Privacy policy.

1. Who processes your data

2. What data we process and why

We only process data that you give us yourself, voluntarily, at one of these five points. We don't buy databases or collect your information from third parties.

2.1. Contact form

When you fill in the contact form we collect: your full name, company, email, phone number (optional), website (optional), what you need, the area or process you want to improve, the size of your company, the timeframe in which you want to move on it and the description of the case you write.

• Purpose: to read your case, assess whether there is a fit and reply with the next step.
• Legal basis: taking pre-contractual steps at your request (art. 6.1.b GDPR). You are the one who initiates contact by asking for a reply.
• Consequence of not providing it: the fields marked as mandatory are the minimum we need to reply to you; without them we cannot process the request.

2.2. AI assessment

The assessment page works in two steps:

• The process text. What you type in the box (or dictate by microphone, which is transcribed into text) is sent to a language model that generates automated guidance. That text and the assessment returned are recorded in our management system so we can review the quality of the service and improve it. Legal basis: legitimate interest in providing and improving the service you have requested (art. 6.1.f GDPR). We expressly ask you not to include third parties' personal data or confidential information there.
• Your contact details. To show you the assessment and email you a copy, we ask for your name, company, email and, optionally, phone number. If you also press "Please get in touch", we also process the phone number and the time slot you indicate. Legal basis: pre-contractual steps at your request (art. 6.1.b GDPR) and your consent to the copy being sent by email (art. 6.1.a GDPR).

About the audio: if you dictate the process, the recording is sent to our transcription service, converted into text and discarded. Reinicia does not store the audio file. What is kept (and what you can correct before sending it) is the transcribed text.

2.3. Registering for a seminar or event

When you book a place at one of our seminars (for example, the 3 October seminar, which has already taken place) we collect: your name, company, job title, company size, your work email and what you write about what your company does and what eats up your time. If you arrive from a personal invitation, we also store the code of that invitation, so we know where your registration came from.

• Purpose: to manage your place (confirm it, allocate it in order, keep the waiting list and free it up if you tell us you can't come), send you the emails for the event itself (confirmation, reminders and any last-minute changes) and organise the room and the lunch afterwards.
• Legal basis: carrying out what you ask for when you register (art. 6.1.b GDPR). The event emails are part of that management, they are not advertising, and that is why they reach you even if you haven't subscribed to anything.
• Double confirmation: the email we send you contains a link you have to click for the place to be booked. It serves to check that the address is yours and that nobody is signing someone else up. Legal basis: legitimate interest in registrations being genuine (art. 6.1.f GDPR).
• Why we ask for a work email: the seminar is for businesses and places are allocated on that basis, so the domain of your email is checked automatically when you submit the form. That does not decide anything about you within the meaning of article 22 GDPR: if you are self-employed and think it suits you, write to us at [email protected] and we'll look at it case by case.
• Consequence of not providing it: without that data we cannot book your place or let you know anything about the event.
• What we don't do: registering does not sign you up to any mailing list. If we want to write to you about anything else, we ask you separately (see section 2.6).

2.4. Email

If you write to us directly at [email protected], we process your address and the content of your message to deal with your enquiry and keep the thread of the conversation. Legal basis: pre-contractual steps or legitimate interest in replying to people who write to us (art. 6.1.b and 6.1.f GDPR).

2.5. Usage analytics and website security

• Analytics. We measure visits and aggregate use of the website with our own instance of Umami, hosted on our server. It does not use cookies, does not create profiles, does not track anyone across websites and does not store identifiable IP addresses: it only produces aggregate statistics (pages viewed, country, device type, source of the visit). Legal basis: legitimate interest in knowing whether the website is any use (art. 6.1.f GDPR). Details in the cookie policy.
• Security. The forms are protected with an anti-bot check (Cloudflare Turnstile) and with request limits per IP address. For that, your IP and technical data about the request are processed. Legal basis: legitimate interest in protecting the website against abuse and automated submissions (art. 6.1.f GDPR).

2.6. Marketing communications

Today the only mailing list on this website is the one for upcoming seminars: from the seminar page you can sign up for us to let you know when there is a new edition. Reinicia does not send a newsletter or other mass marketing communications. If it ever does, it will be with your prior, express and separate consent.

