Privacy Policy
This is a translation of the Spanish Política de Privacidad. If there is any discrepancy, the Spanish version prevails.
When you use our website and our platform, you entrust us with some of your data. We understand that this trust carries great responsibility, so we do our utmost to protect your information and to let you control it.
The purpose of this privacy policy is to tell you what information we collect, how we process it and what rights you have over your data.
Last updated: 13 November 2026.
Who we are
The controller of this website and of the Weikos platform is MAQUELAME, S.L., with tax ID (CIF) B10981074 and registered address at Paseo Capa Negra 4, 28522 Rivas-Vaciamadrid, Madrid (Spain). Hereinafter, “Weikos”.
For any data protection matter, you can write to us at privacy@weikos.io or through the contact form.
Weikos has not appointed a Data Protection Officer, as none of the circumstances in article 37 of the GDPR apply. Privacy requests are handled through the address above.
Our clients and our users
Our clients are mainly music institutions: orchestras, choirs, festivals and similar organisations. Because of the nature of the platform, end users may be managers of an institution, its employees, musicians hired on a temporary basis, or the institution’s clients and suppliers. These people may or may not have a contract directly with Weikos.
For example, an institution may use the platform to manage the data of its permanent staff, its temporary extra players or its suppliers.
Controllers and processors
Under Regulation (EU) 2016/679 (GDPR), Weikos acts as either controller or processor, depending on the case.
Weikos is the controller of:
- The institutional, tax and financial data of the institutions that contract our services.
- The personal and professional data of those who contract directly with Weikos.
- The data provided through the forms on our website (demo requests, enquiries, suggestions or subscriptions to communications).
- The data you give us when you write to help@weikos.io or any other Weikos email address.
Weikos is a processor of:
- The data of platform users managed by client institutions.
- The data of people who, without using the platform, are managed in it by client institutions.
- The data of the clients and suppliers of our client institutions.
In these cases, the client institution determines the purposes and means of the processing. Weikos processes that data only on its documented instructions, under the data processing agreement signed with each institution, as provided in article 28 of the GDPR.
What personal data we process
The data processed on the platform depends on how each institution uses it and on the information it decides to collect. The following list is indicative and covers the maximum set of data the platform can manage; it does not mean that every institution processes all of it.
Institution data
Company name, tax ID, address and contact details. In addition, management information: structure of departments and categories, staff, projects and performances, budgets and financial results, hiring, schedules and employment policies.
User data
Identification: first name and surnames, stage name, profile photo, identity document number and its support number, copy of the identity document (front and back), date of birth, nationality, gender and level of education.
Contact and location: email, telephone, full postal address and the geographical coordinates associated with that address.
Financial and banking: bank account number (IBAN), SWIFT/BIC code, account holder and bank, Social Security number, tax identification number and associated invoices or tax documents.
Employment and professional: contract details (type, speciality, term, pay and status), position and department, working-time records and clock-in records.
Absences and leave: dates, type of absence, reason and any supporting documents attached.
Special category data
Some of the data above may constitute data concerning health within the meaning of article 9 of the GDPR. Specifically, supporting documents for absences and the type or reason for leave may reveal information about a person’s state of health.
This data is processed exclusively in the context of the employment management that the employing institution carries out through the platform, and its processing is based on article 9.2.b) of the GDPR, which allows these categories to be processed when necessary to meet obligations in the field of employment and social security law.
Weikos does not request or require this data: the client institution, as controller, decides what information of this kind it records on the platform.
Weikos does not process biometric data, genetic data, or data revealing ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation.
The mobile apps allow unlocking with face recognition or fingerprint. This verification is carried out entirely by the device’s operating system, which only tells the app whether identification was successful. Weikos never receives, processes or stores the facial image or the fingerprint.
Purposes of processing
We process personal data for the following purposes:
- Providing the platform service to client institutions and their users: management of hiring, planning of services and projects, working-time records, absence management, financial administration and communication between the institution and its musicians.
