Your information, handled with care.

Introduction

At KUZTOMER TECH IBERIA, S.L, which operates commercially under the brand Inceptiva (hereinafter, "Inceptiva" or the "Company"), we recognise the importance of protecting the privacy and personal data of our users, clients, collaborators and all other individuals who interact with our websites, products and services.

This Privacy Policy aims to provide clear and transparent information about how we collect, use, store, protect and, where applicable, share the personal data processed within the context of our activities, in accordance with the applicable regulations regarding personal data protection.

This Privacy Policy applies to the processing of personal data obtained through the websites, applications and services owned by KUZTOMER TECH IBERIA, S.L, except where a specific service has a particular privacy policy that replaces or complements this document.

The use of Inceptiva’s websites and services involves the processing of certain personal data necessary for the provision of the services offered, management of the relationship with users, compliance with legal obligations, and the continuous improvement of our products and services, all in accordance with the principles of lawfulness, fairness, transparency, data minimisation, purpose limitation, integrity, confidentiality, and proactive responsibility established by the current regulations.

Data Controller

The controller of the personal data collected through the websites, applications and services of Inceptiva is:

• Registered name: KUZTOMER TECH IBERIA, S.L
• Trading name: Inceptiva
• NIF/CIF: B93896942
• Registered office: Calle.Durillo, 1, 28232, Las Rozas de Madrid, Madrid, Spain
• Contact email: privacy@inceptiva.com

As the data controller, KUZTOMER TECH IBERIA, S.L determines the purposes and means of the processing of personal data in accordance with current regulations and adopts the appropriate technical and organisational measures to ensure their protection and adequate processing.

Should the Company appoint a Data Protection Officer (DPO) or become legally obliged to do so, their contact details will be published and made available to data subjects through the official communication channels.

Personal Data We Collect

Depending on the use that users make of the websites, applications, and services of Inceptiva, KUZTOMER TECH IBERIA, S.L may collect and process the following categories of personal data:

• Identifying data: name, surname, username, and any other information necessary to identify the user.
• Contact details: email address, telephone number, and any other data provided to maintain the relationship with the user.
• Organisation data: information relating to the company, organisation, or entity to which the user belongs, including data necessary for account management and the provision of services.
• Authentication and access data: access credentials, login information, active sessions, and data related to the authentication mechanisms used.
• Billing and contracting data: information necessary for the contracting of services, issuing invoices, payment management, and compliance with tax and accounting obligations.
• Platform usage data: information on the use of services, functionalities used, account settings, and user preferences.
• Technical data: IP address, device identifiers, browser, operating system, access logs, and other technical information necessary to ensure the operation, security, and administration of the services.
• Activity and audit logs: information generated during the use of the platform for the purposes of security, traceability, fraud prevention, and compliance with legal obligations.
• Support communications: information provided by users in support requests, incidents, enquiries, commercial communications or any other interaction maintained with the Company.

The personal data processed shall, in each case, be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are collected, in accordance with the principle of data minimisation established by the applicable regulations.

Purposes of Processing

KUZTOMER TECH IBERIA, S.L processes users’ personal data for the following purposes:

• To manage access to and use of the websites, applications, and services of Inceptiva.
• To create, administer, and maintain user accounts, as well as to manage organisations, permissions, and other functionalities associated with the contracted services.
• To provide the requested services, execute the contractual relationship, and guarantee the correct functioning of the platform.
• To manage contracting, invoicing, collections, and other administrative, tax, and accounting obligations derived from the provision of services.
• To respond to enquiries, requests for information, incidents, and support requests made by users.
• To ensure the security of systems and services, including the prevention of fraud, detection of unauthorised access, management of security incidents, and maintenance of audit logs.
• To comply with the legal and regulatory obligations applicable to KUZTOMER TECH IBERIA, S.L.
• To improve the quality, performance, and user experience of the websites, applications, and services by analysing their operation and use.
• To send communications related to the provision of services, including technical, operational, security, or administrative notifications necessary for the correct management of the relationship with the user.
• To send commercial communications, updates, content or information regarding Inceptiva products and services, where there is a legal basis for doing so and the user has not expressed their objection or, where appropriate, has given the corresponding consent.

Under no circumstances will personal data be processed for purposes incompatible with those for which they were collected.

The general purposes of analytics, product improvement, commercial communications and marketing described in this section do not apply to data obtained through the Google Workspace APIs.

