Privacy Policy

A Santiago Sin Mochila SL — Backpack transport on the Camino de Santiago

Last updated: August 20, 2026 This Privacy Policy describes how A Santiago Sin Mochila SL collects, uses, protects and shares the personal information of users who interact with its customer service through WhatsApp Business, in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and the policies of Meta Platforms, Inc.

1. Identity and contact details of the data controller

The data controller responsible for processing personal data is: Legal name: A SANTIAGO SIN MOCHILA S.L. Tax ID (NIF): B25984428 Registered and tax address: C/ Alcalde Soto González, nº 9, piso 4ºJ, 15005 A Coruña, Spain Managing Director: Alejandra Vilar Rodríguez Email: info.asantiagosinmochila@gmail.com Website: https://www.asantiagosinmochila.es Customer service WhatsApp: +34 623 75 19 79 A Santiago Sin Mochila SL is the holder of the WhatsApp Business account connected to this customer service channel.

2. Technology platform used

To operate its WhatsApp Business customer service channel, A Santiago Sin Mochila SL uses Conversia, its internal conversation management platform. Conversia is not an independent legal entity or a third party: it is the proprietary technology tool through which A Santiago Sin Mochila SL, as sole data controller (art. 4.7 GDPR), receives, stores and responds to customer messages. The third parties that are actually involved in the processing of data — and that act as data processors under art. 28 GDPR — are those listed in section 9 (Meta, the AI provider and the hosting provider).

3. Description of the service

Through Conversia, A Santiago Sin Mochila SL manages customer service via the WhatsApp Business Cloud API (Meta). The service includes: • Receiving incoming messages from customers via WhatsApp • Automated responses through artificial intelligence agents (chatbot) • Assistance from human agents when necessary • Management and storage of conversation history • Sending reply messages to the customer within the 24-hour window

4. Personal data we collect

We process personal data of users who start or maintain conversations with us via WhatsApp Business: • Identification: User's phone number with international prefix (Source: Meta / WhatsApp) • Identification: Contact name if available on the profile (Source: Meta / WhatsApp) • Content: Text of sent and received messages (Source: User / Meta) • Content: Media files shared, such as images, audio or documents (Source: User / Meta) • Metadata: Date, time and status of each message (Source: Meta / WhatsApp) • Traceability: Internal conversation and message identifier assigned by the platform (Source: Conversia) We do not collect sensitive data (health, religion, ideology, sexual orientation, trade union membership, etc.). If the user voluntarily includes sensitive information in their messages, it will be treated with the highest level of protection and will not be used for purposes other than addressing their inquiry.

5. Purpose of processing

• Customer service: managing, responding to and following up on inquiries, questions or incidents received via WhatsApp. • Booking management: coordinating the pick-up and delivery of luggage between accommodations. • Automated response: allowing AI agents to generate coherent and useful automated responses. • Referral to human agents: transferring the conversation to a human operator when the AI cannot resolve the query or the user requests it. • Service continuity: keeping the conversation history so that context is not lost between sessions. • Service quality: analyzing conversations to improve the accuracy of responses and customer satisfaction. • Legal compliance: retaining records when applicable regulations require it.

6. Legal basis for processing

• Explicit consent (art. 6.1.a GDPR): by starting a conversation via WhatsApp, the user consents to the processing of their data for the purposes described. Consent may be withdrawn at any time. • Performance of a contract (art. 6.1.b GDPR): when processing is necessary to manage the booking and provision of the luggage transport service requested by the user. • Legitimate interest (art. 6.1.f GDPR): the controller has a legitimate interest in managing customer service and responding to inquiries received through its official channels. • Compliance with legal obligations (art. 6.1.c GDPR): when the retention of certain data is required by applicable regulations.

