Privacy policy

1) Data Controller

This Privacy Policy applies to the use of the Aigenrix website and associated services (the "Services"). It forms an integral part of our Terms of Use.

• ·Controller: MELFAVORES SLU
• ·Brand: Aigenrix
• ·Tax ID: B13696315
• ·Registered office: Calle Narcís Macià i Domènech, 21, Esc. A, 2º 1ª, 17310 Lloret de Mar, Girona, Spain
• ·Website: https://www.aigenrix.com/
• ·Email: team@aigenrix.com

2) Applicable regulatory framework

The processing of personal data by Aigenrix is governed, where applicable, by:

• ·Regulation (EU) 2016/679 (GDPR);
• ·Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD);
• ·Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE);
• ·other applicable Spanish and European data protection and electronic communications rules.

3) Data protection principles

We process personal data in accordance with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

We seek to collect only the information reasonably necessary for the relevant purpose.

4) Categories of data we process

Depending on how you use the Website and Services, we may process:

• ·Contact data: name, surname, email address, postal address and telephone number.
• ·Identity and profile data: username or identifier, language, role, preferences and other profile information you choose to provide.
• ·Company and business context: company name, website, country, industry, revenue range, employee range, business model information and other business or operational information you voluntarily provide.
• ·Billing and payment data: tax identifiers, billing address, payment and transaction metadata where relevant to a paid service. We do not store complete payment-card details where payment processing is handled by an external payment provider.
• ·Communications: messages, enquiries and information you send through forms, email, booking tools or other communication channels.
• ·Technical and usage data: IP address or security-related representations derived from it, online identifiers, logs, browser and device information, operating system, pages viewed and website events.
• ·Marketing and cookie preferences: consent records and choices concerning communications, analytics and optional cookies.
• ·Service-specific assessment data: answers and information you voluntarily submit when using assessment, diagnostic, screening or similar Aigenrix tools.

5) Purposes and legal bases

We process personal data only where we have an applicable legal basis.

Depending on the circumstances, these include:

• ·Responding to enquiries and requested business interactions: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR), where applicable, and/or our legitimate interests in responding to business enquiries and operating our business (Art. 6(1)(f) GDPR).
• ·Providing requested services and performing contracts: performance of a contract or taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
• ·Billing, accounting and tax compliance: compliance with legal obligations (Art. 6(1)(c) GDPR).
• ·Security, fraud and abuse prevention: our legitimate interests in protecting our systems, users and Services (Art. 6(1)(f) GDPR), and legal obligations where applicable.
• ·Marketing and commercial communications: your consent (Art. 6(1)(a) GDPR), or another basis expressly permitted by applicable electronic communications law.
• ·Consent-based analytics and optional website functionality: your consent (Art. 6(1)(a) GDPR) where consent is required.
• ·Service improvement and internal business administration: our legitimate interests (Art. 6(1)(f) GDPR), provided those interests are not overridden by your rights and freedoms.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Where processing is based on legitimate interests, you may object to the processing in the circumstances provided by the GDPR and may request information about the relevant balancing assessment.

6) Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy and for any additional period required by applicable law.

As general guidance:

• ·Contractual, accounting and billing records: retained for the periods required by applicable commercial and tax law, which may include periods of up to six years for certain commercial records.
• ·General enquiries, support and communications: normally retained for up to three years after the last relevant interaction unless a shorter or longer period is justified.
• ·Marketing records: retained until consent is withdrawn or you object, subject to reasonable suppression records where necessary to respect your choice.
• ·Security logs and security-related records: retained for short, proportionate periods unless a longer period is necessary to investigate or document an incident.

7) Recipients and service providers

We do not sell personal data.

We may disclose personal data to:

• ·service providers acting on our behalf under appropriate data-processing arrangements and documented instructions;
• ·professional advisers where necessary and subject to appropriate confidentiality obligations;
• ·public authorities, courts or other competent bodies where disclosure is required by law or necessary to establish, exercise or defend legal claims.

We use selected technology providers to operate the Website and Services. Depending on the service you use, these may include:

Service providers may change as our infrastructure evolves. We assess relevant providers and contractual arrangements according to the nature of the processing and applicable legal requirements.

8) International transfers

Some of our service providers may process or store personal data outside the European Economic Area, including in the United States.

Where personal data is transferred outside the EEA, we use a transfer mechanism permitted under Chapter V GDPR. Depending on the provider and destination, this may include:

• ·an applicable European Commission adequacy decision;
• ·the EU-U.S. Data Privacy Framework where the relevant U.S. recipient is validly certified and the framework applies;
• ·European Commission Standard Contractual Clauses; and
• ·supplementary technical, contractual or organisational measures where required.