Data obtained through the Google Workspace APIs will be used exclusively to provide the features expressly requested by the user and described in the specific section of this Policy. They will not be used for advertising, commercial profiling, commercial communications, information resale, credit assessment, or to train, develop or improve general-purpose or non-personalised artificial intelligence or machine-learning models.

Legal Basis for Processing

KUZTOMER TECH IBERIA, S.L processes users' personal data only when there is a legal basis legitimising such processing, in accordance with the provisions of Regulation (EU) 2016/679, General Data Protection Regulation (GDPR).

As a general rule, the legal bases that may apply are the following:

• Performance of a contract or application of pre-contractual measures, when processing is necessary to provide the requested services, manage the user's account, or respond to pre-contractual requests.
• Compliance with legal obligations, when processing is necessary to fulfil obligations imposed by applicable law, including tax, accounting, administrative or security obligations.
• Legitimate interest, when processing is necessary to ensure the security of systems, prevent fraud, improve services, manage incidents, or maintain the relationship with users, provided that such interest does not override the rights and freedoms of the data subjects.
• Data subject's consent, when required by applicable regulations, in particular for sending certain commercial communications, the use of non-essential cookies, or any other processing that demands express authorisation.

When the processing of personal data is based on the data subject's consent, this may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to such withdrawal.

The applicable legal basis for each processing operation will depend on the nature of the service requested, the relationship existing between the user and KUZTOMER TECH IBERIA, S.L, and the specific circumstances under which the personal data are collected.

Data Retention

KUZTOMER TECH IBERIA, S.L will retain personal data only for as long as necessary to fulfil the purposes for which they were collected and, subsequently, for the periods required by the applicable regulations or while legal liabilities may arise from their processing.

In general, the retention criteria will be as follows:

• Data associated with the user account will be retained while the account remains active and there is a contractual or service provision relationship.
• Data relating to contracting, invoicing, and payments will be retained for the periods established by the applicable commercial, tax, and accounting legislation.
• Data processed on the basis of consent will be retained while such consent remains in force or until the data subject requests its withdrawal, provided there is no other legal basis legitimising its retention.
• Records of activity, security, and audit may be retained for as long as necessary to ensure the security of systems, prevent fraud, address incidents, and comply with relevant legal obligations.
• Communications maintained with users may be retained for as long as necessary to manage the existing relationship or to handle possible claims.

Once the applicable retention periods have ended, personal data will be deleted or, where appropriate, anonymised or blocked in accordance with the current regulations and KUZTOMER TECH IBERIA, S.L's internal data retention and deletion policies.

Data Recipients

As a general rule, KUZTOMER TECH IBERIA, S.L will not disclose users’ personal data to third parties, except when it is necessary for the provision of services, when there is a legal obligation, or when the data subject has given their consent where required.

Nevertheless, for the correct functioning of the websites, applications and services of Inceptiva, personal data may be processed by providers acting on behalf of KUZTOMER TECH IBERIA, S.L as processors or sub-processors, including, among others, providers of technological infrastructure, hosting, communications, authentication, payment processing, artificial intelligence services, technical support, and other solutions necessary for the provision of services.

In the specific case of data obtained through the Google Workspace APIs, those providers may process it only where strictly necessary to provide the feature requested by the user. They may not use it for advertising, resale, profiling, or the training or improvement of general-purpose or non-personalised artificial intelligence models.

Furthermore, personal data may be disclosed to administrative or judicial authorities or other public bodies when such disclosure is required by applicable legislation or necessary for compliance with legal obligations.

The up-to-date list of sub-processors used by KUZTOMER TECH IBERIA, S.L, as well as information regarding the services they provide and, where applicable, the relevant safeguards, shall be available in the List of Sub-processors published by the Company.

KUZTOMER TECH IBERIA, S.L contractually requires all its providers that process personal data on its behalf to comply with the obligations established by the applicable regulations on personal data protection, as well as to adopt the appropriate technical and organisational measures to guarantee the security and confidentiality of the information.

Processing of Data Obtained from Google Workspace

8.1. Data Inceptiva May Access

When a user connects a Google account, Inceptiva may access only the data covered by the permissions that the user expressly authorises on Google’s consent screen.

Depending on the integrations enabled, this data may include:

• The basic identity of the connected account, such as name and email address.
• The list of calendars available to the user.
• Google Calendar availability information, dates and time slots.
• The information necessary to create events and bookings requested by the user.
• The files, metadata and contents of Google Drive folders expressly selected by the user.
• The information necessary to send emails through Gmail at the user’s instruction and with their confirmation.