7. Use of artificial intelligence (chatbot)

A Santiago Sin Mochila SL uses, through the Conversia platform, artificial intelligence agents to automatically respond to messages received via WhatsApp. The user should be aware of the following: • User messages are processed by AI systems to generate automated responses in real time. • The AI accesses the history of the current conversation to maintain context and continuity. • Responses generated by the AI are automatic and do not constitute professional advice. • The AI may make mistakes; the user can always request to be assisted by a human. • When the user requests human assistance, or the conversation requires escalation, a human agent takes control of the conversation. 7.1 AI providers AI processing is carried out through specialized external providers. User messages are sent to the AI provider to generate the response. The provider acts as a data processor under art. 28 GDPR, with contractual obligations of confidentiality and non-use of data for its own purposes (model training, advertising, etc.). Data sent to the AI provider is retained only for the time necessary to generate the response and is subsequently deleted in accordance with the provider's policy. Right not to be assisted by AI: the user may request at any time to be assisted exclusively by a human, by writing "talk to a person" or by contacting info.asantiagosinmochila@gmail.com.

8. Data retention

• Conversations and messages: retained while the relationship with the user exists and for the legal periods applicable to address any liabilities arising from the processing. • Contact details: for as long as the user maintains a relationship with the service. • System logs: the minimum time necessary for audit and security purposes. • Data required for legal compliance: the period required by applicable regulations. Once the applicable periods have elapsed, the data will be deleted or anonymized so that it can no longer identify the user.

9. Recipients and data transfers

Personal data is not transferred to third parties, except where legally required or strictly necessary for the provision of the service. The recipients/processors are: • Meta Platforms, Inc. (WhatsApp Cloud API): as data processor for the transmission and receipt of messages via WhatsApp Business. Policy: https://www.whatsapp.com/legal/privacy-policy • AI provider: receives the text of messages to generate automated responses, acting as data processor (art. 28 GDPR). It does not use the data for its own purposes. • Hosting provider: server where conversations are stored, under a data processing agreement in accordance with art. 28 GDPR. Data is not sold, rented or shared with third parties for commercial purposes. Data is not used for advertising or profiling.

10. International transfers

Conversation data is stored on servers managed by A Santiago Sin Mochila SL's hosting provider. The use of the following services may involve international data transfers: • Meta Platforms, Inc. (WhatsApp Cloud API): transfer under the appropriate safeguards established by the European Commission (Standard Contractual Clauses or adequacy decisions). • AI provider: the transfer is carried out under appropriate safeguards in accordance with Chapter V of the GDPR. More information: WhatsApp Privacy Policy (https://www.whatsapp.com/legal/privacy-policy) and Meta Privacy Policy (https://www.facebook.com/privacy/policy).

11. Security measures

• Encryption in transit: all communications use HTTPS/TLS. • Encryption at rest: credentials and secrets are stored encrypted in the database. • Access control: access restricted by roles (RBAC) with mandatory authentication. • Activity logging: auditing of access and actions on the data. • Environment segregation: separation between production and testing. • Encrypted backups: periodic backups with encryption. • Webhook validation: HMAC-SHA256 signature verification on all incoming notifications from Meta.

12. User rights

Access, rectification, erasure ("right to be forgotten"), restriction of processing, objection, portability, withdrawal of consent, and the right not to be subject to automated decisions (requesting human review of decisions made by AI). To exercise these rights: info.asantiagosinmochila@gmail.com, attaching a copy of an identification document. Complaints to the Spanish Data Protection Agency (AEPD): www.aepd.es

13. Minors

Customer service via WhatsApp is intended exclusively for persons over 16 years of age (the minimum age for consent under art. 7 of the LOPDGDD). We do not knowingly collect data from minors. If a user is found to be a minor, their data will be deleted and the conversation ended.

14. 24-hour window and Meta policies

• Businesses may reply with free-form messages within the 24 hours following the user's last message. • After 24 hours without a response from the user, messages may only be sent using templates approved by Meta. • No unsolicited promotional messages are sent outside the 24-hour window. • No notifications or alerts are sent to agents' personal phones via WhatsApp.

15. Changes to the privacy policy

The controller reserves the right to update this Privacy Policy whenever necessary to adapt it to legislative, jurisprudential, technical or service changes. Any change will be published on this same page with the corresponding update date.

16. Cookies

This privacy policy page does not use tracking or advertising cookies. The use of cookies on the management platform (for authenticated users) is described in the cookie policy accessible from the application dashboard.

This Privacy Policy has been drafted in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and the policies of Meta Platforms, Inc. for WhatsApp Business applications. © 2026 A Santiago Sin Mochila SL. All rights reserved.