Website Privacy Policy

Last updated: 22 September 2026

The Spanish version is the legally binding text; in the event of any discrepancy, it shall prevail.

Key information

Who is the data controller?

AVATIA DIGITAL COWORKERS, S.L. (hereinafter, «AVATIA») is the controller of your personal data for the purpose of providing you with the services identified in this Privacy Policy. AVATIA is a company with registered office at Carrer de la Tapineria, 10, 08002 Barcelona, and its tax ID (NIF) is ESB26941393.

At AVATIA we are committed to the fundamental right to the protection of your personal data, and the purpose of this Privacy Policy is to inform you about your rights under the General Data Protection Regulation («GDPR»).

We inform you that AVATIA has a Data Protection Officer in accordance with the GDPR, available to you for any question or query regarding the processing of your data, whom you may contact at dpo@avatia.ai.

What information do we process?

Data you provide to us directly

We collect information about you when you contact us through the channels enabled for this purpose, such as the contact forms to work with us and to join the team. When you contact us through those channels, we will request your first and last name, email address, professional details, telephone number, and company name.

All fields marked with an asterisk (*) in the forms provided to you on the channels are mandatory, such that the omission of any of them may make it impossible for us to provide the requested services. You must provide truthful information; identity impersonation or the use of aliases or anonymous names is prohibited.

When providing any data that may be requested on the channels, you may not choose insulting expressions, or expressions matching trademarks, trade names, or the names or pseudonyms of public figures or celebrities you are not authorised to use.

So that the information provided is always up to date and free of errors, you must notify AVATIA as soon as possible of any changes to your personal data. Likewise, by clicking the «Accept» button (or equivalent) included in those forms, you declare that the information and data you have provided are accurate and truthful.

Demonstration requests

When you request a demonstration, we receive your full name, company, work email address and phone number, together with any comments you choose to provide. The contact fields are required to handle your request; comments are optional. We also receive your IP address, the date and time of submission and limited request references to prevent misuse and investigate problems with submissions. Please do not include patient information, health data or other sensitive information in your comments.

Data obtained indirectly

When you browse, various cookies and other tracking devices may be installed on your device, as explained in our Cookie Policy.

What is the source of the data?

You provide your contact details and any comments in the demo form. We obtain the associated IP address, submission time and limited request references automatically when you submit it.

Where the personal data provided belongs to a third party, you warrant that you have informed them of this Privacy Policy and have obtained their authorisation to provide the data to AVATIA for the purposes indicated above. You likewise warrant that the data provided is accurate and up to date, and you are responsible for any direct or indirect damage that may arise as a result of a breach of this obligation.

For what purpose and on what legal basis do we process the data?

Demonstration requests

For professional demo enquiries made on behalf of an organisation, we process your contact details and message on the basis of our legitimate interest in receiving and managing that enquiry. Where you personally request steps before entering into a contract to which you would be a party, the basis is taking those steps at your request. We process your IP address, submission time and limited request references on the basis of our legitimate interest in preventing misuse and protecting the form. Submitting a demo request does not enrol you in a newsletter or authorise unrelated marketing. This form does not carry out automated lead scoring.

AVATIA acts as data controller for the following purposes and in accordance with the following legal bases:

Based on the management of the contractual or pre-contractual relationship

• Providing you with the services you have requested and handling your requests for information, as well as facilitating the exercise of your rights.
• Assessing the CVs received and managing recruitment processes.

Based on compliance with AVATIA's legal obligations

• Allowing users to exercise their rights recognised under the GDPR (access, rectification, erasure, objection, restriction of processing, and portability), as well as under other national or European data protection regulations.
• Complying with the obligations laid down in tax and accounting regulations, as well as in legislation on consumer and user protection, information society services and electronic commerce, and any other sector-specific or general regulations applicable to AVATIA's activity.

Based on the explicit, free, and unequivocal consent you may give us

• Where applicable, keeping you informed about our own products and services or those of third parties, always sent through AVATIA by electronic means.

