Dashboard payment connections: privacy notice
This notice explains the bank and payment reconciliation features of the private dashboard at app.sarmientofamily.com. It covers the Pull Payments screen, associated family payment records, and access to those features.
Operator and contact
Daniel Sarmiento, operating the Castalla Speaks dashboard in Castalla, Alicante, Spain, is the contact responsible for this processing. Contact info@castallaspeaks.es for privacy questions or requests. This notice concerns this dashboard feature; the bank and payment providers publish their own notices.
Information processed and why
After the account holder authorizes a bank connection, the dashboard can receive connected account identifiers and account information, consent details, and transaction information through Enable Banking. It stores connection credentials and session information encrypted, an account identifier hash and masked account label, and imported incoming credits. Credits may include dates, amounts, currencies, bank references, sender names, descriptions, and status, depending on what the bank supplies.
SumUp payment information may include transaction identifiers, dates, amounts, currencies, status, and refund information. Authorized managers can associate a payment with a family and retain a receipt and an audit record of that assignment. Sign-in identity, security sessions, and technical access information are also processed to restrict access and operate the service.
The purposes are to identify incoming payments, reconcile family accounts, prepare receipts, correct errors, and protect the dashboard. Bank access requires the account holder’s explicit authorization. Family payment administration is connected with providing and administering the academy’s services; accounting records may also be needed to meet legal obligations. Security and error investigation support the operator’s legitimate interest in protecting accounts and maintaining accurate records.
Access, providers, and storage
Payment reconciliation is restricted to authorized academy managers. The bank authorization takes place through the provider and bank; the dashboard does not ask for or store a BBVA online banking password.
Enable Banking and BBVA provide the authorized bank connection. SumUp provides its payment records. The dashboard is hosted through ChatGPT Sites using Cloudflare infrastructure, with ChatGPT sign-in and additional dashboard authentication. Relevant service providers process the data needed for their roles. Hosting and support infrastructure may process data outside Spain or the European Economic Area under the applicable provider arrangements. Contact the operator for information about applicable processing locations and transfer safeguards.
Payment data is used for internal administration, rather than advertising or sale. Public policy pages do not expose payment records. The bank connection cannot initiate an outgoing bank transfer from this dashboard feature.
Retention, disconnection, and choices
There is currently no automatic deletion schedule for imported payment records. They remain in the dashboard until an administrator removes them, subject to any accounting or other retention obligations. The operator can review retention and deletion requests at the contact address above.
The account holder can disconnect the bank connection in the dashboard and manage or withdraw provider consent through Enable Banking’s consent management or the bank. Disconnection stops further access through that connection; it does not erase credits, family ledger entries, or receipts already imported. Choosing not to connect a bank prevents automated bank imports but does not prevent recording a payment manually.
Your rights and questions
Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent for future bank access. The dashboard does not automatically assign a credit to a family or make a legally significant decision about a person: an authorized manager reviews and confirms the assignment. Contact the operator to exercise your rights. You may also contact the Spanish Data Protection Agency (AEPD).
Additional provider information: Enable Banking’s data-sharing privacy notice.