- Managing the contractual relationship with our clients: invoicing, support and administration of the licence agreement.
- Handling requests for contact, demos, information, complaints or suggestions received through the website or by email, including support queries about using the platform. To prepare our reply to a demo or information request, we look at public information about the institution (its website, federations and press); about the person writing to us, only their role in the institution when it is public.
- Sending you Weikos news about the service. If you have a Weikos account, you receive it because you use the service; if not, only if you subscribe and confirm it from the email we send you. You can unsubscribe from any of those emails, and unsubscribing does not affect operational notifications.
- Letting you know when Weikos is ready for soloists, if you join the waitlist.
- Analysing the use of our website, measuring the effectiveness of our campaigns and showing you Weikos advertising on social media, only when you accept it in the cookie notice.
- Sending operational notifications related to the use of the platform: contract invitations, status changes, service notices or requests for documents.
- Complying with legal obligations, particularly in employment, tax and social security matters.
- Producing aggregated, anonymised statistics on the use of the platform, without it being possible to identify specific people.
Some replies to the emails you send us (support queries, requests for commercial information and administrative matters) are prepared by artificial intelligence assistants, which identify themselves as such when signing. A member of the Weikos team reviews these replies before they are sent. If you would rather be helped directly by a person, just say so in your reply.
Legal basis for processing
Each processing activity is based on one of the following legal bases under article 6.1 of the GDPR:
| Processing | Legal basis |
|---|---|
| Providing the service to client institutions | Performance of a contract (art. 6.1.b) |
| Processing user data on behalf of the institution | Performance of the contract between the institution and the person, or the institution’s legal obligation (art. 6.1.b and 6.1.c) |
| Handling requests received through the website | Consent or pre-contractual measures (art. 6.1.a and 6.1.b) |
| Managing the commercial relationship with interested institutions and clients | Pre-contractual measures and performance of a contract (art. 6.1.b) and legitimate interest in following up with those who have written to us (art. 6.1.f) |
| Handling support queries by email | Performance of the contract with the client institution or with the user (art. 6.1.b) and legitimate interest in replying to those who write to us (art. 6.1.f) |
| Operational platform notifications | Performance of a contract (art. 6.1.b) |
| Retention for tax, employment and social security obligations | Legal obligation (art. 6.1.c) |
| Aggregated, anonymised statistics | Legitimate interest in improving the service (art. 6.1.f) |
| Health data contained in absence documents | Obligations in the field of employment and social security (art. 9.2.b) |
| Sending Weikos news to subscribers | Consent (art. 6.1.a) |
| Sending Weikos news to users of the platform | Legitimate interest in informing them about the service they use, with the option to unsubscribe in every email (art. 6.1.f) |
| Notifying people who join the waitlist for soloists | Consent (art. 6.1.a) |
| Analysis of website use, campaign measurement and social media advertising | Consent (art. 6.1.a) |
Where Weikos acts as processor, the legal basis is determined by the client institution, which acts as controller.
Information security
We are implementing an information security management system in line with ISO/IEC 27001 and the Spanish National Security Framework (ENS), with the aim of certifying it in 2027.
Among other measures, we apply the following technical and organisational measures:
- Encryption in transit using TLS for all communications with the platform.
- Encryption at rest of the database and stored files, with AES-256 encryption managed by the infrastructure.
- Additional field-level encryption for the most sensitive information: identity document number, Social Security number, date of birth, postal address, bank accounts (IBAN and SWIFT/BIC) and tax identification. This data is stored encrypted independently of the database encryption.
- Granular access control: each user can access only the information that corresponds to them according to their role and their relationship with the institution.
- Automatic database backups, with point-in-time recovery, and versioning of stored files so that accidental deletions can be reversed.
- Vulnerability reviews of the third-party dependencies used in the platform.
- Selection of providers that offer sufficient guarantees for the protection of the data we entrust to them, formalised through the corresponding data processing agreements.
- We never ask by email for passwords, access codes or bank details. If you receive a message doing so on behalf of Weikos, do not reply and write to us at help@weikos.io.
