Privacy policy
[Indicative legal content, pending professional review — does not constitute legal advice]
How we collect, use and protect your personal data, in compliance with the GDPR and the LOPDGDD.
Controller and data processing
The controller of your data is Costa Companion. When you upload appointment documents (medical appointments, government letters, contracts), we act as data processors: they are used solely to organise the service, can only be seen by the companion assigned to your booking and the platform team, and are stored encrypted and privately.
Retention and erasure
Booking documents are automatically deleted 12 months after the booking is completed or cancelled. You can also delete them at any time from the booking details page.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by emailing us. We will verify your identity before handling the request.
Security
Documents can only be downloaded through short-lived signed links (5 minutes), after verifying your session and permission. No document is accessible through public links.