Privacy Policy

1. Introduction

At BOTSTORMING CLOUD, S.L. we take seriously the privacy of the people whose data we process: those who visit this website or contact us, and those who interact by voice, chat or web with the artificial intelligence agents we provide as a service to our customers.

This Privacy Policy explains what personal data we process, for what purpose, for how long and what rights you can exercise over it, in compliance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).

We distinguish two different situations, because our role in each one is different:

• As data controller: when you visit our website, request commercial information or deal with us directly. This policy governs that processing in detail (sections 3 to 11).
• As data processor: when you interact by voice, chat or web with an artificial intelligence agent that provides a service on behalf of one of our customers. In that case, the one who decides about your data is our customer (the controller), not us — it is up to our customer to inform you at the time of the interaction. Section 12 explains, for information purposes, how we process that data on behalf of our customers and what safeguards we apply.

2. Data Controller

3. Data We Collect (as controller)

3.1 Data you provide to us directly

• Identification information (name, email, telephone).
• Business information (company name, position, sector).
• Contact details when you request information about our services or a demonstration.
• Content of your communications with us.

3.2 Data collected automatically when browsing the website

• Technical information (IP address, browser type, device).
• Usage data (pages visited, session time).
• Cookies and similar technologies (more information in our Cookie Policy).

3.3 Data from the contractual relationship, if you are a customer

• Configuration of the contracted services.
• Billing and transaction data.
• Technical support communications.
• Data generated by the use of the Service (interactions and calls handled by the agents you configure): this data belongs to you as a customer; in relation to it, BotStorming acts as data processor, not as controller — see section 12.

4. Purposes of Processing (as controller)

4.1 Provision of our commercial and support services

• Legal basis: performance of a contract (art. 6.1.b GDPR).
• Retention: for the duration of the contractual relationship and, after its termination or the closure of the account, a maximum of 3 years, unless a legal obligation requires a different period.

4.2 Handling of enquiries and support

• Legal basis: legitimate interest (art. 6.1.f GDPR) in responding to your request.
• Retention: until your enquiry is resolved and, additionally, for the limitation period of possible claims.

4.3 Commercial communications

• Legal basis: express consent (art. 6.1.a GDPR).
• Retention: until you withdraw your consent.

4.4 Improvement of our services

• Legal basis: legitimate interest (art. 6.1.f GDPR).
• Retention: anonymised data for statistical analysis, with no retention limit once it is no longer personal data.

4.5 Compliance with legal obligations

• Legal basis: legal obligation (art. 6.1.c GDPR).
• Retention: for the legally established periods (tax, accounting, commercial).

5. Categories of Personal Data (as controller)

Identification, contact, professional, website browsing and usage data, and financial and transaction data when you are a customer.

6. Origin of the Data

Directly from the data subject: contact forms, telephone or email communications, contracting of our services, requests for commercial information.

7. Recipients

Your data may be disclosed to: public administrations when legally required; infrastructure and technology service providers (hosting, cloud, email and artificial intelligence services); financial institutions for payment management; and legal, tax or accounting advisors. The providers involved in processing data on behalf of our customers are listed on the Sub-processors page. All of them act as data processors where appropriate, subject to the obligations of art. 28 GDPR.

8. International Transfers (as controller)

Our infrastructure servers are located in the European Union. When, for the data described in this section (sections 3 to 7), we use providers located outside the European Economic Area, we apply the safeguards required by Chapter V of the GDPR (adequacy decision, standard contractual clauses or another valid mechanism depending on the provider). When the transfer results from an optional feature that you activate yourself, we show you a prior notice.

9. Rights of the Data Subject

In accordance with the GDPR and the LOPDGDD, you may exercise the following rights: access, rectification, erasure, restriction, portability and objection (including objection to processing for direct marketing purposes, at any time and free of charge).

10. Exercising Your Rights

You can exercise your rights by writing to contact@botstorming.com, attaching a copy of a document proving your identity. We will respond within a maximum of one month from receipt of your request, in accordance with art. 12 GDPR.

11. Security Measures

We apply appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, strong authentication, regular backups and recovery procedures, security audits, and staff training in data protection. You can find more information on the Security and data protection page.

12. If You Interact with an AI Agent of One of Our Customers

This section is for information purposes: it describes how we process data on behalf of our customers when we act as data processors (art. 28 GDPR), not as controllers. The company that contacted you or that you called — not BotStorming — is the one that decides the purposes and means of that processing, and the one that must inform you in accordance with art. 13 GDPR at the time of the interaction.

12.1 What data we may process. Our service may record, transcribe and process using artificial intelligence models the voice, chat or web conversations held with the agent, together with basic identification data of the other party. That content may occasionally include, depending on what you yourself communicate, health data (art. 9 GDPR) or other special categories.

12.2 For what purpose. To provide the service contracted by our customer (call handling, automated customer service, generation of the agent's response) and, if our customer activates this feature, to generate a synthetic voice from a reference sample.

12.3 International transfers. Call data is stored and processed in the European Union. Certain optional features of the service, activated only if our customer chooses them, use global models from providers located outside the European Economic Area, with the safeguards required by Chapter V of the GDPR. Before activating any of these features, our customer sees a notice informing them that the data may be sent outside the European Union.

12.4 Transparency on the use of artificial intelligence. In accordance with art. 50.1 of Regulation (EU) 2024/1689 (AI Act), BotStorming makes available to our customer the technical means necessary for the agent to identify itself as an artificial intelligence system to the people it interacts with. It is our customer who must use those means and not disable them, and who is responsible for ensuring that the agent, in its specific configuration, complies with this obligation.

12.5 Retention and sub-processors. The retention period for this data is determined by each customer, as data controller, as agreed with them.

To provide the service, we use the sub-processors that are published, with the service each one provides and the location of the data, on the Sub-processors page. Any addition or replacement of a sub-processor is reported on that page. BotStorming customers, as data controllers, may object on reasoned and well-founded data protection grounds by writing to contact@botstorming.com; the consequences of the objection are those set out in the data processing agreement signed with BotStorming. This right belongs to our customers and not to the people who interact with their AI agents.

12.6 Your rights. If you wish to exercise your rights over data processed under this section, contact the company you interacted with directly — as controller, it is the one that must handle your request. If you cannot identify it, you can write to us at contact@botstorming.com and we will help you redirect your request.

13. Minors

Our services are not directed at minors. We do not knowingly collect personal data from minors through our website. If you become aware that a minor has provided us with personal data, please contact us so that we can delete it.

14. Complaints

If you consider that we have not properly attended to your rights, you can file a complaint with the Spanish Data Protection Agency (AEPD): C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es.

15. Changes

We reserve the right to modify this Privacy Policy. Changes will be published on this page sufficiently in advance of their application, indicating the date of the last update.

16. Cookies

For information on the use of cookies, please see our Cookie Policy.

Contact

For any questions about this Privacy Policy: contact@botstorming.com.