We work to maintain 99.9% service availability, and the information entered into the platform can be viewed and exported at any time.
Who we share your data with
Weikos does not sell or transfer personal data to third parties for commercial or advertising purposes.
To provide the service, we use providers that act as processors or sub-processors, with whom we have the agreements required by article 28 of the GDPR. They are:
| Provider | Purpose | Data accessed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting of the database, files and application, and sending the emails from the weikos.io forms | All platform data, and what you enter in the website forms | Frankfurt (Germany) |
| SuprSend | Sending email and push notifications | Name, email address and the context data of the notification | United States |
| Google (Workspace) | Weikos email, including support | Name, email address and the content of the messages you send us, with their attachments | European Union, United States and other countries with Google data centres |
| Anthropic | Automatic reading of invoices to extract their data, and preparing replies to the emails you send us (support, commercial information and administrative matters) | For invoices: the content of those the institution decides to process (supplier, amounts and tax details). For emails: name, email address and the content of the messages you send us, with their attachments | United States |
| Google Cloud | Conversion to PDF of the contract documents generated by the institution | The content of the document: data of the contracted person and of the contract | European Union (Madrid) |
| Google (Firebase Cloud Messaging) and Apple (Push Notification service) | Delivery of push notifications to mobile devices | Device identifier and content of the notification | United States |
| Google Wallet and Apple Wallet | Time-recording card in the phone wallet, when the person adds it | Name, institution, position and card code | United States |
| Google (Maps and Places) | Address suggestions as you type | Partial address text and IP address | United States |
| Google Fonts | Loading the interface typeface | IP address | United States |
| Cloudflare | Publishing weikos.io and the help centre (help.weikos.io), anti-spam checks on the forms, and storing the requests you send us through the website | IP address of website visitors and, in the forms, the information you enter | Requests are stored in the European Union; the website is served from the Cloudflare network, headquartered in the United States |
| HubSpot | Recording and following up the commercial relationship with institutions interested in Weikos and with our clients | For people who write to us about Weikos: name, email, telephone if provided, institution, job title, type and size of the ensemble, and a summary of each conversation. If they write through a form on weikos.io, also the page through which they arrived, the page from which they sent it and the campaign that brought them, if any. HubSpot installs no cookies or scripts on weikos.io: the data is sent by our server | European Union (Germany) |
| Meta Platforms | Measuring campaigns and Weikos advertising on Facebook and Instagram, only if you accept it in the cookie notice | The advertising cookie identifier, the weikos.io pages you visit and your IP address. If you then send a form, also your email address, irreversibly encrypted, to know which campaign brought the request | Ireland and United States |
For invoice reading, Anthropic’s service is configured with zero data retention: documents sent for automatic reading are processed at that moment and are not kept once the result has been returned. For support, Anthropic processes messages as a processor to prepare the reply and does not use them to train its models.
We may also disclose data to public authorities, courts and law enforcement when there is a legal obligation to do so.
Where your data is stored
The platform information—database and files—is stored on Amazon Web Services servers in the Frankfurt region (Germany), within the European Union.
The emails you send us are kept in Weikos email, hosted on Google Workspace. The requests you send us through the website forms are stored by Cloudflare, in the European Union.
International transfers
Platform data is stored entirely in the European Union. However, some specific features involve sending data to providers established in the United States:
- Sending notifications (SuprSend): name, email address and the information needed to compose the message.
- Email (Google): the messages you send us and our replies, with their attachments.
- Automatic invoice reading (Anthropic): the document the institution decides to process, which may contain the supplier’s identification and tax details.
- Preparing replies to your emails (Anthropic): the content of the messages you send to Weikos addresses and the contact details they include.
- Address autocomplete (Google): the text typed in the address field and the IP address.
- Loading the interface typeface (Google): the IP address.
- Website and help centre (Cloudflare): the IP address of visitors to weikos.io or help.weikos.io. Requests sent through the forms are stored in the European Union.
