Privacy Policy

Privacy Policy

In accordance with the current data protection legislation, Regulation (EU) 2016/679 of the European Parliament and of the Council, dated April 27, 2016, concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data (hereinafter, GDPR), as well as Organic Law 3/2018, of December 5, on Data Protection and Guarantee of Digital Rights (hereinafter, LOPD-GDD), the user is informed in accordance with Articles 13 of the GDPR and 11 of the LOPD-GDD:

I. DATA CONTROLLER

Who is responsible for processing your data?

• Company Name: Initive
• CIF: 07247519N
• Email: info@initive.ai
• Website: www.initive.ai

II. PURPOSE

For what purpose will we process your personal data?
Initive processes your information for:

• Maintaining the business relationship and providing the contracted service.
• Preparing a customized quotation tailored to your needs.
• Managing communications via email with interested parties.
• Conducting recruitment processes for the company.
• Managing employees and human resources of the company.
• Sending commercial information related to our sector: Advertising.
• Managing training activities.

How long will we retain your data?
The personal data you provide will be retained as long as the business relationship remains in effect. However, for maximum transparency, we inform you of the general retention periods we apply:

• General identification data (email, name, surname, phone number, etc.): Retained as long as the business relationship lasts or until consent is revoked. In any case, they will be deleted when they are no longer necessary for the purpose for which they were collected.
• Law on Infractions and Sanctions in the Social Order (obligations related to affiliation, registration, deregistration, contributions, salary payments, etc.); General Tax Law (accounting books, etc.): 4 years.
• Personal actions without a special deadline (Article 1964 of the Civil Code): 5 years.
• Accounting, tax, and labor records (Article 30 of the Commercial Code – accounting books, invoices, etc.): 6 years.
• Labor-related documents: Contracts, work records, payroll receipts, social security contributions, identification documents – 4 years; in the case of occupational risk prevention reports, illness or accident records, contracts with prevention services – 5 years.
• Data subject to Anti-Money Laundering and Terrorism Financing Prevention Law (Article 25): 10 years.
• Recruitment processes: 2 years from the submission of the CV.
• Commercial information: Even after the relationship between the parties ends, the controller will retain your information to send newsletters related to our products and services. You may exercise your rights under applicable regulations by contacting us through your preferred method.
• Aggregated and anonymized data: Indefinitely.

Despite these general retention periods, we periodically review our systems to delete data that are not legally necessary.

III. LEGAL BASIS

What is the legal basis for processing your data?
Depending on the purpose for which the data is collected, its processing is necessary for:

• Managing the business relationship that you have entered into and contracted with us.
  • Execution of a contract (authorized under Article 6.1.b GDPR).
  • Consent of the data subject (authorized under Article 6.1.a GDPR).
• Providing a customized quotation tailored to your needs.
  • Execution of a contract and/or pre-contractual relationship (authorized under Article 6.1.b GDPR).
• Managing communications via email with interested parties.
  • Consent of the data subject (authorized under Article 6.1.a GDPR).
  • Legitimate interest (authorized under Article 6.1.f GDPR).
• Conducting the company’s recruitment processes.
  • Consent of the data subject (authorized under Article 6.1.a GDPR).
• Managing employees and internal human resources.
  • Contract execution (authorized under Article 6.1.b GDPR).
• Sending commercial communications.
  • Consent of the data subject (authorized under Article 6.1 GDPR).
  • Consent of the data subject (authorized under Article 20 LSSICE).
  • Legitimate interest (authorized under Article 6.1.f GDPR and Article 21.2 LSSICE).
• Managing training activities.
  • Execution of a contract (authorized under Article 6.1.b GDPR).
  • Consent of the data subject (authorized under Article 6.1.a GDPR).

All collected data is necessary for service provision. However, data marked with an asterisk (*) are mandatory. If mandatory data is not provided, the controller cannot provide the contracted service.

Additionally, only individuals over 14 years old may provide personal data on this website. According to the LOPD-GDD, parental or guardian consent is required for processing the data of minors under 14 years old.

Similarly, only individuals over 18 years old may contract our services. For minors under 18 years old, parental or guardian consent is required unless the minor is legally emancipated.

