Privacy Policy

Habitual by Nōmae processes data to operate its website, provide services to businesses, administer professional accounts, maintain security and, where appropriate, send authorised communications.

When a business uses Habitual to manage its loyalty programme, CRM, campaigns, Wallet or customer feedback, that business is normally the data controller and Habitual acts as a processor following its instructions.

Habitual does not sell personal data. Non-essential analytics or advertising technologies are activated only where the corresponding consent exists.

This policy applies to habitual.gonomae.com, the Habitual application currently available at app.habitual.gonomae.com, and associated digital services.

Habitual acts as controller for its own purposes, such as managing enquiries and demos, contracting and billing, professional accounts, security, support, authorised communications and legal compliance.

Habitual acts as processor when a customer business uses the platform to process data relating to its own customers within loyalty, CRM, campaign, segment, visit, reward or feedback workflows.

Habitual may process limited data as an independent controller where necessary for security, fraud prevention, billing, legal compliance or the defence of claims.

• Enquiries and demos: identity, contact, company, role and enquiry content to respond and prepare proposals.
• Professional accounts: identity, company, role, permissions, account activity, support, subscription and billing data to provide and secure the service.
• End customers of businesses: identifiers, email, optional birthday, visits, points, stamps, rewards, Wallet, campaigns, feedback, consents and recurrence inferences to operate the business's loyalty and CRM programme.
• Habitual marketing: email and relationship data for authorised news, invitations and similar services.
• Technical data: IP, session, device, browser, usage events, access logs, errors and security signals.

Habitual does not store full bank-card data where payment is processed by a payment provider.

Habitual may use artificial intelligence to draft content, summarise information, detect opportunities, interpret feedback and assist professional users.

AI provides support and interpretation. Campaigns and production configurations remain subject to applicable permissions and confirmations, and Habitual does not intend to make solely automated decisions producing legal or similarly significant effects without the required safeguards.

Data may come directly from the individual, the business contracting Habitual, authorised users, use of the website, application, Wallet, emails or campaign links, lawful public professional sources for B2B prospecting, and providers needed for payments, authentication, email, Wallet or infrastructure.

Habitual does not sell personal data.

Data may be disclosed to authorities where legally required, advisers subject to confidentiality, and technology providers needed to provide the service. Depending on enabled features, provider categories may include cloud infrastructure, authentication, email, payments, operations, Wallet, analytics, advertising and artificial intelligence.

Where data is transferred outside the European Economic Area, Habitual will use a valid GDPR mechanism such as an adequacy decision, Standard Contractual Clauses and, where appropriate, supplementary measures.

• Unconverted enquiries: up to 12 months after the last interaction.
• Professional prospecting: up to 24 months after the last relevant interaction, unless the person objects.
• Accounts and contractual relationship: for the duration of the relationship and applicable subsequent liability periods.
• Commercial and tax documentation: for applicable statutory periods.
• Marketing: until consent is withdrawn, an objection is made or the relationship ceases to be relevant.
• Security logs: normally up to 12 months unless an incident or claim requires longer retention.
• Data processed for a business: for the period instructed by that business and under the applicable processing agreement.

Individuals may exercise rights of access, rectification, erasure, objection, restriction, portability, withdrawal of consent and, where applicable, the right not to be subject to solely automated decisions.

Requests may be sent to legal@gonomae.com with only the information reasonably necessary to verify identity.

A complaint may also be submitted to the Spanish Data Protection Agency (AEPD).

Operational communications required to provide the service are separate from marketing. Marketing opt-out is free and straightforward.

Necessary technologies may be used for authentication, security, preferences and operation. Analytics technologies, currently Google Analytics 4, remain blocked until Analytics consent is obtained.

See the Cookie Policy for details.

Habitual applies technical and organisational measures proportionate to risk, including access controls, separation between businesses, encryption in transit, audit logs and protection of integrations and infrastructure.

Habitual is primarily aimed at businesses and professionals and is not designed for children under 14 to provide consent directly without the legally required authorisation of a parent or guardian.

This Policy may be updated due to legal, technical, operational or service changes. Where a change is relevant, reasonable notice will be provided.

Privacy, rights, provider or transfer enquiries: legal@gonomae.com.