What we do with your data.

The controller of your data is the centre (the hall of residence or student accommodation) you wrote to. Bedel acts as processor on that centre's behalf, under a processing agreement signed in accordance with Article 28 GDPR. We do not decide what is done with your data: we process it following the centre's instructions.

The content of your WhatsApp conversation, your phone number and, if the centre has you in its directory, your name and room. It is used to look after you: answering your questions, logging a repair or a cancelled meal, alerting the right person on the team, and — when necessary — escalating a serious situation to the centre's management.

The lawful basis is performance of the contract between you and the centre (Art. 6(1)(b) GDPR) and the centre's legitimate interest in looking after and protecting its residents.

Your data is stored on servers in the European Union (Ireland) and the application's processing also runs in the EU (Dublin).

To understand and draft the replies we use an artificial intelligence model from a specialist provider, which runs in the United States. That transfer relies on the European Commission's Standard Contractual Clauses. That provider does NOT train its models on the messages we send it: it is written into its contract.

Messages travel over Meta's WhatsApp Business Platform, which transmits them between you and the centre; in using it we comply with the Meta Platform Terms. Meta processes that data under its own terms and its own privacy policy.

We do not sell your data. We do not pass it to third parties outside the provision of the service.

We do analyse conversations to improve the service, but only looking for patterns (what gets asked a lot, what fails), and after stripping names, phone numbers and room numbers from the text. Everything sensitive — a report, a health situation, a harassment case — is excluded from that analysis.

For as long as your relationship with the centre lasts and for the periods the law requires it to be kept. Confidential reporting channels have their own retention period, set by each centre (1 to 10 years), after which the system destroys them automatically.

You can ask to access your data, rectify it, object to its processing and, above all, erase it — the right to be forgotten. When the centre exercises that erasure, your record, your conversations, your messages and your phone number are genuinely deleted; the only thing kept, no longer identifying you, is the maintenance record the centre needs (a repair, for instance, stops carrying your name).

To exercise them, write to the centre, or to us at miguel@bedel.es, and we pass it on. If you believe they are not being respected, you can complain to the Agencia Española de Protección de Datos, the Spanish data protection authority (aepd.es).

You can ask for your data to be deleted whenever you want: write to us at miguel@bedel.es saying you want your data removed, or ask the centre. Once confirmed, we genuinely delete your record, your conversations, your messages and your phone number — including those received through Meta's WhatsApp Business Platform; the only thing kept, now without identifying you, is the maintenance record the centre needs by law. We answer your request within a maximum of 30 days.

If you ask directly whether you are being served by a machine, Bedel tells you honestly. At any moment you can ask to speak to a person on the team by writing HUMANO.