Privacy Policy
This Privacy Policy describes how Venturalítica S.L. (NIF B23955206), as data controller, collects, processes and protects the personal data of users of this website, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 on Personal Data Protection (LOPD-GDD) and Law 34/2002 on Information Society Services (LSSI-CE).
Who is the controller of your personal data?
Venturalítica S.L. NIF: B23955206 Registered office: C/ Monte Ernio 4, 1.º Izquierda, 20015 Donostia-San Sebastián, Spain Email: info@venturalitica.ai Phone: +34 645 13 40 00 Venturalítica S.L. has not appointed a Data Protection Officer because the conditions in Article 37 GDPR do not apply. For any data protection matter you may write to info@venturalitica.ai.
Processing principles
In accordance with Article 5 GDPR your personal data will be processed lawfully, fairly and transparently. We apply the principles of purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality. This policy follows the layered information model and the question-and-answer structure recommended by the Spanish Data Protection Agency (AEPD).
For what purposes do we process your personal data?
We process the personal data you provide for the following purposes, separated by collection channel: • Contact form: respond to your enquiry, manage the pre-contractual relationship and, where appropriate, send you the information you have requested (e.g. the quick guide on the EU AI Act when you tick the box). • Web analytics (PostHog in the European region): generate aggregated usage statistics —pages visited, visit duration, device, language— in order to improve the navigation experience and the quality of the content. This purpose is only enabled if you give explicit consent in the cookie banner. • Technical operation: keep the strictly necessary functionalities of the site available (session, language preferences, cookie preferences). We do not carry out profiling or automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR.
What is the legal basis for processing your data?
The legal basis is identified per purpose in accordance with Article 6 GDPR: • Handling enquiries and pre-contractual relationship via the contact form: Article 6(1)(b) GDPR — pre-contractual measures taken at the data subject's request. • Sending the quick AI Act guide when explicitly requested through the corresponding tick-box: Article 6(1)(a) GDPR — consent. • Web analytics through PostHog: Article 6(1)(a) GDPR — consent provided in the cookie banner. Without consent the tool is not initialised and no data is sent. • Strictly necessary cookies and technical storage: Article 22.2 LSSI-CE — technical exception — in conjunction with Article 6(1)(f) GDPR — legitimate interest in delivering the service requested by the user. Consent may be withdrawn at any time by writing to info@venturalitica.ai or from the cookie preferences panel, without affecting the lawfulness of processing prior to withdrawal (Article 7(3) GDPR).
To which recipients will your data be communicated?
Your data is not transferred to third parties save for legal obligation. We do, however, rely on the following processors and sub-processors to deliver the service, all bound by a contract under Article 28 GDPR: • Odoo S.A. (Belgium, EU) — CRM and contact form management. • PostHog Inc. — web analytics served from the European region (eu.i.posthog.com), data stored in the EU. • Scaleway S.A.S. (France, EU) — website hosting (serverless containers in Paris). • Resend Inc. / Scaleway TEM — transactional email for sending replies and requested guides. • Cloudflare Inc. — content delivery network and abusive traffic mitigation (data in transit). We do not perform international transfers outside the European Economic Area. Should any take place in the future, they will be covered by the appropriate safeguards provided in Articles 44 to 50 GDPR (European Commission Standard Contractual Clauses or adequacy decisions).
How long will we keep your data?
We keep your data for the time strictly necessary to meet each purpose and, afterwards, for the limitation periods of any actions that may arise: • Contact form without subsequent contracting: up to 1 year from the last communication, unless you request earlier erasure. • Contractual relationship: for the duration of the contract and the applicable legal limitation periods (up to 6 years for commercial and tax obligations). • Analytics identifiers in your browser: until you withdraw consent; associated data in PostHog: 12 months from the last visit. • Cookie banner preferences (cookie_prefs): 24 months; after that period consent is requested again.
What are your rights when you provide us with your data?
Under Articles 15 to 22 GDPR you have the following rights: • Right of access: to obtain confirmation as to whether we process your data and, if so, a copy. • Right of rectification: to correct inaccurate or incomplete data. • Right to erasure («right to be forgotten»): to obtain the deletion when no longer needed for the purpose for which it was collected. • Right to restriction of processing: to suspend processing while accuracy or lawfulness is verified. • Right to portability: to receive your data in a structured, commonly used and machine-readable format. • Right to object: to object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. • Right not to be subject to automated decisions: Article 22 GDPR (not applicable: we do not make such decisions). You can exercise these rights by writing to info@venturalitica.ai with a copy of an identity document. We will reply within a maximum of one month (extendable by a further two months in complex cases, Article 12(3) GDPR). If you believe the processing does not comply with the regulation, you have the right to lodge a complaint with a supervisory authority. In Spain, the Spanish Data Protection Agency —https://www.aepd.es/—. If you habitually reside in another EU Member State, you may contact the supervisory authority competent at your place of residence.
How did we obtain your data?
The personal data we process comes directly from you: you actively provide it when you complete the contact form, request the guide or accept the analytics cookies banner. We do not collect personal data from publicly accessible sources or from third parties. The categories of data we process are limited to identifying data (name, email address), contact data (organisation, optional phone), enquiry content and technical browsing data when consent is given.
Do we make automated decisions or profiling?
We do not make automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR.
What security measures do we apply?
We apply technical and organisational measures appropriate to the level of risk of the processing (Article 32 GDPR): TLS 1.3 in-transit encryption across the entire site, two-factor authentication for operator access where supported by providers, need-to-know access control, encrypted backups, incident logging and documented procedures for breach notification within 72 hours to the AEPD where the conditions of Article 33 GDPR apply.
Do we use cookies or similar technologies?
Yes. We use cookies that are strictly necessary for the operation of the site (language preferences, consent management) and, subject to explicit consent, analytics cookies via PostHog on European infrastructure. The detailed description —provider, purpose, type, duration and legal basis of each cookie— is published in the Cookie Policy. You may manage or withdraw your consent at any time from the «Cookie preferences» link in the footer, with the same ease with which you gave it (Article 7(3) GDPR).
Processing of minors' data
This website is not directed at persons under 14 years of age, the minimum age set in Spain by Article 7 LOPD-GDD for consent. If you are in another Member State the minimum age may be up to 16 years pursuant to Article 8 GDPR. We do not knowingly collect data from minors; if you become aware that a minor has provided data without the consent of the holder of parental authority, you may request its erasure by writing to info@venturalitica.ai.
Changes to this policy
We may update this Privacy Policy to reflect regulatory changes, the addition of new processors or changes in purposes. The current version will always be available on this page and, in the case of substantial changes, your consent will be requested again where appropriate. Last updated: 7 September 2026.