Inceptiva does not access the general contents of the Gmail inbox or read emails received through the integration intended for sending messages.

8.2. Purposes of Processing

Data obtained through the Google Workspace APIs is used exclusively to provide the following user-facing features:

• Display available calendars and allow the user to select the calendar that a tool will use.
• Check the availability of the selected calendar.
• Create events and bookings requested and confirmed by the user.
• Synchronise, in read-only mode, documents from a Google Drive folder selected by the user with an Inceptiva Knowledge Base.
• Allow authorised AI Agents to consult the synchronised knowledge in order to generate responses requested by the user.
• Send emails through Gmail when sending has been requested or confirmed by the user.

Inceptiva does not modify or delete files in Google Drive as part of the knowledge integration.

8.3. Limited Use and Artificial Intelligence Systems

Inceptiva’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Inceptiva does not use, or allow third parties to use, raw, aggregated, anonymised or derived data obtained through the Google Workspace APIs for:

• Targeted, personalised or interest-based advertising.
• Advertising or commercial profiling.
• The sale or supply of data to data brokers or information resellers.
• Credit assessment or the provision of financing.
• Training, developing or improving general-purpose, foundation or non-personalised artificial intelligence or machine-learning models.

Where necessary to provide a feature requested by the user, certain content excerpts or contextual information may be processed through OpenAI’s commercial API. This transfer is limited to generating the response or performing the function requested by the user.

Inceptiva has not authorised the use of data sent through the OpenAI API to train or improve OpenAI models. This data is not transferred for advertising, profiling or general-purpose model-training purposes.

8.4. Storage and Retention

Google authorisation tokens are stored in encrypted form and retained while the connection remains active or until the user disconnects it, Google revokes the authorisation, or the authorisation ceases to be valid.

Documents synchronised from Google Drive may be stored in Inceptiva’s infrastructure and indexed in the selected Knowledge Base to provide the requested feature. Disconnecting Google Drive stops access and future synchronisations, but does not automatically delete documents previously incorporated. The user may delete them from the corresponding Knowledge Base.

Information generated by bookings, sends and executions may be retained as part of conversations, operational records and audit logs for the periods necessary to provide the service, ensure its security and address legal liabilities.

8.5. Providers and Transfers

OpenAI acts as a technology provider for the processing of certain artificial intelligence requests. Its involvement is limited to providing the feature requested by the user and is subject to the applicable contractual and data-protection obligations.

Information obtained from Google Workspace is not disclosed to third parties for purposes other than providing or securing the features requested by the user, unless required by law.

8.6. Control and Revocation

The user may disconnect Google integrations from Inceptiva and revoke the permissions granted through their Google Account security settings.

Revocation will prevent any new access to Google Workspace. Previously synchronised documents must be deleted from Inceptiva if the user also wishes to delete the copies incorporated into a Knowledge Base.

To request information or the deletion of data associated with these integrations, the user may contact privacy@inceptiva.com.

International Transfers

As a general rule, KUZTOMER TECH IBERIA, S.L will seek to ensure that the processing of personal data is carried out within the European Economic Area (EEA).

However, certain service providers used for the provision of Inceptiva services may be located outside the European Economic Area or may process personal data from third countries.

When this occurs, KUZTOMER TECH IBERIA, S.L will ensure that such international data transfers are carried out in accordance with the applicable regulations on personal data protection and only where there is a legal basis to legitimise them, adopting the appropriate safeguards provided for by Regulation (EU) 2016/679 (GDPR).

Such safeguards may include, as appropriate, adequacy decisions adopted by the European Commission, the signing of Standard Contractual Clauses (SCC), binding corporate rules or other legally recognised mechanisms.

Up-to-date information about the providers that may involve international data transfers and the applicable safeguards will be available, where appropriate, in the List of Sub-processors published by KUZTOMER TECH IBERIA, S.L.

