Prisma for Business Privacy Policy

Last update: July 9, 2026

This Privacy Policy explains how data is processed in Prisma for Business (Prisma Empresas), a version or service line oriented to companies, teams, staffing agencies, organizations, worker platforms, delivery rider applications, employees, collaborators, freelancers, or professional groups. Prisma for Business allows organizations to offer financial control tools, income and expense tracking, budgets, advances, reports, financial habits, financial education, analysis, or financial wellbeing to users linked to a company or entity.

1. Scope of Application

This policy applies to Prisma for Business and any associated B2B service, including:

Administration panels and corporate accounts.
Users invited by a company.
Web dashboards and aggregated reports.
Financial wellbeing programs.
Analysis features, alerts, financial education, or economic organization.
Technical integrations with companies or platforms.

Prisma's general Privacy Policy may also apply when a user uses the application on an individual or personal basis.

2. Privacy Roles

Depending on the case, Prisma may act as:

2.1 Data Controller

Prisma will be the data controller when it decides the purposes and means of processing, for example: management of Prisma's own accounts, service security, technical support, commercial management, billing, product improvement, own communications, and legal compliance.

2.2 Data Processor

Prisma may act as a data processor when it processes personal data following instructions from a client company, for example: users created or invited by a company, data associated with a corporate program, information managed within a business space, or reports or configurations defined by the contracting organization.

In those cases, the client company will be the data controller and Prisma will process the data in accordance with the contract, data processing agreement, or documented instructions.

3. Data Processed by Prisma for Business

Prisma for Business may process the following categories of data, depending on the configuration of the contracted service:

3.1 Identifying and Contact Data

First and last name.
Email address.
User ID.
Company, team, center, department, or group.
Role within the platform and invitation, activation, or access status.

3.2 Professional or Company Relationship Data

Depending on the contracted service, data may be processed such as: user type (employee, collaborator, freelancer, rider, temporary worker, etc.), associated company or entity, group, team, or segment, configuration assigned by the company, and participation status in internal programs.

Prisma must not be used to make automated employment decisions without an adequate legal basis, clear information to the user, and sufficient guarantees.

3.3 Financial Data Entered by the User

The user may enter information such as: expenses, income, budgets, goals, debts, net worth, subscriptions, categories, alerts, and receipts, invoices, or documents.

Unless expressly indicated in the contracted service, the company will not access the detailed personal financial data of the user. In financial wellbeing models, the company should receive only aggregated, anonymized, or statistical information when possible.

3.4 Aggregated or Statistical Data

B2B_PRIV_S3_4_LIST1
B2B_PRIV_S3_4_LIST2

These reports must avoid revealing individual personal financial information unless a legitimate purpose, valid legal basis, clear information, and specific contractual configuration exist.

3.5 Technical Data

Data may be processed such as: device, operating system, application version, IP address, date and time of access, technical events, errors, security logs, session identifiers, and performance information.

4. Purposes of Processing

Prisma for Business may process data for the following purposes:

Creating and administering corporate accounts and inviting/managing users.
Providing the contracted service and allowing access to the dashboard or business panel.
Displaying personal financial information to the user themselves.
Generating aggregated reports for the company.
Managing technical support.
Maintaining security and preventing abuse.
Measuring service usage and performance and detecting errors.
Managing billing and the commercial relationship.
Complying with legal obligations.
Improving functionalities and developing new features (preferably with aggregated/anonymized data).

5. Legal Basis

The legal basis will depend on the context and Prisma's role.

When Prisma acts as controller, processing may be based on: performance of contract, user consent, legitimate interest, and compliance with legal obligations.

When Prisma acts as processor, the primary legal basis will be determined by the client company as data controller.

6. Company Access to User Data

In Prisma for Business, the contracting organization may access certain data necessary to administer the service, such as: invited users, activation status, service usage, aggregated information, participation metrics, and data expressly configured as visible to the company.

As a general principle, Prisma for Business must avoid showing the company detailed personal financial data of the user unless: the contracted service clearly requires it, the user has been informed, a valid legal basis exists, it has been contractually configured, and the principles of minimization and proportionality are respected.

7. Confidentiality and Separation of Data

Prisma will apply reasonable measures to separate personal data, company data, and aggregated data.

Internal access will be limited to personnel or providers who need to process the information to provide, maintain, or protect the service.

8. Providers

Prisma for Business may use technical providers for cloud infrastructure, authentication, database, hosting, technical analytics, monitoring, security, payments and billing, and support.

These providers may include Google Firebase, Google Cloud, Stripe, or equivalent services. When necessary, Prisma will formalize data processing agreements with providers acting as processors.

9. International Transfers

Some providers may process data outside the European Economic Area. In that case, appropriate safeguards will be applied in accordance with current regulations, such as standard contractual clauses or other legally recognized mechanisms.

10. Retention

Data will be retained as long as a contractual relationship, active account, or operational need exists.

Subsequently, they may be retained for the periods necessary to comply with legal obligations, address claims, prevent fraud, maintain security, manage billing, and accredit contractual compliance.

Aggregated or anonymized data may be retained for analysis, product improvement, or statistics, provided they do not allow the identification of specific users.

11. Users' Rights

Users can exercise their rights of access, rectification, erasure, objection, restriction, portability, and withdrawal of consent where appropriate.

If processing depends on a client company, Prisma may forward the request to that company or act following its instructions.

To exercise rights you can contact at: ivanpenyalver00@gmail.com. You can also address the company or organization that invited you to use Prisma for Business.

12. Security

Prisma for Business will apply reasonable technical and organizational measures to protect data against unauthorized access, loss, alteration, or disclosure.

These measures may include access controls, authentication, technical logs, logical separation, encryption where appropriate, permission reviews, and secure development best practices.

13. Use of Artificial Intelligence

Prisma for Business may incorporate artificial intelligence features to generate analysis, alerts, reports, data classification, or recommendations.

AI results are advisory and may contain errors. They should not be used as the sole basis for relevant decisions regarding people, employment, working conditions, performance evaluation, creditworthiness, credit, or individual economic situation.

Any business use of AI that could significantly affect users must be previously evaluated by the responsible company and comply with applicable regulations.

14. Contractual and Technical Prohibition on Employment Decisions

Using Prisma for Business, its metrics, outcomes, or any inference to make or support hiring, dismissal, promotion, pay, evaluation, discipline, opportunity allocation, or any other employment decision is prohibited. This prohibition forms part of the service terms, the DPA, and the notice every administrator must accept.

As a technical safeguard, the administration dashboard exposes no personal financial records, amounts, text, UID, or employee email. Usage and outcome metrics are generated in aggregate and suppressed when a cohort contains fewer than 20 people.

15. Changes to This Policy

We may update this Prisma for Business Privacy Policy to reflect legal, technical, contractual, or functional changes.

When changes are relevant, they will be communicated to client companies or affected users through the corresponding channels.

16. Contact

For inquiries regarding privacy in Prisma for Business, you can contact at: ivanpenyalver00@gmail.com