Privacy Policy

Privacy policy

This policy explains what we do with the personal data we collect through this website. If you use the VES platform because your organisation has subscribed to it, the processing of your data is governed by the VES platform privacy policy, not by this one.

Who the controller is

What we process, why and on what legal basis

1. Demo requests and contact

Data: first name and surname, company or entity, job title, phone number, email address, sector, main need, approximate volume and the description of your case that you send us. Also the IP address and the browser you send the form from, and the source of the link you arrived through.

Purpose: to handle your request, prepare the demo and get in touch with you.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). If you also tick the marketing communications box, those messages are based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Retention: 12 months from our last contact, unless the relationship leads to a contract, in which case we keep the data for as long as the relationship lasts and for the applicable limitation periods.

Do you have to give us this data? The fields marked as required on the form are the ones we need in order to help you; if you do not provide them, we will not be able to prepare the demo or get in touch with you. Everything else is optional and only helps us fine-tune our reply.

2. The VES assistant

Data: the questions you type, the answers you receive, your truncated IP address (before storing it we remove its last block, so it cannot be traced back to your device; even so, we still treat it as personal data) and the page you ask from.

There are two separate processing activities here, and it is worth keeping them apart, because they do not depend on the same thing:

a) Answering your questions. The basis is your consent when you start the conversation (Art. 6(1)(a) GDPR). You can withdraw it whenever you like by closing the assistant and asking us to delete the conversation; if you withdraw it, we stop processing your questions for this purpose.

b) Keeping the service available and protected against abuse. The basis is our legitimate interest (Art. 6(1)(f) GDPR), and it covers only the technical logs needed to detect automated or abusive use. This processing does not depend on your consent, and it does not replace it.

Retention: 12 months in both cases, unless you ask us to delete the conversation sooner.

Important: the text of your questions is sent to OpenAI, Ireland Ltd., which acts as a processor in order to generate the answer. This may involve an international transfer to the United States, covered by the European Commission’s standard contractual clauses. OpenAI does not use this data to train its models, under the terms of its service for businesses.

Even so, the assistant is a general enquiry channel: do not type health data, other people’s personal data or confidential information about your organisation into it.

3. Browsing and measurement

Data: the data collected by the cookies and similar technologies you accept. You can review them and change your choice in the Cookie policy.

Purpose: to find out, in aggregate form, which pages are visited and how people move through them, so that we can decide what to improve. We do not build profiles and we do not take automated decisions about you.

Legal basis: your consent (Art. 6(1)(a) GDPR). Without it, no measurement cookie is activated.

Retention: measurement data is kept for 14 months in Google Analytics 4; the cookies are kept for the period stated for each of them in the Cookie policy.

4. Site security

Data: access logs, failed authentication attempts and IP addresses.

Purpose: to detect and stop unauthorised access and automated attacks.

Legal basis: our legitimate interest in protecting the site and the people who use it (Art. 6(1)(f) GDPR), and compliance with the security measures required of us by the Esquema Nacional de Seguridad (Spain’s National Security Framework).

Retention: 12 months.

5. Protection against automated submissions

To keep the form from filling up with junk sent by automated programs, the site uses Google reCAPTCHA v3. It works without asking you to solve anything: it analyses how the browser behaves and returns a score that tells us whether the request looks human.

Data: your IP address, information about your browser and device, and your interaction with the page. Google collects and processes it.

Purpose: to tell a person from an automated program and to prevent mass form submissions.

Legal basis: our legitimate interest in protecting the form and the mailbox it reaches (Art. 6(1)(f) GDPR).

Who processes it: Google Ireland Ltd., which may transfer data to the United States under the European Commission’s standard contractual clauses. You can read their privacy policy and their terms of service.

You should know this precisely: reCAPTCHA only loads on the page with the form. If you browse the rest of the site, it does not run and Google receives nothing. Because of the way it works, on that page it runs without waiting for you to accept cookies, since it relies not on your consent but on the legitimate interest described above.

If you would rather avoid it altogether, write to us at ves@rklintegral.com instead of using the form.

Who else has access to your data

We do not sell or disclose your data. We do work with suppliers that process it on our behalf, each under a signed data processing agreement:

• The website hosting provider, in the European Union.
• Amazon Web Services (Amazon SES), to send the emails generated by the form.
• OpenAI, Ireland Ltd., to generate the assistant’s answers.
• Google Ireland Ltd., in two different roles: audience measurement, only if you accept the corresponding cookies, and protection of the form through reCAPTCHA, which does not depend on your consent.

Some of these providers may process data outside the European Economic Area. In those cases the transfer relies on the standard contractual clauses approved by the European Commission or on an adequacy decision.

We may also disclose data to public authorities where the law requires us to do so.

Your rights

You can exercise at any time your rights of access, rectification, erasure, restriction of processing, portability and objection, and withdraw any consent you have given us, without that withdrawal affecting the processing carried out beforehand.

To exercise them, write to us at ves@rklintegral.com or by post to the address above, stating which right you want to exercise. We will reply within one month, which may be extended by a further two months if the request is particularly complex, on the terms of Art. 12(3) GDPR; if we needed that extension, we would tell you within the first month and explain why.

We will only ask you for an identity document if we have reasonable doubts about your identity, and if we do, we will tell you why.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).

Children

This site is aimed at professionals and is not intended for children under 14. We do not knowingly collect their data. If you notice that a child has given us data, write to us and we will delete it.

Security

We apply the technical and organisational measures required by the GDPR and by the Esquema Nacional de Seguridad, under which RKL Integral is certified at medium category. No security measure is infallible, but we review ours regularly.

Changes to this policy

If we change this policy we will publish the new version here with its date. Changes that substantially affect your rights will be communicated to you by an appropriate means.

Last updated: 17 September 2026.