PRIVACY POLICY

1. Purpose and scope of application

This Privacy Policy governs the processing of personal data carried out by JA2E Consulting through the website ja2e.com (hereinafter, the "Website"), as well as the processing arising from inquiries, requests for information, assessment requests, professional communications, proposals, quotes, pre-contractual actions, and professional relationships initiated through it.

This Policy is intended to provide transparent information about:

what personal data JA2E may process;
for what purposes;
on what legal bases;
for how long;
who may have access to it;
what international transfers may occur; and
what rights are available to data subjects.

Processing will be carried out in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights ("LOPDGDD"), Law 34/2002 on Information Society Services and Electronic Commerce ("LSSI-CE"), and other applicable regulations.

This Policy must be interpreted together with the Legal Notice and Terms of Use and the Cookie Policy.

2. Data controller

The data controller is:

Controller: José Atué Belmonte

Trade name: JA2E Consulting

Tax ID (NIF): 49194050V

Registered/professional address: Jaume Vicens Vives, 83, 08302, Spain

Email: jatue@ja2e.com

Website: https://www.ja2e.com

Hereinafter, "JA2E".

Inquiries relating to privacy and data protection, as well as requests to exercise rights, may be sent to jatue@ja2e.com.

3. Principles applicable to processing

JA2E will process personal data in accordance with the principles of:

lawfulness, fairness, and transparency;
purpose limitation;
data minimization;
accuracy;
storage limitation;
integrity and confidentiality; and
proactive accountability.

JA2E will endeavor to process only data that is adequate, relevant, and necessary for each purpose, and will avoid further use for purposes incompatible with those for which it was obtained.

4. Categories of data processed

The specific categories will depend on the relationship maintained with each data subject.

4.1. Data provided through forms

When a user completes a Website form, the following may be processed:

Identification data:

first and last name.

Contact data:

email address;
telephone number, when provided.

Professional data:

company or organization;
job title or professional role, where applicable.

Data relating to the inquiry:

needs expressed;
information relating to the project or service;
content entered in text fields;
any other information voluntarily provided that is relevant to handling the request.

4.2. Subsequent communications

When the data subject subsequently communicates with JA2E by email, telephone, videoconference, or other channels, the following may be processed:

identity;
contact details;
organization represented;
professional role;
content of the communications;
dates and times;
needs expressed;
proposals or quotes;
documentation provided;
information necessary to manage the potential professional relationship.

4.3. Technical information

Use of the Website may generate certain technical data related to its provision, operation, and security, such as:

IP address;
browser;
device type;
operating system;
date and time;
information relating to technical requests;
information necessary to prevent fraud, spam, abuse, or malicious activity.

The use of cookies and technologies for storing or accessing information on the device is specifically regulated in the Cookie Policy.

5. Special categories and unnecessary data

JA2E's general forms are not designed to receive special categories of personal data.

Users should refrain from including, unless strictly necessary and an appropriate legal basis exists:

health data;
racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade union membership;
genetic data;
biometric data intended to uniquely identify a person;
information relating to sex life or sexual orientation.

The following should also not be sent through general forms:

passwords;
credentials;
full card numbers;
unnecessary confidential documentation;
unnecessary trade secrets; or
personal data of third parties that is not relevant.

If JA2E accidentally receives information of this nature that is not necessary to handle the request, it may delete it or adopt other appropriate minimization measures.

6. Source of the data

Generally, the data is provided directly by the data subject when they:

complete a form;
send an email;
make contact by telephone;
request information;
request an assessment;
request a proposal or quote;
initiate discussions aimed at a possible contract; or
subsequently maintain a professional relationship with JA2E.

Certain technical information may be generated automatically as a result of using the Website.

When a person makes contact on behalf of a company or organization, the professional data necessary to identify their role and manage the relationship with that entity may be processed.

Where, exceptionally, personal data is obtained from sources other than the data subject and Article 14 GDPR applies, JA2E will provide the legally required information within the corresponding time limits, unless an exception provided for in the applicable regulations applies.

7. Purposes and legal bases

The legal basis will depend on the specific purpose of the processing.

