Privacy policy
Last updated: [LAST UPDATED DATE]
1. Who we are
The controller of the personal data collected through this website and our contact channels is:
- Controller
- JST Commerce LLC
- Legal form
- Limited liability company formed in the State of Texas (USA), filing number [TEXAS FILING NUMBER]
- Address
- San Antonio, Texas, USA
- Contact
- info@jst-commerce.com
- EU representative
- [EU REPRESENTATIVE, IF APPLICABLE]
We offer services to businesses located, among other places, in Spain. For that reason we apply Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spain’s Organic Law 3/2018 (LOPDGDD) when we process data of people who are in the European Union.
2. Who this policy applies to
- Visitors to this website.
- People who contact us by WhatsApp, by email or through the contact form.
- Our clients and their contact persons.
If you have talked to the WhatsApp bot of a business that is our client, that business is the controller of your data. Section 4 explains this.
3. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your enquiries and preparing proposals | Name, email, phone number, business and the content of your message | Your consent and steps taken at your request before entering into a contract (Art. 6(1)(a) and 6(1)(b) GDPR) |
| Providing the contracted services, invoicing and support | Contact details, billing details and service-related communications | Performance of a contract (Art. 6(1)(b) GDPR) |
| Meeting accounting, tax and legal obligations | Billing details and details of the contractual relationship | Legal obligation (Art. 6(1)(c) GDPR) |
| Keeping the website secure and running | Technical data such as IP address, browser type and server logs | Legitimate interest in the security of the site (Art. 6(1)(f) GDPR) |
We do not make automated decisions with legal effects on individuals, and we do not build profiles for advertising. We do not sell personal data.
4. Data we process on behalf of our clients
When we set up and run a WhatsApp bot or an automation for a business, we process the data of the people who message that business (for example, phone number, name, message content, and order or booking details) on that business’s instructions.
In that case the business is the data controller and JST Commerce LLC acts as a data processor, under a data processing agreement that complies with Article 28 GDPR. To exercise your rights over that data, please contact the business you spoke to. If you write to us instead, we will pass your request on to them.
5. WhatsApp and Meta
WhatsApp conversations are provided through the WhatsApp Business platform, operated by Meta Platforms. Meta processes message data under its own terms and privacy policies. We use the data received through WhatsApp only to handle the conversation and provide the service; we do not use it for advertising and we do not share it with third parties for that purpose.
6. Who we share data with
We only share data with providers that deliver services to us and process the data on our instructions:
- Vercel Inc.: hosting of this website.
- Formspree Inc.: delivery of contact form messages.
- Meta Platforms: WhatsApp Business platform.
- [AUTOMATION HOSTING PROVIDER]: hosting of the automation workflows (n8n).
- [EMAIL PROVIDER]: email.
We may also disclose data to authorities and courts where we are legally required to do so.
7. International transfers
JST Commerce LLC is established in the United States, and so are some of our providers. Where this involves transferring data outside the European Economic Area, the transfer relies on [INTERNATIONAL TRANSFER MECHANISM], such as the standard contractual clauses approved by the European Commission or the provider’s participation in the EU-U.S. Data Privacy Framework. You can ask us for more information about these safeguards.
8. How long we keep data
- Enquiries and contacts: [ENQUIRY RETENTION PERIOD] from the last communication.
- Client data: for the duration of the contractual relationship and, afterwards, [CLIENT DATA RETENTION PERIOD] to meet legal obligations and handle possible claims.
- Conversations handled for clients: for the period each client specifies and, by default, [CONVERSATION RETENTION PERIOD].
9. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent at any time, by writing to info@jst-commerce.com. We may ask for additional information to confirm your identity. We will reply within one month.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority in your country.
10. Cookies
This website does not use analytics or advertising cookies, and it does not load third-party fonts or scripts. If we add any such tools in the future, we will update this policy and ask for your consent where required.
11. Security
We apply reasonable technical and organisational measures to protect data: restricted access, encrypted connections and providers that offer appropriate safeguards. No system is completely secure; if a breach affects your data, we will act in accordance with the applicable law.
12. Children
Our services are aimed at businesses and professionals. We do not knowingly collect data from minors.
13. Changes to this policy
We may update this policy to reflect changes in our services or in the law. The current version will always be published at this address, with its update date.