Where UK personal data is involved, applicable UK transfer mechanisms may also be used.

Measures may include encryption in transit and at rest, access controls, data minimisation and other risk-appropriate safeguards.

You may contact us at team@aigenrix.com for information about the transfer safeguards applicable to relevant processing.

9) AI / LLM processing safeguards

Where an Aigenrix service expressly uses an artificial intelligence or large language model provider, we apply safeguards appropriate to the relevant processing.

These may include:

• ·limiting inputs to information necessary for the relevant function;
• ·minimising or masking direct personal identifiers where reasonably possible;
• ·selecting provider configurations that restrict provider use of submitted data for model training where available and appropriate;
• ·excluding credentials and other unnecessary sensitive information;
• ·applying access controls and audit measures;
• ·assessing relevant provider retention and data-processing terms.

We do not intentionally submit special-category personal data to AI providers unless a specific service requires it and an appropriate legal basis and safeguards have been established.

The current version of the Profit Leakage Exposure Scan does not send your Scan answers to an AI or large-language-model provider.

10) Security

We apply technical and organisational measures appropriate to the nature and risk of the processing, including, as applicable, TLS encryption, access controls, logging and monitoring, backups, security hardening, data minimisation and least-privilege principles.

No information system can be guaranteed to be completely secure. Where a personal-data breach occurs, we will assess and handle it in accordance with applicable GDPR requirements, including notification to the competent supervisory authority and affected individuals where required under Arts. 33 and 34 GDPR.

Private report links, including links generated by the Profit Leakage Exposure Scan, should be kept confidential. Anyone who obtains a valid report link may be able to access that report. You may contact us to request deletion of your Scan and report.

11) Minors

Our Services are intended for business and professional users and are not directed to persons under 18.

If we become aware that personal data of a minor has been submitted without an appropriate legal basis, we will take reasonable steps to delete it.

Parents or legal guardians may contact team@aigenrix.com regarding such information.

12) Data subject rights

Subject to the conditions established by applicable law, you may exercise your rights of:

• ·access;
• ·rectification;
• ·erasure;
• ·restriction of processing;
• ·objection;
• ·data portability; and
• ·not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

To exercise your rights, contact:

Email: team@aigenrix.com

or write to:

MELFAVORES SLU
Calle Narcís Macià i Domènech, 21, Esc. A, 2º 1ª
17310 Lloret de Mar, Girona
Spain

We may request information reasonably necessary to verify your identity. If you act through a representative, we may request evidence of their authority to act on your behalf.

We normally respond within one month of receiving a valid request. This period may be extended by up to two additional months where permitted by Art. 12(3) GDPR, taking into account the complexity and number of requests.

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) or another competent supervisory authority.

13) Commercial communications

We send electronic commercial communications only where permitted by applicable law.

Where consent is required, communications are sent only after the relevant consent has been provided.

Where applicable law permits communications in the context of an existing customer relationship concerning similar products or services, we may rely on that permitted basis subject to the applicable requirements.

Every marketing communication will provide a simple means to unsubscribe or object.

You can also withdraw marketing consent or object to eligible marketing communications by contacting team@aigenrix.com.

Requesting or receiving a Profit Leakage Exposure Scan report does not, by itself, subscribe you to marketing communications.

14) Cookies and similar technologies

We use cookies and similar technologies for technical purposes and, where required, only after your consent for analytics or optional functionality.

Detailed information about cookie categories, providers, purposes, retention periods and how to provide or withdraw consent is available in our Cookies Policy and through the Preference Centre accessible from the Website.

With respect to the Profit Leakage Exposure Scan, Scan answers, email addresses and private report links are not intentionally sent to analytics providers as analytics event data.

15) Automated decisions and profiling

Aigenrix does not currently make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR.

The internal commercial prioritisation associated with the Profit Leakage Exposure Scan is used to help our team organise business enquiries. It does not determine the Scan result, does not produce legal or similarly significant effects, and is subject to human review.

If we introduce automated decision-making falling within Art. 22 GDPR in the future, we will provide the information and safeguards required by applicable law.

16) Policy updates

We may update this Privacy Policy to reflect changes in our Services, technology, service providers, processing activities or applicable law.

The current version will be published on this page with the date of the latest update. Where appropriate, we will provide additional notice of material changes.

Questions about this Privacy Policy can be sent to team@aigenrix.com or by post to:

MELFAVORES SLU
Calle Narcís Macià i Domènech, 21, Esc. A, 2º 1ª
17310 Lloret de Mar, Girona, Spain.