- Commercial relationship (HubSpot): the data is stored in the European Union; any access by HubSpot, Inc. from the United States is covered by the EU-U.S. Data Privacy Framework.
- Social media advertising (Meta), only if you accept advertising cookies: the cookie identifier, the pages visited, the IP address and, if you send a form, your email address, irreversibly encrypted. Meta Platforms participates in the EU-U.S. Data Privacy Framework.
These transfers are based on the mechanisms provided for in Chapter V of the GDPR. Google LLC participates in the EU-U.S. Data Privacy Framework, recognised by the European Commission through its adequacy decision of 10 July 2023. With the other providers, transfers are based on the standard contractual clauses approved by the European Commission, included in the data processing agreements signed with each of them.
Apart from these cases, we do not transfer personal data to third countries.
How long we keep your data
Where Weikos acts as processor, the information remains on the platform for as long as the contract with the client institution lasts and the institution decides to keep it. When the contract ends, the data is returned or deleted as agreed with the institution.
Where Weikos acts as controller, we apply the following periods:
| Type of data | Retention period |
|---|---|
| Data from the contractual relationship with clients | For the term of the contract and, after it ends, for as long as any liabilities arising from it remain |
| Tax and accounting documents | 6 years from the last entry, under the Spanish Commercial Code |
| Employment and social security documents | 4 years, under the rules on infringements and penalties in the social order |
| Requests received through the website | 1 year from the last communication, unless the relationship continues |
| Commercial contact data (interested institutions) | 2 years from the last communication, unless the relationship continues or you ask us to delete it sooner |
| Support queries by email | 1 year from the last communication, unless the relationship continues |
| Subscription to commercial communications | Until consent is withdrawn |
| Weikos news for users of the platform | While you have a Weikos account or until you unsubscribe |
| Waitlist for soloists | Until we let you know it is available, or two years at most |
| Technical and security logs | 12 months |
After these periods, the data is securely deleted or anonymised, unless it must be kept to meet outstanding legal or contractual liabilities.
Your rights over your data
The GDPR grants you the following rights:
- Access: to know what data of yours we process and obtain a copy.
- Rectification: to correct inaccurate data or complete incomplete data.
- Erasure: to request that your data be deleted when it is no longer needed or when there is no basis for continuing to process it. This is not an absolute right and may give way to legal obligations.
- Restriction of processing: to request that the use of your data be suspended in certain cases, keeping it only for the exercise or defence of legal claims.
- Portability: to receive your data in a structured, commonly used format, or to request that it be transmitted to another controller.
- Objection: to object to certain processing, in particular processing based on legitimate interest.
- Withdrawal of consent: where processing is based on your consent, to withdraw it at any time, without affecting the lawfulness of prior processing.
- Automated decisions: not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Weikos does not make decisions of this kind.
You can exercise these rights by writing to help@weikos.io, stating the right you wish to exercise and attaching a document proving your identity. We will reply within one month at most, which may be extended by two further months when the request is particularly complex, in which case we will inform you of the extension. These requests are always handled by a member of the Weikos team.
The Weikos mobile apps also include an option to request account deletion directly from the app. When we receive the request, we confirm receipt and carry out the deletion within 30 days at most, after checking that there are no legal or contractual obligations requiring certain information to be kept, such as contracts in force or documents subject to tax or employment periods. In that case, we will tell you what data must be kept and for how long.
If your data is managed on the platform by a client institution, Weikos acts as processor. In that case, we will pass your request on to the relevant institution, which must handle it as controller, and we will let you know.
Exercising these rights is free of charge. Only in the case of manifestly unfounded or excessive requests, particularly repetitive ones, may Weikos charge a reasonable fee or refuse to act, in accordance with article 12.5 of the GDPR.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), the competent supervisory authority in Spain.
Changes to this policy
Weikos may modify this privacy policy to adapt it to regulatory changes or to the evolution of our services. The date of the last update appears at the beginning of the document. When changes are substantial, we will inform our clients and users through the platform or by email.