Rights of Data Subjects

In accordance with the applicable regulations on the protection of personal data, data subjects may exercise, at any time and free of charge, the following rights:

• Right of access: to know whether KUZTOMER TECH IBERIA, S.L is processing their personal data and to obtain information regarding such processing.
• Right to rectification: to request the correction of personal data that is inaccurate or incomplete.
• Right to erasure: to request the deletion of their personal data when any of the circumstances provided for under the applicable regulations are met.
• Right to object: to object to the processing of their personal data when such processing is based on legitimate interest or on any other circumstance legally established.
• Right to restriction of processing: to request that the processing of their personal data be restricted in the cases established by law.
• Right to data portability: to receive the personal data provided in a structured, commonly used and machine-readable format, as well as to request its transmission to another data controller where technically feasible.
• Right to withdraw consent: to withdraw, at any time, the consent given for those processes based on such legal ground, without affecting the lawfulness of the processing carried out prior to such withdrawal.
• Right not to be subject to automated individual decision-making, including profiling, where applicable in accordance with current regulations.

The exercise of these rights may be carried out under the terms and conditions established by the applicable regulations and in accordance with the procedure described in the following section of this Privacy Policy.

Exercise of Rights

Data subjects may exercise the rights recognised by the applicable regulations on personal data protection by means of a request addressed to KUZTOMER TECH IBERIA, S.L via the email address privacy@inceptiva.com or through any of the contact methods provided by the Company.

The request must allow for verification of the identity of the applicant and specify the right they wish to exercise; additional information may be requested where necessary to verify their identity or to correctly process the request.

KUZTOMER TECH IBERIA, S.L shall respond to requests within the time limits established by the applicable regulations and may refuse those that are manifestly unfounded, excessive, or do not meet the legally required conditions.

If the data subject considers that the processing of their personal data does not comply with current regulations, they may lodge a complaint with the competent supervisory authority, without prejudice to any other administrative or judicial remedy to which they may be entitled.

Information Security

KUZTOMER TECH IBERIA, S.L maintains a strong commitment to the protection of personal data and adopts appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the nature of the data processed, the context and purposes of the processing, as well as the risks to the rights and freedoms of individuals.

These measures are intended to prevent the destruction, loss, alteration, unauthorised disclosure or improper access to personal data, as well as to ensure the confidentiality, integrity, availability and resilience of the systems and services used for their processing.

The security measures implemented are reviewed and updated periodically in order to adapt to technological developments, changes in the services offered and the legal obligations that may apply.

General information regarding the security measures implemented by KUZTOMER TECH IBERIA, S.L may be consulted in the Trust Center and other informative documentation published by the Company, without prejudice to any information whose disclosure could compromise the security of the systems or the data processed.

Minors

The websites, applications and services of Inceptiva are primarily aimed at businesses, professionals, and individuals of legal age.

KUZTOMER TECH IBERIA, S.L does not knowingly collect personal data from minors nor does it specifically direct its services to this group.

In the event that KUZTOMER TECH IBERIA, S.L becomes aware that personal data of a minor has been collected in breach of the applicable regulations, it will take reasonable measures to proceed with its deletion or, where appropriate, request the authorisation of the holder of parental authority or guardianship.

If any person considers that a minor has provided personal data through the services of Inceptiva, they may notify privacy@inceptiva.com so that the Company can take the appropriate measures.

Changes to the Privacy Policy

KUZTOMER TECH IBERIA, S.L may modify or update this Privacy Policy whenever necessary to adapt it to regulatory, case law, technological or organisational changes, or to changes arising from the evolution of the websites, products, or services offered.

The modifications will be published through the official channels of Inceptiva and shall take effect from the effective date indicated in the updated version, unless the applicable legislation requires a different procedure.

When the modifications significantly affect the processing of personal data or when so required by the applicable legislation, KUZTOMER TECH IBERIA, S.L will take reasonable steps to inform users through appropriate means.

Users are advised to consult this Privacy Policy periodically in order to be aware of its current version. The date of the last update of the document will be indicated at the beginning or end of the document for information purposes.

Contact

If you have any queries, questions or requests related to this Privacy Policy or to the processing of your personal data, you may contact KUZTOMER TECH IBERIA, S.L via the following channels:

• Privacy email address: privacy@inceptiva.com
• Registered address: Calle.Durillo, 1, 28232, Las Rozas de Madrid, Madrid, Spain

KUZTOMER TECH IBERIA, S.L will respond to queries and requests received within the timeframes established by the applicable legislation and will take the necessary measures to guarantee the proper exercise of the rights of the data subjects.

In the event that the Company appoints a Data Protection Officer (DPO), their contact details will be published in the official channels of Inceptiva and will be available for any matters related to the protection of personal data