• What we collect: your name and email and, if you arrive from a personal invitation, the code of that invitation, so we know where your sign-up came from.
• Purpose: to let you know by email about upcoming editions of the seminar. When you sign up we also send you a single thank-you email.
• Legal basis: your consent, which you give by ticking the box on the form (art. 6.1.a GDPR and art. 21 LSSI).
• Unsubscribing: you can withdraw your consent whenever you like by replying to any of our emails or writing to [email protected]. Withdrawing it does not affect what we did before.
• Where it is stored: in our management tool (Notion) and, at the moment you sign up, in an internal messaging alert (Telegram) to the controller with your name and email.
• Consequence of not providing it: without your name and email we cannot let you know. It doesn't affect anything else.

3. Processing with artificial intelligence

This is an AI consultancy and it would be absurd not to say so clearly: part of what you write on this website is processed by a language model. Specifically:

• The text you describe in the assessment is sent to the OpenAI API, which generates the guidance you see on screen.
• If you dictate the process by voice, the audio is sent to OpenAI's transcription API (Whisper) to convert it into text.
• The case you write in the contact form is sent to the same API to summarise and classify it (type of need, urgency and fit), so that we can prioritise our reply.

This data is processed through the OpenAI API, which does not use it to train its models. Reinicia does not pass your information to any AI provider for that provider's own purposes.

There are no automated decisions with legal effects or that significantly affect you within the meaning of article 22 GDPR. The classification the model makes is an internal prioritisation aid: the person who reads your case, decides whether there is a fit and replies to you is a human being. The assessment you receive is for guidance only and does not by itself determine any decision about you.

4. Who else sees your data

We do not sell or pass on your data to third parties. We do work with providers that process it on our behalf (processors), with a signed data processing agreement and solely to provide their service to us:

In addition, your data may be disclosed to public authorities, judges and courts where there is a legal obligation, and to tax or accounting advisers if we end up having a business relationship and invoices need to be issued.

5. Transfers outside the EEA

Some of the providers above are established in the United States or process data outside the European Economic Area. These transfers are covered by the safeguards provided for in chapter V of the GDPR: the adequacy decision under the EU-U.S. Data Privacy Framework for providers that have signed up to it and, failing that, the standard contractual clauses approved by the European Commission together with the supplementary measures each provider documents.

In the case of the internal messaging alert, the information sent is a summary of your request (name, company and stated need) and its purpose is to let the controller deal with you without delay. If you would rather your request were not processed that way, write to us at [email protected] instead of using the form and we will handle it by email only.

You can ask us for information about the safeguards applied to any of these transfers by writing to [email protected].

6. How long we keep it

No "for as long as necessary". These are the periods:

Once the period has expired, the data is deleted or anonymised. In the meantime, you can ask us to delete it at any time (see the next section).

7. Your rights

The GDPR gives you a number of rights over your data, and exercising them is free of charge:

• Access: to know what data of yours we hold and obtain a copy.
• Rectification: to correct data that is inaccurate or incomplete.
• Erasure: to ask us to delete it when it is no longer necessary.
• Objection: to object to processing based on our legitimate interest, on grounds relating to your particular situation.
• Restriction: to ask us to keep it but stop using it while a complaint or a rectification is resolved.
• Portability: to receive the data you have provided to us in a structured, commonly used format, or have us send it to another controller.
• Withdrawing consent at any time, where the processing is based on it, without affecting the lawfulness of processing carried out before it was withdrawn.

To exercise them, write to [email protected] stating which right you wish to exercise. We may ask you to prove your identity if there is reasonable doubt about who is making the request. We will reply within one month, which may be extended to two if the request is complex.

If you believe we have not dealt properly with your request, or that we are processing your data improperly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. Before that, if you like, write to us: it can usually be sorted out by talking.

8. Security

We apply technical and organisational measures proportionate to the risk: the website is served entirely over HTTPS, the forms go through an anti-bot check and request limits, the systems that process submissions are not publicly accessible and the credentials for the services are kept separate from the code and from this website.

No system is infallible. If there were a security breach posing a high risk to your rights, we would notify you without undue delay, and the AEPD where appropriate.

For your part, we ask one specific thing of you: do not send passwords, third-party data, confidential information or sensitive documents through these forms. To review a case, understanding the process is enough for us.

9. Minors

This website is aimed at professionals and businesses, not at minors, and we do not offer our services to minors. Under article 7 of Spanish Organic Law 3/2018 (LOPDGDD), processing of data based on consent is only valid on its own from the age of 14; below that age, the authorisation of the person with parental authority or guardianship is required. If we find that we have received data from a minor without that authorisation, we will delete it.

10. Changes to this policy

We will update this policy when the processing, the providers or the applicable regulations change. The version in force is always the one published on this page, with its last updated date at the top. If the change is substantial and affects processing based on your consent, we will let you know.