Privacy Policy

Controller: Experiens AI SL

Tax ID (NIF): B10628618

Registered address: Torrent d'en Vidalet 46, 2-1, 08012 Barcelona, Spain

Email: privacy@experiens.ai

Website: https://experiens.ai

Contact data (name, email, organisation, country, message, and the engagement type or referral source you select) when you use our contact form or email us.

Usage and technical data (IP address, device identifiers, browser type, pages visited, approximate location) when you browse the site.

Customer or prospect data (billing details) if you purchase services or request a quote.

We do not intentionally collect special categories of data (e.g., health, biometric, political opinions) unless you choose to share them in free text fields.

We process personal data to:

• Respond to inquiries and communicate with you. Where our contact form asks for your organisation, country, or how you heard about us, this information is used only to understand and route your inquiry appropriately, and is not used for any other purpose.
• Provide and manage our services, including onboarding, delivery, and support (if applicable).
• Operate, secure, and improve the website, including preventing abuse and spam (for example, through bot-detection technology on our contact form), debugging, and performance.
• Marketing communications (only if you subscribe or consent; you can opt out anytime).
• Legal compliance (e.g., accounting, tax, responding to lawful requests).

We rely on one or more of the following legal bases, depending on the context:

• Consent (newsletter subscription; non-essential cookies).
• Contract or steps prior to a contract (e.g., handling service requests).
• Legitimate interests (basic website security, preventing fraud and spam; minimal analytics where lawful).
• Legal obligation (tax/accounting retention).

We may disclose personal data in the following cases:

a) Legal and procedural obligations

We may disclose personal data to Courts and Tribunals, competent public administrations and authorities, Notaries and Public Registries, and Law Enforcement Authorities, where required or permitted by applicable law.

b) Service providers (Data Processors)

We engage trusted third-party service providers who process personal data on our behalf, including:

• Resend (transactional email delivery for contact form submissions)
• Cloudflare (bot detection and abuse prevention on our contact form, via Cloudflare Turnstile)
• Netlify (website hosting and infrastructure)
• Invoicing and payment gateway services
• Email and office productivity services
• IT security and technical support
• Electronic signature and videoconferencing services

This list reflects our main current service providers and may be updated as our service providers change; the categories of processing remain as described above. All such providers act strictly in accordance with our instructions and under a data processing agreement executed in compliance with Article 28 of the General Data Protection Regulation (GDPR).

If any provider is located outside the European Economic Area, we ensure appropriate safeguards (e.g., adequacy decision or Standard Contractual Clauses) before transferring personal data.

We retain personal data for the periods indicated below, depending on the purpose of processing. In all cases, data may be retained for longer where necessary to comply with legal obligations or for the establishment, exercise, or defence of legal claims.

a) Handling inquiries and information requests (contact form, email, or phone)

Data are retained for up to 12 months from the closure of the inquiry.

b) Management of professional relationships (clients and suppliers)

Including file opening, advisory services, related communications, invoicing, and collections: Data are retained for the duration of the relationship and, thereafter:

• 6 years for commercial and accounting purposes;
• Up to 10 years where anti-money laundering regulations apply.

c) Newsletter and informational communications

Data are retained until you unsubscribe or object to receiving communications.

d) Website security and maintenance

Including fraud prevention, detection of anomalous access, and service continuity: Data (e.g., IP address, device identifiers, technical logs) are retained for up to 12 months, or longer where required by applicable technical or legal obligations.

e) Recruitment processes (if you submit your CV)

CV and related contact data are retained for up to 24 months, or for the duration of the recruitment process, whichever is longer.

You can request:

• Access to your data
• Rectification
• Erasure
• Restriction
• Objection
• Data portability (where applicable)
• Withdraw consent at any time (where processing is based on consent)

To exercise rights, contact: privacy@experiens.ai.

Our website and services are directed at businesses and professionals, not at children. We do not knowingly collect personal data from individuals under the age of 16. If you believe a child has provided us with personal data, please contact us at privacy@experiens.ai so we can take appropriate action.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Spanish Data Protection Authority (AEPD) without undue delay and, where required by law, inform affected individuals.

If you believe your data protection rights have been infringed, you may lodge a complaint with the Spanish Data Protection Authority (AEPD).

We use appropriate technical and organisational measures designed to protect personal data (e.g., access controls, encryption where appropriate, backups, monitoring). No system is 100% secure, but we work to minimise risks.

Our website may use cookies and similar technologies. Where we use any cookies beyond those strictly necessary for the website to function, details of those cookies, their purpose, and how to manage your preferences are set out in our separate Cookie Policy.

We may update this Privacy Policy from time to time. The newest version will be published on this page with an updated "Last updated" date.