policy.
WITH WHOM WE SHARE YOUR DATA
We may share this data with the following third parties, including other companies in the Fortis Group and technical service providers and others:
Service providers and business partners. We may share your personal data with our service providers and business partners who perform marketing services and other business operations on our behalf. For example, we may partner with other companies for safe cash back, fulfillment orders, sending newsletters, email support, and messaging services. We ensure that all business/technical partners and relevant third parties are subject to binding contractual commitments to process the data we share with them in accordance with our instructions, this Privacy Policy, and applicable data protection legislation.
Advertising partners and affiliate networks. If you make a transaction at an Affiliated Store, some of your data may be shared with that Affiliated Store to reward you with reimbursements.
Law enforcement agencies, courts, regulators, and governmental authorities. If legally requested, we may also share data with law enforcement and/or third parties in connection with data requests for criminal investigations and suspected illegal activities.
Asset buyers. Your data may also be transferred to another company in the event of the sale of all or part of our business to a third party.
The Fortis Group (bDuro ID and Fortis Duros). The Fortis Group aims to provide you with a unique service experience through the "bDuro ID". bDuro ID is a unified program that allows you to easily connect to other Fortis services via a single sign-on function, share your account information, and join a loyalty program with the companies in the Fortis Group that jointly participate in the BDuro ID program. Your data will only be shared if you choose to connect to another bDuro ID identification service.
We share your account credentials and profile information with the BDuro ID services. This service is jointly provided by the BDuro ID Services at your direction, if you register with another BDuro ID Service.
Some of these Fortis Services, with which your data may be shared, are located in countries where the data protection level is not equivalent to that of Europe. However, the Fortis Group has adopted Binding Corporate Rules that ensure an adequate level of data protection between all Fortis Services. You can view this document here.
In any case, we remind you that if you opt to use another Fortis Service, your data will be processed in accordance with its own Privacy Policy.
Sharing additional data with the Fortis Group. We may share your data (transactional and browsing data and, with your consent, geolocation data potentially collected through cookies or similar technologies) with the other companies in the Fortis Group for the following purposes:
A. To perform statistical analysis (for example, to know how many users are using more than one Fortis service) and improve Fortis services and business development;
B. To personalize products, services, and offers, such as vouchers and campaigns presented to you in the services of the companies in the Fortis Group, based on the interactions you had with the other Fortis services;
C. To detect, prevent, and respond to claims of fraud, illegal activities, claims of intellectual property infringement, or violations of the law or our terms and conditions;
D. To provide you with marketing communications and notifications (by mail, text message, newsletter, and/or phone call) about offers from the companies in the Fortis Group;
E. To personalize the ads shown to you in the services of the companies in the Fortis Group and outside of them based on the interactions you've had in the Fortis services and outside of them;
F. For credit scoring based on your (payment) behavior in Fortis services and risk insurance scoring according to applicable laws;
G. To fulfill legal or regulatory requirements when explicitly required by law, such as in response to court orders, law enforcement requests; and
H. To address your requests, claims, complaints, and user rights.
In the European Union, we need to have a legal basis to process your personal data. For purposes A to D, Fortis relies on its legitimate interest to offer you the best experience in Fortis services. For purposes D to F, Fortis relies on your consent. For purpose G, we rely on compliance with legal obligations (for example, legal requests from law enforcement) and for purpose H, we rely on fulfilling our (pre) contractual obligations to you. You have certain rights regarding your personal data, subject to local legislation. See this section.
TRANSFERS OF YOUR DATA
Your personal data may be transferred to countries that may not have equivalent data protection to your country of residence, particularly to the countries where the companies of the Fortis Group are located. We ensure that your rights and freedoms regarding the processing of your personal data are appropriately and adequately protected, and to comply with all legal requirements.
YOUR RIGHTS REGARDING YOUR PERSONAL DATA
You have certain rights regarding your personal data. These include the following rights:
· access your personal data
· rectify the information we hold about you
· delete your personal data
· restrict the use of your personal data
· object to our use of your personal data
· receive your personal data in a usable electronic format and transmit it to a third party (right to data portability)
· file a complaint with the local Data Protection Authority.
We encourage you to contact us to update or correct your information if it changes or if the personal data we hold about you is inaccurate. To update your profile information by yourself, you just need to access your account and update your information directly from there.
To exercise your rights, please contact us through the red assistance icon located at the bottom right of the screen on any page (option "Delete account and privacy policy").
If you want to automatically delete your account, you can also do so directly in your account under "My account > Services and privacy > Delete my account for this service".
MARKETING PREFERENCES
We send you two types of emails: customer service emails necessary to maintain the Services, and promotional emails containing special offers, discounts, and promotions offered by Fortis and other companies in the Fortis Group, if you have chosen to receive such promotional communications.
While customer service emails are necessary for you to benefit from our Services, you may opt out of receiving promotional emails at any time by clicking the "unsubscribe" link in any promotional email you receive, or by modifying your subscription preferences in your account.
You may also receive promotional emails containing information and special offers from third parties if you have given your consent to receive such communications (only if we offer that possibility in the Services).
CONTACT US
Fortis Financial Technologies, S.L., located at Gran Vía de les Corts Catalanes, 583, 5º F, Barcelona, with NIF B-67461152, registered in the Mercantile Registry of Barcelona is the data controller of the personal data we collect and process.
If you have questions or concerns about how your personal data has been used, please contact us through the red assistance icon located at the bottom right of the screen on any page (option "Delete account and privacy").
If you wish to automatically delete your account, you can do so under "My account > Services and privacy > Delete my account for this service".
You can contact our data protection officer at: fortis-hola@bduro.com.
We are committed to working with you to obtain a fair resolution of any complaint or concern about your privacy. However, if you feel we have not been able to assist you with your complaint or concern, you have the right to lodge a complaint with the Data Protection Authority.
CHANGES TO OUR PRIVACY POLICY
Occasionally, we may modify this Privacy Policy to account for changes in our Services and how we handle your data. If this Privacy Policy is modified, we will notify you with reasonable notice. Changes will take effect from the moment they are notified to you.