Privacy policy

1. Data controller

The controller of the personal data collected through this site is:

Company name

Aymar Innovations, S.L.

Tax ID

B26770594

Postal address

Avda. Inmaculada Concepción 39, Portal 3, 4º B, 29631 Benalmádena (Málaga), Spain

Email

admin@aymaragents.com

Phone

+34 603 293 908

When we deal with the end customers of our customers (companies that subscribe to the Aymar Agents platform), our role is different: we are processors, not controllers. This distinction is explained in section 7.

2. Purposes of processing

We process the personal data you provide for the following purposes:

• Attending to enquiries, demo requests and communications sent through the contact form.
• Sending commercial communications about our products and services, only when you have given express consent.
• Complying with applicable legal obligations.
• Managing the sign-up, access, use and billing of the Aymar Agents platform by the companies that subscribe to it and their authorised users.
• Operating, on behalf of those companies, the artificial intelligence conversational agents they subscribe to (acting as processors with respect to the data of their end customers — see section 7).

3. Legal basis

The legal basis for processing your data is the consent you give when sending the contact form and, where applicable, by ticking the specific box to receive commercial communications (Article 6.1.a of the General Data Protection Regulation).

When you subscribe to the platform as a business customer, the additional legal basis is performance of the service agreement (Article 6.1.b of the General Data Protection Regulation). When we act as processors (section 7), the legal basis for the processing is determined by our customer in its own relationship with its end customers.

4. Categories of data processed

We process the following categories of personal data:

• Identifying data: first and last name.
• Contact data: email address and, optionally, phone number.
• Professional data: company or sector, team size and CRM used, when you provide them in the form.
• Content of your messages and any other information you choose to provide voluntarily.
• Account and platform usage data (access credentials, activity logs, service configuration) when you are a customer or authorised user of Aymar Agents.
• Billing data, handled directly by our payment provider (see section 6).

5. Retention period

Retention periods depend on the type of data and your relationship with us:

• Enquiries and contact form: for as long as necessary to attend to your request and, thereafter, for the legally required periods to address any liabilities arising from the processing.
• Data of the end customers of our customers (for example, if you have written to the WhatsApp assistant of a company using Aymar Agents): for as long as that company's account remains active. You can request the erasure of your data at any time (section 8); when we execute it, we effectively delete your conversations, messages and attachments, and anonymise the records that must be kept for statistical purposes.
• Termination of a business customer: when a company stops using the platform, we keep its data and that of its end customers for a 30-day grace period (in case the termination was accidental) and, after that period, we effectively delete it from our databases and storage systems.
• Internal security audit logs: 90 days, deleted automatically.
• Orphaned attachment files (incomplete or abandoned uploads): deleted automatically in a periodic sweep, with a minimum safety window of 48 hours.

6. Recipients and data processors

We do not disclose your data to third parties except where legally required. To provide our services, we rely on the following providers, which act as processors (or, where applicable, as independent controllers of payment data). Their specific involvement depends on whether you visit us as a website user or subscribe to the Aymar Agents platform as a customer:

International transfers: several of these providers process data outside the European Economic Area, mainly in the United States and, in DeepSeek's case, in China. For transfers to the United States we rely, depending on the provider, on its adherence to the EU-US Data Privacy Framework and/or standard contractual clauses approved by the European Commission. China does not have a European Commission adequacy decision, so the transfer to DeepSeek requires reinforced standard contractual clauses with supplementary measures; this point is flagged for the pending legal review (see the notice at the top of this page).

7. Dual role: controller and processor

Aymar Innovations, S.L. plays two different roles depending on the data in question. As a controller, we decide how and why we process the data of people who visit this website and the data of the companies that subscribe to the platform and their authorised users — this is the role described in the rest of this policy.

As a processor, we process the data of those companies' end customers (the people who write to their conversational agents) solely on their documented instructions, set out in a data processing agreement under Article 28 of the General Data Protection Regulation. That agreement is available, in draft form, on our Data Processing Agreement page.

Those messages flow through different channels, depending on the one each end customer uses: the WhatsApp Business Platform, Messenger and Instagram Direct (via Meta), Telegram, and the chat widget embedded in the customer's own website.

8. Rights of the data subject

You can exercise the following rights granted by the General Data Protection Regulation (Articles 15 to 22) at any time:

• Access to your personal data.
• Rectification of inaccurate or incomplete data.
• Erasure of data when it is no longer needed.
• Restriction of processing in the cases provided by law.
• Objection to processing on grounds relating to your particular situation.
• Portability of the data in a structured, commonly used format.

If you are an end customer of a company using Aymar Agents (for example, if you have spoken with its WhatsApp, Telegram or website widget assistant), you can exercise these rights directly with that company, which is the controller of your data, or with us as processor. In the latter case, when the platform allows it directly — as with the erasure of your data — we carry it out ourselves; in other cases, we forward your request to the controller company.

9. Exercising your rights and supervisory authority

To exercise any of these rights you can write to the email address indicated at the top, proving your identity. If you consider that the processing of your data does not comply with current regulations, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.