MYHIXEL HUB - Privacy Policy

In compliance with the applicable regulations on the protection of personal data, this Privacy Policy governs the processing of the personal data of users of the Myhixel Hub mobile application (hereinafter, the “App”), owned by NEW WELLNESS CONCEPT, S.L. (hereinafter, the “Controller”).

The purpose of this Privacy Policy is to provide clear, complete, and transparent information about the processing of users’ personal data, including what data is collected, for what purposes it is used, the legal basis for the processing, how long it is retained, with whom it may be shared, and what rights may be exercised.

Accessing, downloading, registering for, or using the App implies that the user has read and accepted this Privacy Policy. If the user does not agree with its contents, they must refrain from using the App.

1. IDENTITY OF THE DATA CONTROLLER

In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and the applicable national legislation, users are informed that the controller of the personal data is:

Company name: NEW WELLNESS CONCEPT, S.L.
Tax ID (NIF): B90344813
Registered office: Avenida republica argentina 25, planta 8. 41011. Sevilla 

Privacy contact email: dpd@myhixel.com
Data Protection Officer: Luis López Loma
Data Protection Officer email: dpd@myhixel.com

2. PURPOSE OF THE APP

Myhixel Hub is a mobile application associated with the use of devices marketed by the Controller, through which authorized users may register, access their account, and use features and services linked to those devices and to the Myhixel ecosystem.

3. PERSONAL DATA PROCESSED

The Controller will process the personal data necessary for the proper provision of the service offered through the App. In particular, the following categories of data may be processed:

3.1. Identification and registration data

  • email address, when the user chooses to register using email and password;

  • nickname or username, when the user chooses to register using nickname and password;

  • password or access credential, processed using appropriate security measures;

  • internal account or user identifiers.

3.2. Device and App technical data

The App may process technical device identifiers, such as the Android ID or the equivalent identifier available on Apple devices, when necessary for the technical operation of the App, access verification, account security, or incident resolution.

Likewise, other minimum technical data may be processed, such as:

  • device model;

  • operating system and version;

  • technical installation identifiers;

  • technical information required for service connectivity;

  • diagnostic, stability, and error data.

3.3. Usage data

The Controller may process information derived from the use of the App, its features, and interaction with compatible devices, for the purpose of properly providing the service, ensuring the operation of the App, maintaining security, improving performance, and managing technical incidents.

3.4. Data related to push notifications

If the user authorizes the receipt of push notifications, the identifiers or tokens necessary for sending them may be processed, as well as the information strictly necessary to send operational or informational communications related to the service.

3.5. Data related to Bluetooth

If the user authorizes the use of Bluetooth, the App may use this functionality to detect, link, pair, or communicate with compatible devices related to the services offered by Myhixel.

3.6. Support, security, and misuse prevention data

The Controller may process information related to technical incidents, errors, security events, technical logs, and any other data necessary to prevent unauthorized access, fraudulent use, or activities contrary to the proper functioning of the service.

4. PRINCIPLE OF DATA MINIMIZATION AND PSEUDONYMIZATION

The Controller applies technical and organizational measures aimed at minimizing the processing of personal data and, to the extent possible, avoiding the direct identification of the user through the App.

Whenever technically and functionally feasible, the information will be processed in aggregated, separated, or pseudonymized form. However, except in cases where re-identification is impossible by reasonable means, such information will not be considered fully anonymized, but rather pseudonymized.

5. PURPOSES OF THE PROCESSING

The user’s personal data will be processed for the following purposes:

a) to allow user registration and account creation;
b) to authenticate access to the App using email and password or nickname and password;
c) to manage the relationship with the user and provide the features and services available through the App;
d) to allow connection, detection, linking, or interaction with compatible devices via Bluetooth;
e) to send push notifications related to the operation of the service, the user’s account, or the user experience, when authorized by the user;
f) to ensure the security of the App and the service, prevent unauthorized access, and detect abnormal or fraudulent use;
g) to perform maintenance, debugging, improvement, updating, and optimization tasks for the App;
h) to respond to requests, inquiries, technical incidents, and support requests;
i) to comply with applicable legal obligations and respond to requests from public or judicial authorities.

6. LEGAL BASIS FOR THE PROCESSING

The processing of the user’s personal data is based on the following legal grounds:

  • the performance of a contractual or pre-contractual relationship, in order to allow user registration, account access, and the provision of services offered through the App;

  • the legitimate interests of the Controller, in particular to ensure service security, prevent fraud or improper access, maintain the proper technical functioning of the App, and improve the quality of the service;

  • the user’s consent, when required for the activation of device permissions, such as access to Bluetooth or receipt of push notifications;

  • compliance with legal obligations, when the processing is necessary to fulfill legal duties or requests from competent authorities.

7. DEVICE PERMISSIONS

The App may request certain device permissions only when necessary to enable specific features of the service.

7.1. Bluetooth

The App may request access to the device’s Bluetooth for the purpose of detecting, pairing, connecting, or communicating with compatible devices related to the service offered by Myhixel.

