Privacy policy

Information under Articles 13/14 GDPR and LOPDGDD (Organic Law 3/2018 – Spain). Supervisory authority: Agencia Española de Protección de Datos (AEPD).

1. Controller

Vet en Ruta S.L. · NIF: B93908325
Represented by Lennert Maurice Gerber, sole administrator
Contact and correspondence address: Carretera General del Norte, entrada 319–321, local 4B, Tacoronte, Tenerife, España
Email: contact@vetenruta.es
Phone: +34 611 791 672

1b. Data protection officer (DPO)

Because Vet en Ruta does not process special-category health data of natural persons under Article 9 GDPR at scale, there is currently no legal obligation to appoint a data protection officer under Article 37 GDPR or Article 34 LOPDGDD. Requests are handled directly by the controller at the address above.

2. What data we process

2.1 Home-visit requests

When you request a home visit through the booking form, we process:

• Name, email, phone number, address and postal code
• Information about your pet such as name, species, age, weight and concern
• Preferred appointment time and additional notes

Legal basis: Article 6(1)(b) GDPR (pre-contractual steps / contract performance).

2.2 Waiting list

For the waiting list we process email, postal code, and optionally name and pet type. Legal basis: Article 6(1)(a) GDPR (consent).

2.3 Applications

For job applications submitted through the careers form, we process name, email, phone number, location or region, and a CV upload. Legal basis: Article 6(1)(b) GDPR (pre-contractual measures).

2.4 Server logs and hosting

The website is hosted by Vercel (Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA); the backend runs on Supabase (Supabase Inc., 970 Toa Payoh North, Singapore, with EU data centres). Both providers process technical data such as IP address, timestamps, and user agent to deliver the service. Data Processing Addenda and EU Standard Contractual Clauses (SCC) are in place for any third-country transfers to the USA. Legal basis: Article 6(1)(f) GDPR (legitimate interest in stable delivery).

2.5 AI website assistant

If you voluntarily use the AI chat widget, we process your message, the selected language, a technical session ID, and a shortened conversation history so follow-up questions can be answered in the same browser context. Please do not enter sensitive personal data or detailed medical information there. The contents are sent to Google (Gemini API, USA) to generate the reply; if that service is overloaded, they are sent instead via OpenRouter (OpenRouter, Inc., USA) to an AI model provider available there. The providers may also use the contents to improve their own products and AI models, and provider staff may read them; to that extent the providers act under their own responsibility. Please therefore do not enter any personal data in the chat. We also store a hashed IP reference, the message content, the answer, and a status value (for example successful, fallback, or rate-limited) so we can support quality review, abuse protection, and support review. Legal basis: Article 6(1)(f) GDPR (legitimate interest in safe, helpful website support) together with your voluntary use of the widget.

2.6 Fonts

The fonts used (Nunito, Inter) are served exclusively from our own server. No connection is made to Google Fonts or any other third-party server; no IP addresses are transmitted to third parties.

2.7 Email, WhatsApp and map

If you email us, your messages are processed via Microsoft 365 (Microsoft Ireland Operations Limited). We send confirmations and internal notifications about your booking request through the email service Resend (Plus Five Five, Inc., USA). If you contact us via WhatsApp, WhatsApp Ireland Limited also processes your messages under its own privacy terms. The map on our homepage loads map data from OpenFreeMap (openfreemap.org), which technically requires your IP address to be sent to that server. Legal basis: Article 6(1)(b) GDPR (enquiry and contract) or Article 6(1)(f) GDPR (legitimate interest in communication and a working website).

2.8 Invoicing and backups

We use Holded (Holded Technologies, S.L., Spain) as a processor for invoicing and related bookkeeping. Necessary customer, invoice and payment details are processed, rather than complete clinical records. Encrypted backups are stored with Backblaze B2. Legal bases: Article 6(1)(b) and (c) GDPR for the contract and statutory accounting duties, and (f) for secure backups. Holded privacy information: https://www.holded.com/es/politica-de-privacidad.

