Privacy Policy
Last updated: 14 December 2024
1. Information for the User
Universal Telecom Experts S.L. (hereinafter, "UTIO" or "we"), with CIF B92635515 and registered office at Calle Almogia 14, B5 L30, 29007 Málaga, España, is the data controller for the User's personal data and informs you that this data will be processed in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Spanish Organic Law 3/2018 of 5 December (LOPDGDD).
📧 Controller Contact Details
- Company name: Universal Telecom Experts S.L.
- CIF: B92635515
- Address: Calle Almogia 14, B5 L30, 29007 Málaga, España
- Email: privacidad@utio.io
- Phone: +34 951 047 200
- Data Protection Officer: privacidad@utio.io
2. What Data Do We Collect?
UTIO may collect and process the following categories of personal data:
2.1. Registration and Account Data
- Full name and contact details
- Company name and CIF/NIF
- Corporate email address
- Phone number
- Full postal address
- Encrypted password
2.2. Billing and Payment Data
- Payment information (processed by Stripe, Inc.)
- Transaction and invoice history
- Contracted subscription plan
2.3. Service Usage Data
- Conversations processed by our AI agents
- Content of emails, WhatsApp messages and voice calls (solely to provide the service)
- Usage statistics and performance metrics
- Activity and access logs
- Settings and preferences
2.4. Technical Data
- IP address
- Browser and device type
- Operating system
- Cookies and similar technologies
- Approximate geolocation data
3. Purposes and Legal Basis for Processing
| Purpose | Legal Basis | Retention |
|---|---|---|
| Management of the user account and provision of the service | Performance of the contract (Art. 6.1.b GDPR) | Duration of the contract + 6 years (tax obligations) |
| Billing and payment management | Performance of the contract and legal obligation (Art. 6.1.b and c GDPR) | 6 years from the last invoice |
| Processing of communications (AI) | Performance of the contract (Art. 6.1.b GDPR) | For the duration of the service, then immediate deletion |
| Sending marketing communications | Consent (Art. 6.1.a GDPR) | Until you withdraw consent |
| Service improvement and statistical analysis | Legitimate interest (Art. 6.1.f GDPR) | 2 years from collection |
| Compliance with legal obligations | Legal obligation (Art. 6.1.c GDPR) | As required by applicable regulations |
4. Data Recipients
Your personal data may be disclosed to the following recipients:
4.1. Service Providers
- Stripe, Inc. - Payment processing (USA - Privacy Shield and standard clauses)
- OpenAI / Anthropic - Language models for conversational AI (USA - standard clauses)
- Amazon Web Services (AWS) - Server hosting (EU - Ireland)
- Google Cloud Platform - Infrastructure services (EU)
- Meta Platforms (WhatsApp Business API) - Messaging service
⚠️ International Transfers
Some of our providers may be located outside the European Economic Area. In these cases, we guarantee that the transfer is carried out with appropriate safeguards (Standard Contractual Clauses approved by the European Commission, Privacy Shield where applicable, or adequacy decisions).
4.2. Public Authorities
We may disclose your data to public authorities where there is a legal obligation, including:
- The Tax Agency (tax obligations)
- Law enforcement bodies (crime prevention)
- Courts and Tribunals (judicial proceedings)
5. Processing of Communications Data
🔒 Confidentiality Commitment
UTIO is committed to:
- Processing communications (emails, WhatsApp, calls) solely to provide the contracted service
- NOT using the content of communications to train its own AI models
- NOT sharing content with third parties except for necessary processors (OpenAI/Anthropic under a DPA contract)
- Securely deleting content after processing
- Keeping content encrypted in transit and at rest
5.1. Retention of Conversation Data
- Real-time content: Processed and deleted immediately (not stored)
- Metadata (date, time, duration): 30 days for metrics
- Transcripts (if enabled): 90 days, then automatic deletion
6. User Rights
As a User, you have the right to exercise the following rights in relation to your personal data:
🔍 Right of Access
Obtain information about whether we are processing your personal data and, where applicable, access it.
✏️ Right of Rectification
Request correction of inaccurate data or completion of data that is incomplete.
🗑️ Right of Erasure
Request deletion of your data when it is no longer necessary or processing is not lawful.
⏸️ Right of Restriction
Request restriction of the processing of your data in certain circumstances.
📦 Right of Portability
Receive your data in a structured format and transmit it to another controller.
🚫 Right to Object
Object to the processing of your data on grounds relating to your particular situation.
How to exercise your rights?
You can exercise your rights by sending a request to:
- Email: privacidad@utio.io
- Postal mail: Calle Almogia 14, B5 L30, 29007 Málaga, España
You must enclose a copy of your ID or equivalent document. We will respond to your request within a maximum of 1 month.
📋 Right to Complain
If you believe that the processing of your data does not comply with the regulations, you may file a complaint with the Spanish Data Protection Agency (AEPD):
- Website: www.aepd.es
- Address: C/ Jorge Juan, 6, 28001 Madrid
- Phone: 901 100 099 / 912 663 517
7. Security Measures
UTIO has implemented appropriate technical and organisational security measures to protect your personal data:
- TLS/SSL encryption on all communications
- AES-256 encryption of data at rest
- Two-factor authentication (2FA) available
- Role-based access control (RBAC)
- Periodic security audits
- Continuous threat monitoring
- Daily encrypted backups
- Security incident response protocols
8. Cookies and Similar Technologies
UTIO uses cookies and similar technologies. For more information, please see our Cookie Policy.
9. Minors
UTIO's services are aimed at companies and professionals. We do not intentionally collect data from minors under 18 years of age. If we detect that we have collected data from a minor without parental authorisation, we will proceed to delete it immediately.
10. Changes to the Policy
UTIO reserves the right to amend this Privacy Policy to adapt it to legislative or case-law developments or changes in our services. Changes will be notified at least 15 days in advance of their application.
The date of the last update is shown at the beginning of this document.
11. Contact
For any question or query about this Privacy Policy, you can contact us at:
Universal Telecom Experts S.L.
Calle Almogia 14, B5 L30, 29007 Málaga, España
Email: privacidad@utio.io
Phone: +34 951 047 200