Version 2.0 — Effective 8 September 2026
Supersedes Version 1.0 of 5 August 2025.
Versión en español · Download PDF
This Policy explains how OASLY AQUA, S.L. ("Oasly", "we") collects, uses, shares and protects your personal data, under Regulation (EU) 2016/679 ("GDPR") and Organic Law 3/2018 ("LOPDGDD").
Controller: OASLY AQUA, S.L. · CIF B22655765
Carrer del Degà Bahí 28, 08026 Barcelona, Spain
Privacy contact: privacy@oasly.com · +34 689 44 85 08
We have not appointed a Data Protection Officer, as we are not required to. Privacy enquiries go to the address above.
We collect data when you:
WhatsApp. When you message our WhatsApp business number we receive your phone number, your WhatsApp profile name, the content of your messages and any photos or videos you send. WhatsApp is operated by Meta, which acts as our processor for message content and separately as its own controller for the operation of the WhatsApp service under its own terms.
We do not seek special-category data. Please do not send us health information or identity documents unless we specifically ask for them.
| Purpose | Legal basis |
|---|---|
| Answering your enquiry and preparing a possible contract, including checking whether we serve your area | Steps taken at your request before entering a contract — Art. 6(1)(b) |
| Providing the service: order, installation, maintenance, filter changes, billing | Performance of a contract — Art. 6(1)(b) |
| Operating our WhatsApp channel, including automated first responses (see §5) | Art. 6(1)(b), and our legitimate interest in responding promptly — Art. 6(1)(f) |
| Keeping the Installation Record and installation photographs as evidence of the condition of your property and the work performed | Our legitimate interest in establishing, exercising or defending legal claims — Art. 6(1)(f) |
| Improving our automated assistant using anonymised past conversations (see §5) | Our legitimate interest in improving the service — Art. 6(1)(f) |
| Sending commercial messages about products similar to those you have bought | Our legitimate interest, and Art. 21.2 of Law 34/2002 — you may opt out at any time |
| Sending commercial messages where you have asked us to | Your consent — Art. 6(1)(a) |
| Fraud prevention and debt recovery | Legitimate interest — Art. 6(1)(f) |
| Accounting, tax and guarantee obligations | Legal obligation — Art. 6(1)(c) |
Where we rely on legitimate interest, we have assessed that interest against your rights and you may object at any time (see §9).
First responses on our WhatsApp channel may be written by an automated assistant that uses artificial intelligence. The assistant tells you it is an AI assistant at the start of the conversation. You can ask to speak to a person at any time. Outside our working hours the assistant may reply to you directly; during working hours a member of our team reviews conversations.
To produce a reply, the content of your conversation is sent to our AI providers (see §6). Those providers do not use your data to train their models.
Improving the assistant. We also keep past customer conversations, with names, phone numbers, e-mail addresses and addresses removed, to help the assistant answer future questions accurately. Installation photographs are never used for this purpose. If you would prefer your conversations not to be used in this way, tell us at privacy@oasly.com and we will exclude them.
No automated decisions with legal effect. The assistant answers questions and helps arrange installations. It does not make decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 GDPR. Pricing and service availability follow fixed published rules, not an individual assessment of you.
We use the following categories of service provider, each under a written data processing agreement:
| Provider | Role | Location of processing |
|---|---|---|
| Meta (WhatsApp Business) | Messaging channel | EU and United States |
| Supabase | Customer database and file storage | European Union (Stockholm); support access from outside the EEA |
| n8n | Workflow automation | European Union (Germany, Sweden) |
| OpenRouter, Anthropic | AI assistant used to draft replies | United States |
| OpenAI | Text indexing used to retrieve relevant past answers | United States |
| Shopify | Online shop, orders and payments | European Union at rest; group processing in Canada and the United States |
| Appstle | Subscription management within Shopify | United States and Canada |
| Airtable | Customer relationship management | United States |
| Calendar used for installation appointments | Depends on our configuration; see below | |
| Payment providers, couriers, our accountants | Payments, delivery, statutory obligations | European Union |
We also disclose data to public authorities where required by law.
A note on where your data is. Our customer database and our workflow automation are hosted in the European Union. Some of the providers above process data outside the European Economic Area. In those cases the transfer is covered by an adequacy decision of the European Commission, by Standard Contractual Clauses, or by the EU–US Data Privacy Framework, and we hold a data processing agreement with each provider. We do not claim that all processing takes place inside the EU, because that would not be accurate.
| Data | Retention |
|---|---|
| Enquiries that do not become orders | 12 months from the last contact |
| Customer conversation history | 24 months after the contract ends |
| Installation photographs and the Installation Record | 5 years from installation, being the period during which a claim relating to the work may be brought |
| Contract, invoices and payment records | 6 years, per Article 30 of the Commercial Code and tax legislation |
| Commercial-messaging preferences and opt-outs | Until withdrawn, and the opt-out record indefinitely so that we continue to respect it |
| Anonymised conversations used to improve the assistant | Retained while the assistant is in use; no longer personal data once anonymised |
| Browsing data | As set out in the Cookie Policy |
At the end of these periods we delete the data or anonymise it irreversibly.
Data is encrypted in transit. Our database is access-controlled and hosted in the European Union. Installation photographs are stored in a private, non-public bucket and are accessible only to staff who need them. Customer conversations are handled only through our business systems and business WhatsApp number, never on personal accounts. We keep backups and restrict administrative access.
You have the right to access your data, to rectify it, to request erasure, to restrict or object to processing, and to data portability. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.
To exercise a right, write to privacy@oasly.com, or simply send us a message on the WhatsApp number you normally use to contact us.
Identification. If you contact us from the phone number or e-mail address already associated with your record, that is normally enough for us to identify you. We will ask for further information only where we have reasonable doubt about who you are, and we will not ask for a copy of your identity document unless it is genuinely necessary.
We respond within one month. If you are not satisfied, you may complain to the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.
If you are a customer, we may send you messages about products and services similar to those you have bought, as permitted by Article 21.2 of Law 34/2002. Every such message includes a simple way to opt out, and you may also reply STOP or BAJA on WhatsApp, or write to privacy@oasly.com, at any time and at no cost. We will not send you other commercial messages unless you have asked us to.
We use our own and third-party cookies for technical, analytical and advertising purposes. See our Cookie Policy for details and to set your preferences.
We may update this Policy. The version and effective date appear at the top. Where a change is material we will notify active customers by e-mail or WhatsApp before it takes effect.
OASLY AQUA, S.L. · Carrer del Degà Bahí 28, 08026 Barcelona, Spain
privacy@oasly.com
— END OF PRIVACY POLICY —