3. Recipients of the data

Your data is processed only to provide the service. The following service providers are involved:

• Vercel Inc. (website hosting, USA – SCC)
• Supabase Inc. (database and file storage, EU region)
• Google (Gemini API) and, as a backup, OpenRouter, Inc. with the model provider used there, both USA, for the AI chat; these providers may also use contents for their own purposes (see 2.5)
• Microsoft Ireland Operations Limited (email mailbox, Microsoft 365)
• Plus Five Five, Inc. / Resend (sending booking emails, USA – EU-U.S. Data Privacy Framework and SCC)
• Holded Technologies, S.L. (invoicing and bookkeeping, Spain)
• Backblaze, Inc. (encrypted backups)

3b. Transfers for veterinary purposes

In the course of providing veterinary care, it may be necessary to transfer data to third parties: (a) referral clinics and specialist practices, (b) external laboratories (e.g. IDEXX, Laboklin) for sample analysis, (c) other veterinarians, for handing over medical history, (d) your pet insurer, for claim handling. These transfers happen only to the extent necessary for the specific treatment or handling, and are based on Article 6(1)(b) GDPR (contract performance), Article 6(1)(f) GDPR (legitimate interest in continuity of care), or your express consent (Article 6(1)(a) GDPR).

3c. Marketing communications

Marketing communications (newsletters, vaccination reminders, notices of new services) are only sent to people who have given explicit opt-in consent, in accordance with Article 21 LSSI-CE. Every email contains an unsubscribe link; you may withdraw your consent at any time with effect for the future, without affecting the lawfulness of prior processing.

4. Retention period

We retain personal data only for as long as needed for the relevant purpose, legal obligations or the establishment and defence of claims. The following periods and criteria apply:

• Veterinary treatment records: at least five years from the last entry in the patient record under Article 20 of the veterinary Code of Professional Conduct. Longer legal retention or specific evidence-preservation duties remain applicable.
• Business documents and invoices: six years from the last entry in the business books under Article 30 Código de Comercio. Tax periods and interruptions of those periods may require longer retention.
• Requests that do not lead to a visit or are cancelled: while needed to handle the enquiry, normally up to six months after closure; evidence needed for claims is retained separately with restricted access.
• Waiting list: until consent is withdrawn, at most 24 months from registration unless you consent again.
• Unsuccessful applications: normally up to 30 days after the recruitment process closes; longer retention for future vacancies requires separate consent.
• Technical logs: only as long as needed for operation, troubleshooting and security. Evidence of a specific security incident may be retained with restricted access until the incident and related claims are resolved.
• AI chat logs: normally 90 days. At the end of the relevant period, data is deleted or anonymised; data legally required is restricted until the obligation ends. Backups are for recovery only and expire through the backup cycle; deletions must be reapplied after restoration.

5. Your rights

You always have the right to:

• Access (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), restriction (Art. 18 GDPR) and data portability (Art. 20 GDPR)
• Object (Art. 21 GDPR) and withdraw consent (Art. 7(3) GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

Competent authority in Spain: Agencia Española de Protección de Datos (AEPD), www.aepd.es. Complaints can be filed online directly: sedeagpd.gob.es.

6. Cookies and local storage

We use only strictly necessary cookies and localStorage entries required for the website to function (e.g. language preference under the key vet-en-ruta-lang, cookie-consent status). Analytics or marketing cookies are not used at present; their future introduction would require explicit consent via an extended cookie banner (Art. 22 LSSI-CE).

7. Minors

Our offering is aimed at adults. Persons under 14 cannot give valid consent to the processing of their data under Art. 7 LOPDGDD; bookings are reserved to adults with legal capacity.

8. Security measures

We have implemented technical and organisational measures in accordance with Article 32 GDPR to protect your data against unauthorised access, loss, alteration, or disclosure. These include in particular: encrypted transmission via TLS, encryption at rest in our database (Supabase), access-restricted accounts following the principle of least privilege, regular backups, and periodic review and updating of safeguards.

9. Data-breach notification

In the event of a personal-data breach that poses a risk to your rights and freedoms, we will notify the Agencia Española de Protección de Datos (AEPD) under Article 33 GDPR within 72 hours of becoming aware, and – where the risk is high – we will also notify you without undue delay under Article 34 GDPR.

10. Automated decisions and profiling

We do not take automated individual decisions within the meaning of Article 22 GDPR and do not carry out profiling with legal effect on you.

11. Source of data

As a rule we collect data directly from you. In individual cases we may – only at your express request or with your consent – receive data about your pet from a previous veterinarian, a laboratory, or a referring clinic, in order to ensure continuity of treatment.

12. Contact for privacy requests

Please send all privacy requests to contact@vetenruta.es. We will respond within the statutory deadline of one month.

13. Changes to this privacy policy

We may update this privacy policy to reflect changes in our processing activities or the legal framework. The current version is always available on this page; the date of the most recent update is shown below. We will notify you of material changes by email or by a clearly visible notice on the website.

Last updated: 27 October 2026