1. Information for users

1.0. Who is the controller of your personal data?

Aivora Solutions S.L. is the CONTROLLER of the USER’s personal data and informs the USER that such data will be processed in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Spanish Organic Law 3/2018 of 5 December (LOPDGDD).

1.1. Why do we process your personal data?

To maintain a business relationship with the user. The processing operations envisaged are:

• Sending commercial and advertising communications by email, fax, SMS, MMS, social media or any other electronic or physical means, present or future, that enables commercial communications. These communications will be sent by the CONTROLLER and will relate to its products and services, or to those of its partners or suppliers with which it has entered into a promotional agreement. In such cases, third parties will never have access to the personal data.
• Carrying out market research and statistical analysis.
• Handling orders and requests, and responding to enquiries or any other request made by the USER through any of the contact methods available on the CONTROLLER’s website.
• Sending the online newsletter with news, offers and promotions relating to our business.

1.2. On what basis may we process your personal data?

Processing is lawful under Article 6 GDPR as follows:

• With the USER’s consent: sending commercial communications and the newsletter.
• On the basis of the CONTROLLER’s legitimate interest: carrying out market research, statistical analysis, etc., and handling orders, requests, etc. at the USER’s request.

1.3. How long will we keep your personal data?

Personal data will be kept for no longer than necessary to fulfil the purpose of the processing or for as long as legal obligations require their retention. Once no longer needed, they will be erased using appropriate security measures to ensure the anonymisation of the data or their complete destruction.

1.4. Who do we share your personal data with?

No disclosure of personal data to third parties is envisaged except, where necessary to carry out the purposes of the processing, to our communications-related service providers, with which the CONTROLLER has entered into the confidentiality and data processing agreements required by applicable privacy legislation.

1.5. What are your rights?

The USER has the following rights:

• The right to withdraw consent at any time.
• The right of access, rectification, portability and erasure of their data, and the right to restrict or object to its processing.
• The right to lodge a complaint with the supervisory authority (www.aepd.es), or with the supervisory authority of the Member State of their habitual residence, if they consider that the processing does not comply with applicable law.

1.6. Contact details for exercising your rights:

Aivora Solutions S.L. Calle Santa María Magdalena, 10-12, 28016 Madrid (Spain). Email: rsgsi@aivora.ai

1.7. How can you request deletion of your account and personal data?

The Aivora app is a professional tool. Accounts cannot be created through open sign-up, nor can they be created or removed directly by the dealership: Aivora creates and deletes them at the request of the company that subscribes to the service, for its authorised staff. This section covers the deletion of that user account and the personal data associated with it.

How to request deletion

1. Send an email to rsgsi@aivora.ai with the subject “Account deletion request”.
2. Provide your full name, the email address you use to sign in to the app, and the dealership or group you belong to.
3. We will verify your identity before processing the request, to prevent unauthorised deletions. We may ask you for additional information solely for that purpose.
4. As your account is part of the service contracted by your employer, and user accounts are created and removed at their request, we will notify the contact person designated by the dealership before we remove your access. This notification is limited to what is strictly necessary and does not suspend the response period.
5. We will confirm in writing that the deletion has been carried out within one month of receiving your request, in accordance with Article 12(3) GDPR. This period may be extended by a further two months where the request is particularly complex, in which case we will inform you of the reason.

What is deleted: your user account and profile, your login credentials, your professional contact details, your settings, and the identifiers and usage data associated with your account. Deletion is propagated to the backups of our production databases within a maximum of 7 days, corresponding to the retention period configured in Google Cloud. Call recordings and stored documents are erased in accordance with the periods set out below.

What is not deleted through this procedure: the app is used to manage the relationship between the dealership and its customers. The records of that activity — tasks, calls and their recordings, conversations and documents provided by customers — are data that Aivora processes on behalf of the dealership, which is the controller. Deleting your account does not erase those records, even though your name may appear in them as the agent who handled them. Their erasure is governed by the data processing agreement entered into with the dealership and is carried out on the dealership’s instructions or when the service ends.

What is retained and for how long: we will keep the following data blocked, meaning restricted and accessible only at the request of a competent authority or for the establishment or defence of legal claims: (i) the record of your request and its resolution, as evidence of compliance, for 5 years; and (ii) access and activity logs, for the period required by our information security obligations and in accordance with the retention periods set out in our information security management system. If you are also a contractual or billing contact for the dealership, we will retain accounting and billing records for 6 years (Article 30 of the Spanish Commercial Code) and tax-relevant information for 4 years (Article 66 of the Spanish General Taxation Act, Law 58/2003). Once these periods expire, the data are erased.

If you are a dealership customer rather than an app user: you do not have an Aivora account. Please address your erasure request to the dealership you deal with, which is the controller of your data; Aivora will assist it in its capacity as processor.

2. Mandatory or optional nature of the information provided by the user

By ticking the relevant boxes and entering data in the fields marked with an asterisk (*) in the contact form or download forms, USERS expressly, freely and unambiguously accept that their data are necessary for the provider to handle their request, while providing data in the remaining fields is optional. The USER warrants that the personal data provided to the CONTROLLER are accurate and is responsible for notifying any changes to them.

The CONTROLLER informs USERS that all data requested through the website are mandatory, as they are necessary to provide an optimal service. If not all data are provided, the information and services provided may not be fully tailored to the USER’s needs.

3. Security measures

In accordance with applicable personal data protection legislation, the CONTROLLER complies with all provisions of the GDPR and the LOPDGDD in processing the personal data for which it is responsible, and in particular with the principles set out in Article 5 GDPR, under which data are processed lawfully, fairly and transparently in relation to the data subject and are adequate, relevant and limited to what is necessary for the purposes for which they are processed.

The CONTROLLER warrants that it has implemented appropriate technical and organisational policies to apply the security measures required by the GDPR and the LOPDGDD in order to protect the rights and freedoms of USERS, and has provided them with appropriate information to enable them to exercise those rights.

For further information on privacy safeguards, you can contact the CONTROLLER at Aivora Solutions S.L., Calle Santa María Magdalena, 10-12, 28016 Madrid (Spain). Email: rsgsi@aivora.ai