Privacy Policy - empentIA

1. Data Controller

The controller of the personal data collected through this website is:

Company name: empentIA Tech SL
Tax ID (CIF): B88914098
Address: c/ Cortina 16, 08720 Vilafranca del Penedès (Barcelona), Spain
Contact: hola@empentia.com
Phone: 685 615 150

2. Purposes of Processing

2.1. Automation audit (empentia.com)

Data collected: company URL, sector of activity, company size, software tools used, business processes, name, email, phone, position, contact preference.
Purpose: to carry out an automated audit identifying automation opportunities and improving the audited company's productivity. To contact the applicant with the results and, subject to consent, related commercial information.
Legal basis: consent of the data subject (Art. 6.1.a GDPR) and legitimate interest for the provision of the requested service (Art. 6.1.f GDPR).

2.2. Client portal (app.empentia.com)

Data collected: email, name, company data, business information provided voluntarily (clients, products, invoices).
Purpose: management of the contractual relationship, provision of the contracted automation and AI services, and service-related communication.
Legal basis: performance of a contract (Art. 6.1.b GDPR).

2.3. Commercial communications

Purpose: sending information about services, news and content of interest related to automation and artificial intelligence for businesses.
Legal basis: explicit consent of the data subject (Art. 6.1.a GDPR).

2.4. Public scraping

As part of the audit service, empentIA accesses publicly available information on the audited company's website (text, metadata, detected technologies). This information is used exclusively to personalize the audit and does not include personal data beyond that already public.

2.5. WhatsApp messaging channel (service operated on behalf of clients)

When empentIA provides customer service via WhatsApp on behalf of one of its clients (for example, a property management company), the contracting client is the data controller of the end users who write to that channel, and empentIA acts as the data processor on its behalf, under a data processing agreement signed between both parties (Art. 28 GDPR).

Data processed: phone number, WhatsApp profile name, content of the messages exchanged, and associated metadata (timestamps, delivery status).
Purpose: handling of enquiries, incidents and customer service through the WhatsApp channel, including responses generated automatically by artificial intelligence systems.
Legal basis: as determined by the controlling client, typically the performance of a contract or the service relationship with the end user (Art. 6.1.b GDPR) or legitimate interest (Art. 6.1.f GDPR).
Automated systems: responses may be generated by an AI assistant. The user may request human attention at any time, and may opt out of the channel by replying STOP.

3. Data Recipients

Personal data may be shared with the following recipients, only where necessary for the provision of the service:

Supabase Inc. — Database and authentication provider (servers in the EU).
Vercel Inc. — Frontend web hosting provider.
Railway Corp. — Backend hosting provider.
Anthropic PBC — Artificial intelligence provider for analysis and content generation.
Brevo (Sendinblue) — Email delivery provider.
Meta Platforms Ireland Ltd. — Provider of the WhatsApp Business Platform messaging infrastructure. In the processing of WhatsApp channel data, Meta acts as an independent controller with respect to its own purposes as determined by its terms of service. Data is processed through Meta's Cloud API.

No international data transfers outside the European Economic Area will be carried out without adequate safeguards. For providers based in the USA, we ensure they have the appropriate certifications or transfer mechanisms in place.

4. Retention Period

Audit data: retained for a maximum period of 12 months from collection, unless the data subject requests earlier deletion.
Client data: retained for the duration of the contractual relationship and, subsequently, for the legally established periods to address potential liabilities (5 years).
Commercial communications: until the data subject withdraws consent.
WhatsApp channel data: retained according to the instructions of the controlling client, and in any case no longer than necessary for the purpose of the service or as established by the processing agreement.

5. Rights of Data Subjects

Everyone has the right to obtain confirmation as to whether we are processing their personal data. In particular, the following rights may be exercised:

Access: the right to obtain information about the personal data being processed.
Rectification: the right to request the correction of inaccurate or incomplete data.
Erasure: the right to request the deletion of data ("right to be forgotten").
Restriction: the right to request the restriction of processing in certain cases.
Portability: the right to receive the data in a structured, commonly used format.
Objection: the right to object to the processing of the data.

To exercise these rights: send an email to hola@empentia.com indicating the right you wish to exercise and attaching a copy of your identity document. We will respond within a maximum of 30 days.

You also have the right to lodge a complaint with the Catalan Data Protection Authority (apdcat.gencat.cat) or the Spanish Data Protection Agency (aepd.es).

6. Security Measures

empentIA Tech SL has adopted the technical and organizational measures necessary to guarantee the security of personal data:

Encryption of communications (HTTPS/TLS)
Secure authentication via magic link (no password storage)
Per-client data isolation (multi-tenant architecture)
Access restricted to authorized personnel only
Periodic backups

7. Updates

This Privacy Policy may be amended to adapt it to legislative developments or changes in our services. Any changes will be published on this page. We recommend reviewing it periodically.