Privacy Policy

1. INTRODUCTION

At Solneko, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of personal data (GDPR), and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), we inform data subjects about the processing of their personal data through this Privacy Policy.

This policy applies to persons who interact with the Provider as business clients contracting the chatbot Service. The processing of the data of the end users of such clients is governed by the Data Processing Agreement (DPA) signed between the Provider and each business client.

2. DATA CONTROLLER

The controller responsible for the processing of personal data is the holder of the Solneko service. To avoid duplication, the full legal identification and contact details of the controller are provided in Section 11 (Contact) at the end of this document.

3. DATA PROCESSED AND PURPOSES

The Provider processes personal data from two distinct sources:

3.1. Business client data (contracting controllers)

This refers to the data of the contact persons at the companies that contract the Service.

Data processed:

First and last name of the contact person
Professional email address
Contact telephone number
Company data (name, tax ID, address)
Billing data

Purposes:

Management of the contractual relationship and provision of the Service
Issuing invoices and managing collections
Communications related to the Service (support, notices, updates)
Compliance with legal and tax obligations

Legal basis:

Performance of a contract (Art. 6(1)(b) GDPR)
Compliance with legal obligations, in particular tax obligations (Art. 6(1)(c) GDPR)
Legitimate interest for communications related to the contracted Service (Art. 6(1)(f) GDPR)

Retention period:

Data will be retained for the duration of the contractual relationship and, once it has ended, for the legally required periods: 4 years for tax obligations (Spanish General Tax Law), 6 years for commercial documentation (Spanish Commercial Code).

3.2. Data of the chatbot's end users (customers of our clients)

When the Provider's chatbot is deployed by a business client to serve its own end users, those end users may enter personal data in the conversations (name, queries, incidents, etc.).

In this case:

The business client acts as controller of such data.
The Provider acts as processor, processing the data solely on behalf of and in accordance with the instructions of the business client.
The conditions of this processing are governed by the Data Processing Agreement (DPA) signed between both parties.

Important: The Provider does not use end users' conversation data for any purpose of its own, except as expressly authorized by the business client in the DPA.

4. INTERNATIONAL DATA TRANSFERS

To generate chatbot responses, the Provider uses the service of OpenAI, LLC (United States), a provider of artificial intelligence language models.

This entails an international transfer of data to a third country (the USA) of the data entered in chatbot conversations by end users.

This transfer is carried out under the following safeguards:

OpenAI, LLC is subject to the Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Art. 46(2)(c) GDPR.
OpenAI has its own Data Processing Agreement (DPA) that governs data processing in its capacity as processor.

The Provider has signed or accepts OpenAI's DPA in its own name and, in its capacity as processor with respect to its business clients, includes this sub-processing arrangement in the DPA agreed with each client.

For more information on OpenAI's safeguards: https://openai.com/policies/privacy-policy

Should other AI providers or third-party tools involving data transfers be incorporated, the Provider will update this section and inform affected clients.

5. RECIPIENTS AND DISCLOSURE OF DATA

The personal data of business clients will not be disclosed to third parties, except in the following cases:

Legal obligation: when required by competent authorities (Tax Agency, courts, etc.)
Essential service providers: the Provider may share data with technology providers (hosting, electronic invoicing, etc.) that act as processors and with whom the corresponding confidentiality and data processing agreements have been signed.

The Provider does not sell or disclose personal data to third parties for commercial purposes.

6. RIGHTS OF DATA SUBJECTS

Persons whose data are processed by the Provider as controller (i.e., the contacts of business clients) may exercise the following rights:

Access: to know what data are being processed
Rectification: to correct inaccurate or incomplete data
Erasure: to request deletion of data when no longer necessary
Restriction of processing: to request restriction of processing in certain circumstances
Portability: to receive data in a structured, commonly used format
Objection: to object to processing based on legitimate interest

To exercise any of these rights, the data subject must send a written request to:

solneko@solneko.es, indicating "Exercise of GDPR rights" in the subject line and attaching a copy of an identity document.

The Provider will respond within a maximum period of one month from receipt of the request, which may be extended to three months in complex cases.

Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), via its website www.aepd.es.

7. SECURITY MEASURES

The Provider has adopted the necessary technical and organizational measures to guarantee the security of personal data and to prevent its alteration, loss, unauthorized processing or access, taking into account the state of the art, the nature of the data stored and the risks to which they are exposed.

Measures applied include, among others:

Encryption of communications through secure protocols (TLS/HTTPS)
Role-based access control and secure authentication
Use of hosting and storage providers with recognized security certifications
Periodic review of implemented security measures

8. COOKIES AND TRACKING TECHNOLOGIES

If the Service or the Provider's website uses cookies or other tracking technologies, the user will be informed via the corresponding Cookie Policy, which will be shown prominently when accessing the website or the Service's management platform.

9. MINORS

The Service is aimed exclusively at businesses and professionals. The Provider does not knowingly collect or process personal data of minors under 14 years of age. If it is detected that data of a minor has been collected, it will be deleted immediately.

10. CHANGES TO THE PRIVACY POLICY

The Provider reserves the right to modify this Privacy Policy to adapt it to legislative, case-law or business changes. Any material modification will be communicated to business clients by email or via notice on the Service platform, with at least 15 days' notice.

11. CONTACT

For any query relating to the processing of your personal data:

Eloy Garrido Castro

Trade name: Solneko

Privacy email: solneko@solneko.es

Address: c/ de la Danza, 25, Mairena del Aljarafe, Spain

Phone: 644 66 10 42

Version 1.0 | Last updated: April 4, 2026