Privacy policy

Last updated: August 2026

1. Data controller

• Owner: Carlos Joaquín Navarro Torren (Cereus.dev)
• Tax ID (NIF): 73205447N
• Privacy contact: aloha@ohanapp.es

2. Two distinct roles: website and platform

Under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 (LOPDGDD), Ohana acts in two different capacities that are worth understanding:

• As data controller, for the data you provide through this website or by email (for example, when requesting information or a demo).
• As data processor (art. 28 GDPR), for the data managed inside the Ohana platform. In this case the organisation (the club, PTA, association, foundation or school) is the controller of its members’ and families’ data, and Ohana processes it exclusively on their behalf, following their instructions and under a data processing agreement.

3. What data we process

Through this website

• Contact details you send us by email: name, email address and the content of your message.

In the app and the portal (on behalf of each organisation)

• Identification and contact: name and surname, date of birth, email, phone numbers, photo (optional) and identity document (national ID) where the organisation requires it.
• Family: household composition, who the responsible adult for each child is, and each member’s link to the organisation.
• Postal address of the family.
• Health data: the medical notes, allergies or medication you choose to include. This is special category data (art. 9 GDPR): providing it is voluntary, it is stored encrypted, and it is shared with the organisation only if you expressly enable that permission, which you can revoke at any time.
• Financial: fees, receipts and your chosen payment method. If you choose direct debit, the IBAN and account holder, stored encrypted. Card payments are processed directly by the Redsys banking gateway: Ohana never stores card numbers.
• Organisation-specific fields: each organisation may define additional fields (for example, shirt size or school year). Their content is decided by the organisation, which is contractually prohibited from entering special category data there.
• Activity: enrolments, attendance, enrolment remarks, activity chat messages and the organisation’s communications.
• Technical and security: device identifier and notification token, open sessions, IP address and audit logs of relevant actions, and the date, version and IP with which you accepted the terms of use.

Children’s data is always provided and managed by their parents or legal guardians within their family space. Children do not create their own account and do not access the app themselves.

4. Purposes and legal bases

• Handling your requests for information or a demo — legal basis: pre-contractual measures at the data subject’s request (art. 6.1.b GDPR) and consent (art. 6.1.a).
• Providing the Ohana service to organisations — legal basis: performance of the contract with the organisation (art. 6.1.b) and, for members’ and families’ data, the processing arrangement under art. 28 GDPR.
• Processing health data — legal basis: your explicit consent (art. 9.2.a GDPR), given when you enable the corresponding permission and withdrawable at any time from the app.
• Managing charges and direct debits — legal basis: performance of the contract between the family and its organisation, and compliance with accounting and tax obligations (arts. 6.1.b and 6.1.c).
• Complying with legal obligations (tax, accounting, security) — art. 6.1.c GDPR.
• Keeping the platform secure and evidencing correct use — legitimate interest (art. 6.1.f GDPR), limited to essential technical and audit logs.

5. Who we share your data with: no one

We do not sell, rent or transfer personal data to third parties. We do not use it for advertising, our own or anyone else’s; we do not share it with “commercial partners”; we do not build profiles or make automated decisions with legal effects.

Only the strictly necessary providers are involved so the service can work (sub-processors), always under contract, with the safeguards of art. 28 GDPR and without being able to use the data for their own purposes:

• Plenit — hosting of servers, database and files, in data centres in Madrid (Spain).
• IONOS — sending the service’s emails (verification, notices), in the European Union.
• Redsys — banking payment gateway for card payments, in Spain.
• Google (Firebase Cloud Messaging) — sending push notifications to devices.
• Google and Apple — sign-in verification, only if you choose to sign in with their accounts.
• healthchecks.io — technical alert confirming backups ran, with no personal data.

Beyond these cases, we will only disclose data where a legal obligation requires it (for example, to the competent authorities). If we change provider, we will update this list and inform organisations with reasonable notice.

6. International transfers

Servers, database, files and backups are hosted in Spain. The only transfers outside the European Economic Area may occur with Google (push notifications and sign-in) and Apple (sign-in), and are covered by the safeguards of Chapter V GDPR: the EU-US Data Privacy Framework and, secondarily, the Standard Contractual Clauses approved by the European Commission. Only the essentials travel to those services: the device identifier and the notice shown, or the sign-in verification.

7. Retention periods

Within the platform, periods are determined by each organisation as controller. As a general rule we apply the following:

• Enquiries received through this website: up to 1 year from the last contact.
• Family data: while the organisation keeps the service and the family its membership. If you request deletion of your account, it is scheduled with a 15-day period (reversible by signing in again) after which your personal data is irreversibly anonymised.
• Receipts and charges: kept for the organisation’s accounting and tax obligations, generally up to 6 years.
• Audit logs and IP addresses: for as long as needed for platform security and to evidence correct use of the service.
• Backups: kept encrypted for 30 days.

When the relationship with an organisation ends, its data is deleted or returned as instructed, keeping blocked only what is needed to address legal liabilities during the applicable limitation periods.

8. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, as well as withdraw any consent you have given, by writing to aloha@ohanapp.es with proof of identity. We will reply within one month, extendable by two further months for complex requests, in which case we will let you know.

Many of these rights you can exercise yourself, instantly, from the app: correcting your family’s data, revoking permissions for photo, ID, phone or health data, and deleting your account. If the data is processed within an organisation’s space, we will forward your request to the responsible organisation or provide its contact details, and cooperate with it to fulfil the request.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Security

We apply appropriate technical and organisational measures (art. 32 GDPR), including:

• Encryption of all communications via TLS.
• Encryption within the database itself (AES-256-GCM) of the most sensitive data: national ID, IBAN and account holder, health data and free-text fields such as enrolment remarks.
• Role- and permission-based access control, secure authentication and available two-step verification.
• Isolation of each organisation’s data and audit logging of relevant actions.
• Automatic removal of EXIF metadata from photographs, including geolocation.
• Daily encrypted backups and a recovery plan.

You can read more in our Data protection commitment (GDPR).

10. Changes to this policy

Any change to this policy will be published on this same page with the date of the update. If the change is substantial, we will announce it through the platform’s usual channels.

Courtesy translation. In the event of any discrepancy, the Spanish version prevails.