7.1. Handling general inquiries

JA2E may process data to:

receive and analyze inquiries;
respond to the data subject;
provide information;
understand the needs raised;
maintain the necessary communications; and
arrange meetings or calls.

Where there is not yet a pre-contractual request, the legal basis will be JA2E's legitimate interest in responding to communications voluntarily directed to the organization and in appropriately managing its professional relationships, in accordance with Article 6.1(f) GDPR.

7.2. Requests for assessments, proposals, quotes, or services

When a person contacts JA2E to consider a possible engagement, or to request an assessment, a proposal, a quote, or the definition of a project, the data may be used to:

analyze requirements;
assess feasibility;
prepare proposals;
prepare quotes;
define scope;
determine methodology;
estimate resources and planning;
hold preliminary meetings;
negotiate terms; and
take other steps requested prior to a possible engagement.

The legal basis will be the implementation of pre-contractual measures at the request of the data subject, in accordance with Article 6.1(b) GDPR.

7.3. Contractual relationships

Once a contract is formalized, JA2E may process the data necessary to:

provide the services;
administer the project;
maintain operational communications;
coordinate meetings;
manage deliverables;
issue invoices;
manage payments; and
demonstrate compliance with contractual obligations.

The legal basis will be the performance of the contract, in accordance with Article 6.1(b) GDPR.

Processing necessary to comply with tax, accounting, or other legal obligations will be based, where applicable, on Article 6.1(c) GDPR.

7.4. B2B relationships and professional contacts

Where the data subject acts as an employee, director, representative, collaborator, or contact person of a company or organization, JA2E may process their professional data in order to maintain and manage relationships with that entity.

The legal basis will be legitimate interest, in accordance with Article 6.1(f) GDPR and Article 19 LOPDGDD.

7.5. Security and prevention of unlawful use

JA2E may process technical information to:

protect its systems;
prevent unauthorized access;
prevent spam;
detect fraud;
identify malicious activity;
investigate incidents;
prevent abusive use; and
retain technical evidence when necessary.

The legal basis will be JA2E's legitimate interest in ensuring the security and lawful use of its systems and services, in accordance with Article 6.1(f) GDPR, without prejudice to any applicable legal obligations.

7.6. Measurement and improvement of the Website

JA2E may use statistical and technical information to:

understand the general operation of the Website;
measure its use;
analyze performance;
detect errors;
improve content;
optimize navigation and user experience.

The Website currently uses Framer's built-in analytics features.

According to the provider's current documentation, Framer Analytics does not use cookies or persistent identifiers. To calculate daily unique visitors, Framer technically uses the IP address and certain browser information together with a secret element that is renewed daily; the results provided in the analytics panel are presented in anonymized form and do not allow JA2E to persistently track a person across different days.

To the extent that the technical operations necessary to provide this functionality involve the processing of personal data, such processing will be based on JA2E's legitimate interest in understanding and improving the operation and performance of the Website, in accordance with Article 6.1(f) GDPR, after due consideration of users' rights and freedoms.

Should JA2E subsequently incorporate analytics, advertising, tracking, or personalization technologies that require consent, these will not be activated until such consent has been validly obtained.

7.7. Legal obligations

JA2E may process data when necessary to:

comply with tax, accounting, or administrative obligations;
respond to legally valid requests;
comply with judicial decisions;
cooperate with competent authorities; or
comply with other applicable legal obligations.

The legal basis will be compliance with a legal obligation, in accordance with Article 6.1(c) GDPR.

7.8. Formulation, exercise, or defense of claims

JA2E may retain or use certain data when necessary to formulate, exercise, or defend rights or claims, whether judicial or extrajudicial.

The legal basis will be the legitimate interest in the protection and defense of its legal rights and interests, in accordance with Article 6.1(f) GDPR.

8. Processing based on legitimate interest

When JA2E relies on Article 6.1(f) GDPR as the legal basis, it will assess:

the interest pursued;
the necessity of the processing;
the reasonable expectations of the data subjects; and
the potential impact on their rights and freedoms.