7.2. Push notifications

The App may request authorization to send push notifications for the purpose of communicating operational information, relevant service notices, or information related to the user’s account.

The user may revoke these permissions at any time through their device settings, although certain functionalities may be limited or unavailable as a result.

8. DATA RECIPIENTS

The user’s personal data may only be disclosed or made available to third parties when necessary for the proper provision of the service, compliance with legal obligations, or the protection of the Controller’s legitimate interests.

In particular, the data may be processed by the following categories of recipients:

8.1. Service providers

Third parties providing services to the Controller as data processors, where necessary for technical infrastructure, support, security, maintenance, error monitoring, or other auxiliary services essential for the functioning of the App.

8.2. Monitoring and diagnostic tools

The App uses Sentry as an error monitoring, technical diagnostics, and stability analysis tool. In this context, Sentry may process technical and error information strictly necessary for the detection, analysis, and correction of App malfunctions.

8.3. Public authorities

Data may be disclosed to administrative, judicial, tax, or law enforcement authorities when required by applicable law or when such disclosure is necessary for the formulation, exercise, or defense of legal claims.

8.4. Group companies

Where applicable, data may be disclosed to other companies within the corporate group to which the Controller belongs, exclusively for internal administrative purposes, provided there is an adequate legal basis and the applicable legal safeguards are respected.

9. INTERNATIONAL DATA TRANSFERS

According to the information currently available regarding the services used in the App, the personal data processed is not transferred outside the European Economic Area.

However, if in the future the Controller uses providers involving international data transfers, such transfers will be carried out in full compliance with the applicable regulations and subject to the adoption of appropriate safeguards required by data protection legislation.

10. DATA RETENTION PERIOD

Personal data will be retained for the time strictly necessary to fulfill the purposes for which it was collected and, in particular:

  • for as long as the relationship with the user is maintained;

  • for as long as the account remains active;

  • for the time necessary to provide the service and handle incidents;

  • and, once the relationship has ended, for the legally required periods or for as long as liabilities related to the processing may arise.

Once these periods have expired, the data will be deleted, anonymized, or, where appropriate, duly blocked in accordance with applicable regulations.

11. USER RIGHTS

The user may exercise, at any time and under the terms established in the applicable legislation, the following rights:

  • right of access;

  • right to rectification;

  • right to erasure;

  • right to object;

  • right to restriction of processing;

  • right to data portability;

  • right to withdraw consent, where processing is based on consent.

To exercise these rights, the user may send a written request, together with documentation proving their identity, to the following postal address:

NEW WELLNESS CONCEPT, S.L.
Plaza Escuela Sevillana, 18, Postal Code 41940, Tomares (Seville), Spain

or to the following email address:

dpd@myhixel.com

The Controller will respond to the request within a maximum period of one (1) month, which may be extended by a further two (2) months in the case of particularly complex or numerous requests, in accordance with the applicable regulations.

Likewise, the user has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if they consider that the processing of their personal data does not comply with the applicable law.

12. ACCOUNT AND DATA DELETION

The App allows users to initiate the deletion of their account from the Profile menu.

When the user requests deletion of their account, the Controller will proceed to delete the account and the associated personal data that does not need to be retained due to legal obligations or for the formulation, exercise, or defense of legal claims. Certain data may be duly blocked for the legally required periods.

Additionally, the user may request the deletion of their account and data by sending a communication to dpd@myhixel.com.

13. ACCURACY OF THE DATA

The user guarantees that the personal data provided through the App is truthful, accurate, complete, and up to date, and undertakes to communicate any changes thereto.

The user shall be liable for any direct or indirect damage or loss that may be caused to the Controller or third parties as a result of providing false, inaccurate, incomplete, or outdated data.

14. INFORMATION SECURITY

The Controller adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk and to prevent the loss, alteration, unauthorized processing, or unauthorized access to the user’s personal data.

However, the user should be aware that no technological system is completely invulnerable, and therefore the Controller cannot guarantee absolute security.

Likewise, the Controller shall not be liable for damages arising from the user’s failure to install updates, patches, or security improvements made available to them where such updates are necessary to maintain a reasonable level of security for the App or the device.

15. MINORS

The App is not intended for users for whom the applicable regulations require parental consent unless such consent has been lawfully obtained.

If the Controller becomes aware that personal data of a minor has been processed in breach of the applicable legal requirements, it will take reasonable measures to delete such data as soon as possible.

16. CHANGES TO THE PRIVACY POLICY

The Controller reserves the right to amend this Privacy Policy at any time in order to adapt it to legislative, case law, technical, operational, or business changes.

The version published at any given time through the official channels of the App shall be the version that applies. Where the changes introduced are relevant, the Controller may inform the user through additional means where legally required or reasonably appropriate.

17. ADDITIONAL INFORMATION

For additional information regarding the protection of personal data, the user may consult the website of the Spanish Data Protection Agency (AEPD).