IDO — Privacy policy

I. Privacy and data protection policy

IDO Marketing on off line SLU undertakes to adopt the technical and organisational measures necessary, according to the level of security appropriate to the risk of the personal data collected through this website.

II. Laws incorporated into this policy

This policy complies with the following rules in force in Spain:

Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data (GDPR).
Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).
Royal Decree 1720/2007, of 21 December, approving the Regulation implementing the LOPD (RDLOPD).
Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).

III. Identity of the data controller

Controller: IDO Marketing on off line SLU
Tax ID (NIF): B64776958
Commercial Registry of Barcelona: Volume 40499, Folio 12, Sheet 365035
Representative: José Luis Checa
Email: gdpr@idomkt.com

IV. Record of personal data

The personal data collected through forms and any other mechanism of the site will be processed by IDO Marketing on off line SLU in order to facilitate and fulfil the commitments established between the site and the user, to maintain the commercial relationship and to handle the requests received. A record of processing activities is kept in accordance with Article 30 of the GDPR.

V. Principles applicable to processing

The processing of personal data is subject to the following principles:

Lawfulness, fairness and transparency: prior consent will be required and the user will be informed transparently about the purposes of the processing.
Purpose limitation: data will be collected for specified, explicit and legitimate purposes.
Data minimisation: only the strictly necessary data will be collected.
Accuracy: data must be accurate and always kept up to date.
Storage limitation: data will be kept only for the time necessary.
Integrity and confidentiality: data will be processed in a way that guarantees its security and confidentiality.
Accountability: the controller will demonstrate compliance with the above principles.

VI. Categories of personal data

On this site only identifying data is processed. Special categories of personal data under Article 9 of the GDPR are never processed.

VII. Legal basis for processing

The legal basis for processing is the express and verifiable consent that the user grants when using forms, accepting the cookie banner or interacting with the conversational assistant. Such consent may be withdrawn at any time with the same ease with which it was given; its withdrawal will not, as a general rule, condition the use of the site.

In those forms where certain information is mandatory to complete, this will be indicated to the user at the time of collection.

VIII. Purposes of processing

Personal data is collected and processed for the following purposes:

To facilitate and fulfil the commitments established between the site and the user.
To handle requests, enquiries and demands for commercial information.
To personalise the commercial and operational interaction.
To carry out statistical activities and marketing studies in order to tailor the content offered.
To improve the quality, functioning and navigation of the site.
To maintain the continuity and traceability of the conversations that the user initiates with the site's AI assistant.

IX. Retention periods

As a general rule, personal data will be kept for a maximum of 18 months from its collection or from the last significant interaction with the user, unless a prior request for deletion is made by the data subject or a longer period is legally required. Conversations held with the site's AI assistant are stored associated with the session for the same period.

X. Recipients and data processors

IDO Marketing on off line SLU does not transfer personal data to third parties, except where legally required. To provide the service, the following data processors are used, with whom the corresponding contracts under Article 28 of the GDPR are in place:

Anthropic PBC, OpenAI Inc. and Google LLC — providers of language models (LLM) that process the messages exchanged with the conversational assistant. The data is transmitted encrypted and is governed by their respective standard contractual clauses approved by the European Commission.
Own infrastructure hosted with providers whose data centres are located in the European Union (server in Frankfurt, Germany), where the PostgreSQL/Supabase database and the self-hosted Umami analytics services reside.

No international transfers outside the European Economic Area are carried out that are not covered by the safeguards provided for in Chapter V of the GDPR.

XI. Personal data of minors

Only persons over 14 years of age may validly give consent for the processing of their personal data. For minors under that age, the consent of their parents, guardians or legal representatives will be required.

XII. Secrecy and security of data

IDO Marketing on off line SLU adopts the technical and organisational measures necessary to protect personal data. The site has a TLS certificate that ensures the encrypted transmission of data between the user's browser and our servers. The databases are encrypted at rest and critical secrets are rotated periodically, with automated nightly audits.

IDO Marketing on off line SLU undertakes to report without undue delay any security breach that entails a high risk to the rights and freedoms of users, within the maximum period of 72 hours established by the GDPR. All staff and external collaborators are subject to a duty of confidentiality.

XIII. Rights of the user

The user may exercise the following rights before IDO Marketing on off line SLU:

Access: to obtain confirmation of whether their data is being processed and, where applicable, to access it.
Rectification: to modify inaccurate or incomplete data.
Erasure (right to be forgotten): to obtain the deletion of their data when it is no longer necessary, consent is withdrawn, they object to the processing, it has been processed unlawfully or it must be erased for a legal obligation.
Restriction of processing: to restrict the processing in the cases set out in Article 18 of the GDPR.
Portability: to receive the data in a structured format and to transmit it to another controller.
Objection: to prevent or stop the processing of the data.
Not to be subject to automated decisions: not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects on the user.

XIV. Exercise of rights

The exercise of any of the above rights shall be carried out by written communication addressed to the data controller, with the reference "RGPD", indicating:

Name, surname and a copy of the DNI (or other valid identity document).
The specific request and the reasons justifying it.
A postal or electronic address for the purposes of notifications.
Date and signature.
Supporting documents where applicable.

Contact channels for the exercise of rights:

Email: gdpr@idomkt.com

XV. Links to third-party websites

The site may include hyperlinks to third-party web pages with their own privacy policies. IDO Marketing on off line SLU does not operate those sites and disclaims any responsibility for the content and the processing carried out on them.

XVI. Complaints to the supervisory authority

The user has the right to lodge a complaint with the competent supervisory authority, in particular in the State of their habitual residence, place of work or place of the alleged infringement. In Spain, the competent authority is the Spanish Data Protection Agency (aepd.es).

XVII. Acceptance and changes to this policy

It is necessary that the user has read and agrees with the conditions on the protection of personal data contained in this policy. Use of the site implies acceptance of this Privacy Policy.

IDO Marketing on off line SLU reserves the right to modify this policy at its own discretion or as a result of legislative or case-law changes. Changes will not be explicitly notified to users; periodic review is recommended.

Privacy policy.