Privacy Policy

Last update: 01/06/2025

At xevicases.com, managed by Xevi Cases AI Solutions, SL (hereinafter, "we", "our" or "the Owner"), we are committed to protecting your privacy and personal data. This Privacy Policy aims to inform you clearly and transparently about what personal data we collect, how we process it, for what purpose, and what your rights are, in accordance with the EU General Data Protection Regulation (GDPR) and applicable Spanish legislation.

1. Who is responsible for processing your data?

Owner and Controller: Xevi Cases AI Solutions, SL
Email: hola@xevicases.com
Website: https://xevicases.com

2. What personal data do we collect and how do we obtain it?

We collect personal data in various ways depending on your interaction with our website and services:

Data you provide directly:
- When you contact us via contact form, email, or other means: name, surname, email address, phone number (if provided), and the content of your message or inquiry.
- When you subscribe to our newsletter (if available): email address.
- When you hire our services: data needed for contractual and billing management (name, tax ID, address, banking details if applicable).
Data collected automatically while browsing:
- Technical information about your device and internet connection: IP address, browser type and version, operating system, internet service provider.
- Usage data from the website: visited pages, time spent, clicked links, search terms. This data is primarily collected via cookies. For more details, see our Cookies Policy.

We do not collect special categories of personal data (sensitive data) unless you provide it voluntarily and it is strictly necessary to deliver a requested service.

3. For what purpose do we process your personal data?

Your personal data will be processed for the following purposes:

To manage and respond to your inquiries, requests for information, or proposals received through the contact channels provided.
To deliver the services you have contracted and carry out the related administrative, accounting, and tax management.
To send you commercial and informative communications about our services, news, blog articles, or events (newsletters), provided that you have given us your explicit consent. You can revoke this consent at any time.
To improve our website and user experience, through navigation and usage analysis (generally aggregated and anonymized).
To ensure website security and prevent fraud or unlawful activities.
To comply with our legal obligations.

4. What is the legal basis for processing your data?

The legal basis that allows us to process your personal data depends on the purpose for which we collect it:

Your consent: To respond to your inquiries when you contact us, to send you commercial communications (newsletter), or for the use of certain cookies. You can withdraw your consent at any time.
Performance of a contract or pre-contractual measures: When you contract our services or request a proposal, processing your data is necessary to manage that relationship.
Compliance with a legal obligation: In some cases, we must process your data to comply with applicable regulations (e.g., tax obligations).
Our legitimate interest: For purposes such as improving our services, analyzing website usage (in aggregate form), or ensuring security, provided that your rights and freedoms do not override our interest.

5. Who do we share your personal data with?

As a general rule, we will not share your personal data with third parties without your consent, except in the following cases:

Service providers (data processors): We may share your data with third parties who provide us with services and need access to your data for this purpose (e.g., hosting providers, email and newsletter services, web analytics tools, accounting/tax advisors). These providers act as data processors under our instructions and with contracts that ensure the protection of your data.
Competent public authorities: When a law or legal procedure requires us to do so (e.g., Tax Agency, law enforcement, judicial authorities).

As a general rule, we will not share your personal data with third parties without your consent, except in the following cases:

6. How long will we retain your data?

We will retain your personal data only as long as necessary to fulfill the purposes for which it was collected, and afterwards, during the legal limitation periods for potential liabilities.

Data for managing inquiries will be kept as long as necessary to respond to them.
Data related to service contracts will be retained for the duration of the contractual relationship and, once ended, for the legally required periods (e.g., 6 years for commercial documentation, 5 years for tax purposes).
Data used for sending commercial communications will be kept until you revoke your consent.
Browsing and cookie data will be retained as indicated in our Cookies Policy.

7. What are your rights regarding your personal data?

As the data subject, you have the following rights, which you may exercise at any time:

Right of access: Request information about whether we are processing your personal data and, if so, access it.
Right to rectification: Request correction of your data if it is inaccurate or incomplete.
Right to erasure ("right to be forgotten"): Request deletion of your data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
Right to restriction of processing: Request that the processing of your data be suspended in certain circumstances (e.g., if you contest its accuracy).
Right to data portability: Receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller in certain cases.
Right to object: Object to the processing of your data for reasons related to your particular situation. In particular, you can object at any time to the processing of your data for direct marketing purposes.
Right not to be subject to automated individual decisions: Including profiling, which produces legal effects concerning you or significantly affects you in a similar way. (Note: Specify if you perform such processing).

To exercise these rights, you can send a written request, attaching a copy of your ID or equivalent identification document, to the email address hola@xevicases.com, clearly indicating which right you wish to exercise.

If you believe your rights have not been adequately addressed, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD) or the competent supervisory authority.

8. Security Measures

We have adopted the necessary technical and organizational measures to ensure an appropriate level of security for the risk associated with the processing of personal data, with the aim of preventing accidental or unlawful destruction, loss, or alteration, or unauthorized disclosure or access.

See also section 11 for specific details on sensitive data protection and automated systems.

9. Accuracy and Truthfulness of Data

The user guarantees that the personal data provided is true and accurate and undertakes to notify any modification or update thereof.

10. Use of Google Services and Data Access

This website and associated systems (such as the integrated chatbot and process automations) may use Google Workspace APIs, including but not limited to Google Drive, Google Docs, Google Sheets, and Google Calendar.

This access is used exclusively to provide functionalities such as automatic quote generation, consultation of previously stored data, calendar management, and other personalized services that enhance the user experience and optimize internal processes.

In accordance with the Google API Services User Data Policy, we guarantee that:

It is important to clarify that the OAuth permissions requested by this application allow access exclusively to resources and files managed by the system owner. At no point are credentials or permissions requested to access data from end users' personal Google accounts.

Access is granted only when strictly necessary for the requested functionality.
These data are not used to train generalized artificial intelligence models.
Access is limited to system-managed personal files and information is not shared between users.
We fully comply with Google’s 'Limited Use' policy requirements.

The use and transfer of information obtained from Google APIs by this application complies with the Google API Services User Data Policy, including the 'Limited Use' requirements.

11. Protection of sensitive personal data

This website and its associated systems may process sensitive personal data such as name, email address, phone number, postal address, or tax ID (NIF), as long as it is provided by users for the management of quotes, communications, or automation flows.

This data is never obtained from users' Google accounts, but only through their direct interaction with forms or bots controlled by the system.

To ensure the protection of personal data:

Access to data is limited to automated systems that comply with the defined permissions and is restricted to specific files in Google Drive.
Sensitive data is not stored outside the Drive system nor are internal databases with user information maintained.
Automation flows are designed to access only the information strictly necessary to fulfill the requested functionality.
Logging is implemented to trace the use of such data and improve transparency.
No data is shared with third parties or used to train any artificial intelligence model.
All information is handled with the same level of security, regardless of its origin.

12. Changes to the Privacy Policy

We reserve the right to modify this Privacy Policy to adapt it to legislative or jurisprudential developments, as well as industry practices. In such cases, we will announce the changes on this page with reasonable advance notice before they are implemented. We recommend that you review this policy periodically.