Data protection

Privacy Policy

1. Data controller

  • Identity: INTENCION AI, S.L.
  • Tax ID (NIF): B93913697
  • Address: Calle Aviación Española 3, 1º izq., 28003 Madrid, Spain
  • Email: info@intencion.es

INTENCION AI, S.L. has not appointed a Data Protection Officer, as none of the circumstances set out in article 37 of the GDPR apply. For any question regarding the processing of your data, you can write to info@intencion.es.

2. Purpose of processing

This website has no forms: browsing it does not involve collecting any personal data. We only process your data if you choose to get in touch, for these purposes:

  • To handle and organise meeting requests made through our booking tool.
  • To reply to enquiries you send us by email.
  • To send you commercial information about our services, if you give us your consent.

3. Legal basis

To handle your meeting request or enquiry, the legal basis is the taking of steps at your request prior to entering into a contract, under article 6.1.b) of the General Data Protection Regulation (GDPR), and failing that your consent, given when you write to us or book, under article 6.1.a).

For sending commercial communications, the legal basis is your consent under article 6.1.a) of the GDPR, which you can withdraw at any time without affecting the lawfulness of processing carried out beforehand.

Measuring how the site is used rests on two different bases. For Google Analytics it is your consent under article 6.1.a) of the GDPR, which you can withdraw whenever you want from the cookie policy. For Cloudflare Web Analytics it is our legitimate interest in knowing which pages get read, under article 6.1.f), because it counts visits with no cookies, no identifiers stored on your device and no way of identifying anyone.

4. Data collected

Depending on the channel you choose:

  • When booking a meeting through our booking tool: your name, your email address, the date and time you pick and any information you choose to add to the booking.
  • When writing to us by email: your email address and whatever data you include in the message.
  • When browsing the site: the page viewed, the date and time, the page or search engine you came from, the approximate country and the type of device and browser. Cloudflare Web Analytics collects that data without storing anything on your device; your IP address is processed only transiently to serve the request and is not kept alongside the visit. If you also accept analytics cookies, Google Analytics collects the same data tied to a random identifier stored in your browser, and uses your IP address to infer approximate location without keeping it in the reports.

5. Recipients

Data is not shared with third parties, except where legally required. The following data processors are used:

  • Google Workspace: email, calendar and storage, with data hosted in the EU. Confirming a booking creates the appointment and the Google Meet link in our calendar, so Google also processes that appointment's data in accordance with its Privacy Policy.
  • Railway: hosting for agenda.intencion.es, our own tool for handling bookings. Both the server and its database sit in the provider's European region, in the Netherlands. It processes the data in accordance with its Privacy Policy.
  • Notion: the CRM where the booking is recorded so we can handle and follow up on it. It processes the data in accordance with its Privacy Policy.
  • Resend: delivery of the booking emails, such as the confirmation and the reminders. It processes the data in accordance with its Privacy Policy.
  • Google (Google Analytics): measurement of how the site is used, only if you accept analytics cookies. Google processes the data in accordance with its Privacy Policy and may host it on servers outside the European Economic Area. Those transfers rely on the EU-US Data Privacy Framework adequacy decision and, additionally, on the standard contractual clauses approved by the European Commission.
  • Cloudflare (DNS, Cloudflare Web Analytics and Turnstile): domain resolution, cookieless visit counting and the anti-abuse check that protects the booking form. It processes the data in accordance with its Privacy Policy, with the same safeguards for international transfers.

Railway, Notion and Resend are US providers. Although the booking tool and its database are hosted in the European Union, their involvement as processors may entail international transfers, covered by the standard contractual clauses approved by the European Commission set out in their respective data processing agreements.

You can read in the cookie policy which cookies the analytics sets, how the Google content embedded in the site is loaded and why none of it happens without your consent.

6. Retention period

Personal data is kept for as long as necessary to respond to the enquiry and, where applicable, for the periods established by law. Once the purpose has been fulfilled, the data is deleted.

Browsing data collected by Google Analytics is kept for a maximum of 14 months from the last activity, which is the retention period configured in the tool. Cloudflare Web Analytics keeps only aggregated data, which cannot identify any individual.

7. Rights of the data subject

Users can exercise the following rights by writing to info@intencion.es:

  • Access: to find out which personal data is being processed.
  • Rectification: to request the correction of inaccurate data.
  • Erasure: to request the deletion of the data.
  • Restriction: to request the restriction of processing.
  • Portability: to receive the data in a structured format.
  • Objection: to object to the processing of the data.

Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

8. Security measures

The technical and organisational measures necessary to guarantee the security of personal data and prevent its alteration, loss, unauthorised processing or access have been adopted, in line with the state of the art.

These measures include restricted access to the corporate accounts where requests are received, two-step authentication and limiting data access to the people who need to handle it.