IV. DATA SUBJECT RIGHTS

What rights do I have regarding data protection?
In accordance with Articles 13 GDPR and 11.2.c) LOPDGDD, you may exercise the following rights by contacting info@initive.ai. Under applicable regulations, you have the following rights as defined in Articles 15 to 22 GDPR and 12 to 18 LOPDGDD:

• Right to request access to personal data.
• Right to request rectification or deletion.
• Right to request restriction of processing.
• Right to object to processing.
• Right to data portability.

You may request the necessary forms to exercise your rights from the controller via email. Additionally, you may file a complaint with the Spanish Data Protection Agency (AEPD). More information in Section VII.

V. RECIPIENTS

Who will receive your data?
Your personal data will only be shared or transferred internationally in compliance with applicable laws (Articles 13.1.e and 44 GDPR, and Articles 11.1 and 40 LOPDGDD 3/2018). The controller works with third parties whose servers are located in the EU, EEA, or Switzerland, ensuring adequate and confidential data processing.

Outside of these cases and unless legally required, your data will not be shared with third parties except when strictly necessary for service provision. Generally, data may be shared with:

• Technology service providers.
• Payment service providers.
• Courier and delivery companies.
• Third parties acting as service providers on our behalf (accountants, advisors, freelancers).
• Third-party data processors or collaborators closely related to the controller for service provision.

Data transfers will be conducted under strict confidentiality, using necessary safeguards such as confidentiality agreements. Users may object to these transfers via written request.

VI. DATA ORIGIN

Where do we obtain your data?
Personal data processed by Initive originates from the data subject or collaborating companies. More information can be obtained by contacting info@initive.ai.

Categories of personal data processed:

• Identification data (name, surname, passport number, addresses, emails, date of birth, place of birth, phone numbers).
• Commercial information (own and third-party).
• Economic data (bank account number, credit card number).
• CV data (academic background, qualifications, hobbies, affiliations).
• Video surveillance data (image).

Sensitive data processing will comply with Articles 9 GDPR and 9 LOPDGDD, informing the data subject accordingly.

VII. ADDITIONAL INFORMATION

• Security Measures: Users of the controller’s website are informed that technical and organizational security measures have been implemented to prevent data loss, misuse, alteration, unauthorized access, and theft, thereby ensuring the confidentiality, integrity, and quality of the information contained therein, in accordance with current data protection regulations. The personal data collected in the forms are processed exclusively by the controller’s staff or designated Data Processors. Additionally, the website features SSL encryption, allowing Users to securely transmit their personal data through contact or registration forms on the website.
• Social Media: The data controller has profiles on some of the major social media platforms (Facebook, Instagram, LinkedIn) and is recognized in all cases as the Data Controller for the personal data of its followers, fans, subscribers, commenters, and other User profiles (hereinafter, “followers”) that are published by the controller.
  The purpose of data processing by the controller, where permitted by law, is to inform followers about activities and offers via any available method provided by the social media platform, as well as to offer personalized customer service. The legal basis for this processing is the User’s consent, which can be revoked at any time.
  Under no circumstances will the controller extract data from social media unless the User has provided explicit and specific consent (e.g., for participation in a contest).
• Confidentiality: The information provided by the User will always be considered confidential and may not be used for purposes other than those described herein. The controller undertakes not to disclose or reveal information about the User’s requests, the purpose of the requested advice, or the duration of the relationship with the User.
• Accuracy of Data: The User declares that all data provided are true and accurate and agrees to keep them updated. The User is responsible for the accuracy of their data and will be solely liable for any disputes or claims that may arise due to the falsification of such information. It is essential that the User informs the controller of any modifications to their personal data to ensure it remains up to date.

Documentation prepared by LegalDPO, based on the information provided by the Data Controller. The content complies with regulations in effect as of February 2023, and may be subject to changes due to legislative modifications or jurisprudential criteria. It is the responsibility of the data owner to verify the current validity of the regulations at any given time.

VIII. SUPERVISORY AUTHORITY

We are committed to complying with data protection regulations, as they represent our most valuable asset. However, if you believe that your rights have been violated, you may file a complaint with the Spanish Data Protection Agency (AEPD) at C/ Jorge Juan, 6, 28001 – Madrid. More information about  AEPD. http://www.agpd.es/. Documentation prepared by LegalDPO. https://legaldpo.es/