Based on AVATIA's legitimate interest

• Keeping you informed about AVATIA's products and services related to those previously contracted and that may be of interest to you.
• Conducting periodic reviews of our services and carrying out satisfaction surveys in order to assess and improve the quality of the service we provide.
• Carrying out internal reviews and, where applicable, contacting the client where possible fraud or identity impersonation is detected or reasonably suspected.

However, if you do not want your data to be processed for these purposes, you may object at any time by contacting us at hello@avatia.ai, as indicated in the "Exercising your rights" section of this Privacy Policy.

To whom is the data disclosed?

All disclosures of personal data we make are necessary to fulfil the purposes indicated, or are made to comply with a legal obligation:

• To public authorities and the administration of justice, and to the State security forces and bodies, in compliance with the legal obligations applicable to us.
• Companies providing IT services, tools, or the IT infrastructure on which the services provided by AVATIA are based, such as hosting providers, CRMs, emailing service companies, etc.

In this respect, we inform you that any disclosure that occurs will be carried out taking into account all the necessary legal safeguards. We also guarantee that we sign specific contracts with all our service providers as established by the regulations.

Likewise, AVATIA guarantees that, should there be providers located in countries outside the European Union or others not deemed adequate under data protection regulations, the necessary precautions are taken to ensure that the data can be transferred securely — whether because the provider offers appropriate safeguards, through, among others, the signing of the European Commission's Standard Contractual Clauses, or because one of the exceptions provided for in the regulations is met.

Exercising your rights

We inform you that you may exercise the following rights:

• The right of access to your personal data, to know which data is being processed and the processing operations carried out on it.
• The right to rectification of any inaccurate personal data.
• The right to erasure of your personal data, where possible.
• The right to request the restriction of processing of your personal data where the accuracy, lawfulness, or necessity of the processing is in doubt, in which case we may retain the data for the exercise or defence of claims.
• The right to object to automated decision-making, including profiling.
• The right to object to the processing of your personal data where the legal basis authorising us to process it is legitimate interest.
• The right to portability of your data, where the legal basis authorising us to process it is the existence of a contractual relationship or your consent.
• The right to withdraw the consent given to AVATIA.

You may exercise your rights at any time and free of charge in the following ways:

• By sending an email to hello@avatia.ai from the email address with which you registered for our services, indicating the right you wish to exercise.
• By sending a written request to Carrer de la Tapineria, 10, 08002 Barcelona, indicating the right you wish to exercise.

In addition, whenever you receive any communication from us, by clicking the unsubscribe section it will contain, you may opt out of all previously accepted commercial communications.

When you exercise your rights, and only if we have doubts about your identity, we may request additional information to verify your identity.

We also inform you that you have the right to lodge a complaint with the Spanish Data Protection Agency if you consider that we have committed a breach of data protection legislation in relation to the processing of your personal data.

Furthermore, we inform you that you may register with the Robinson List at www.listarobinson.es — the advertising exclusion system managed by the Spanish Digital Economy Association (ADIGITAL) — or with the StopPublicidad List of the Spanish Association for Digital Privacy at listastoppublicidad.com, where you may register in order to object to your data being used to send you commercial communications.

Retention period for your data

Demonstration requests

We keep the information submitted through the demonstration-request form for 90 days from receipt. We keep the associated IP address for 7 days for security purposes. After those periods, these records are excluded from normal use and queued for deletion, which normally completes within a few days. Any information that must be retained to meet a legal obligation or establish, exercise or defend a legal claim is restricted to that purpose and kept only for the necessary period.

We will only keep your data for as long as necessary to provide you with these services. Any data you provide us through the channels will be blocked once it is no longer necessary to manage the service, and will only be available where there is a legal obligation (arising from a request by the State security forces and bodies or by the Courts and Tribunals), as well as when you exercise your rights.

Security and confidentiality

In order to prevent unauthorised access to or unauthorised disclosure of personal data, we have taken the appropriate technical and physical measures, as well as the management processes, to safeguard and secure the information we collect from you.

Updates to this Privacy Policy

We make our best efforts to keep our Privacy Policy fully up to date. If we make changes, these will be clearly and specifically identifiable, as far as possible within the relationship we have established with you (for example, we may notify you of changes by email).

This Privacy Policy was reviewed and published on 21 September 2026.