JA2E's legitimate interests may include:

responding to communications voluntarily directed to the company;
managing professional relationships;
maintaining B2B relationships;
protecting systems and services;
preventing fraud or abuse;
analyzing and improving the operation of the Website; and
defending legal rights.

Data subjects may exercise their right to object under the terms established by Article 21 GDPR.

9. Commercial communications

Submitting an inquiry, request for information, assessment, quote, or proposal does not in itself constitute consent to receive general commercial communications.

Where a commercial communication requires consent, this will be requested separately, in a specific, informed, and unambiguous manner.

Consent may be withdrawn at any time.

Where a prior contractual relationship exists and the requirements established by applicable regulations are met, JA2E may send communications relating to its own products or services similar to those originally contracted.

In legally required cases, a simple and free procedure will be provided to request unsubscription.

10. Mandatory data

Fields identified as mandatory must be completed when necessary to manage a request.

The absence of essential information may prevent JA2E from adequately handling the inquiry or assessing the requested service.

Data not identified as mandatory will be provided voluntarily.

11. Data retention

JA2E will retain data only for as long as necessary for the corresponding purposes and, subsequently, for the periods legally required or necessary to address possible liabilities.

11.1. Inquiries not leading to a contract

Inquiries, requests for information, and potential projects that do not result in a contractual relationship will generally be retained for a maximum of twelve months from the last substantive interaction with the data subject.

Once that period has elapsed, the data will be deleted or anonymized unless there is a legal reason justifying its retention for a longer period.

11.2. Pre-contractual actions

Data will be retained while the negotiation or evaluation of a possible project remains active.

If a contract is not formalized, the general criterion indicated for inquiries not leading to a contract will subsequently apply, without prejudice to any retention necessary to evidence the actions taken or to address possible claims.

11.3. Contractual relationships

Data necessary for a contractual relationship will be processed for the duration of that relationship.

Once the relationship has ended, the data will be retained, duly blocked or subject to restricted access, for the periods required by tax, accounting, commercial, and other applicable legislation, as well as for the limitation periods applicable to possible liabilities.

Once these periods have elapsed, the data will be deleted.

11.4. Commercial communications

Where processing depends on consent, data may be processed until such consent is withdrawn.

Where a data subject objects to receiving communications, JA2E may retain the minimum information necessary to evidence and respect that objection.

11.5. Exercise of rights

Documentation relating to requests to exercise rights may be retained for as long as necessary to evidence that they were properly handled and for the corresponding limitation periods.

11.6. Technical and security data

Technical logs will be retained only for the period reasonably necessary to ensure security, investigate incidents, and comply with applicable obligations.

12. Recipients

JA2E will not sell personal data obtained through the Website's forms.

Data may be disclosed when:

a legal obligation exists;
it is necessary to perform a contract;
another valid legal basis exists; or
the data subject has authorized it, where necessary.

Depending on the circumstances, recipients may include:

public administrations;
courts and tribunals;
law enforcement authorities;
administrative or regulatory authorities;
financial institutions for the management of financial transactions;
legal advisors;
tax or accounting advisors;
auditors; and
other professionals when necessary to comply with obligations or defend rights.

13. Data processors

JA2E may use providers that need access to certain data in order to provide their services.

These may include providers of:

technological infrastructure;
hosting;
development or maintenance;
email and communications;
forms;
storage;
cybersecurity;
technical support; and
professional tools.

Where they act as data processors, they must be subject to the corresponding obligations under Article 28 GDPR.

Framer B.V.

The Website is developed and hosted using the Framer platform.

With respect to any processing in which Framer processes personal data on behalf of JA2E, JA2E will act as the controller and Framer B.V. as the processor, in accordance with the applicable data processing agreement.

14. International transfers

The international accessibility of the Website does not, by itself, constitute an international data transfer.

However, certain technology providers may rely on infrastructure or subprocessors located outside the European Economic Area.

Where a transfer subject to Chapter V GDPR occurs, JA2E will require the existence of a valid transfer mechanism.

Framer's current DPA states that transfers outside the European Economic Area may be based, as applicable, on:

an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework where the recipient is validly certified; or
where an adequacy decision does not apply, the European Commission's Standard Contractual Clauses or another safeguard permitted under Article 46 GDPR.

JA2E will apply equivalent criteria with respect to other providers that may carry out international transfers.

Data subjects may request additional information regarding transfers affecting their data and the safeguards used by writing to jatue@ja2e.com.

15. Processing carried out on behalf of clients

This Policy primarily governs processing in relation to which JA2E acts as data controller, mainly with respect to:

visitors to the Website;
persons making inquiries;
potential clients;
clients;
representatives; and
professional contacts.

However, in certain projects JA2E may access or process personal data included in systems, platforms, databases, or documentation belonging to clients, following their instructions.

Where JA2E processes data on behalf of a client, the relationship must be governed by the corresponding data processing agreement under Article 28 GDPR.

Such an agreement may govern:

subject matter;
duration;
nature;
purpose;
categories of data;
data subjects;
instructions;
confidentiality;
security;
subprocessors;
international transfers;
exercise of rights;
security incidents;
return or deletion of data; and
audits.

This Policy does not replace the specific processing agreements entered into with clients.

16. Artificial intelligence and automated decisions

JA2E may provide professional services that incorporate artificial intelligence, automation, or algorithmic systems.

The legal position of the parties, the data used, and the applicable obligations will be determined on a project-by-project basis.

Data submitted through the Website's general forms is not currently used to make decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them.

Nor is it currently used to decide, in an exclusively automated manner, whether a potential client will be accepted or rejected.

Should this situation change, JA2E will update the corresponding information before initiating the new processing.

17. Data security

JA2E will adopt appropriate technical and organizational measures, taking into account:

the nature of the data;
scope;
context;
purposes;
the state of the art;
implementation costs; and
risks to the rights and freedoms of individuals.

These measures will be aimed, among other purposes, at:

preserving confidentiality;
maintaining integrity;
ensuring availability;
managing access;
preventing unauthorized access;
avoiding loss or alteration;
managing vulnerabilities; and
responding to incidents.

No system connected to the Internet can guarantee absolute security against every possible threat.

18. Security breaches

When JA2E becomes aware of a security breach affecting personal data, it will assess its circumstances and risks.

Where legally required, it will notify the incident to the competent supervisory authority within the established time limits.

Where the breach is likely to result in a high risk to the rights and freedoms of individuals, JA2E will also notify the affected individuals under the terms required by the GDPR, unless an applicable legal exception applies.

19. Rights of data subjects

Where applicable, data subjects may exercise the following rights:

Right of access: to know whether JA2E is processing their data and to access it.
Right of rectification: to request correction of inaccurate or incomplete data.
Right of erasure: to request deletion of data where a legal ground exists.
Right of restriction: to request restriction of processing in the cases legally established.
Right to object: to object to processing based on legitimate interest for reasons related to their particular situation. In matters of direct marketing, they may object at any time.
Right to data portability: to receive certain data in a structured, commonly used, and machine-readable format and, where applicable, to request its transmission to another controller.
Right to withdraw consent: where processing is based on consent, it may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.
Rights relating to automated decisions: the rights recognized under Article 22 GDPR may be exercised where their requirements are met.

20. How to exercise rights

Rights may be exercised by submitting a request to:

jatue@ja2e.com

The request must allow the data subject's identity and the right they wish to exercise to be determined.

JA2E will only request additional information to verify identity where there are reasonable doubts about the identity of the person making the request.

The exercise of rights will be free of charge, except in the exceptional cases provided for by applicable regulations for manifestly unfounded or excessive requests.

JA2E will respond within the legally established time limits.

21. Supervisory authority

Where a data subject considers that the processing of their data infringes data protection regulations, they may lodge a complaint with the competent supervisory authority.

In Spain:

Spanish Data Protection Agency — AEPD www.aepd.es

This right is without prejudice to any other administrative or judicial remedies that may be available.

22. Minors

JA2E's services are primarily professional and business-oriented in nature and are not specifically directed at minors.

JA2E does not intend to deliberately collect personal data from minors through its general forms.

Where it becomes aware that it has received data from a minor without a sufficient legal basis, it will take the measures reasonably necessary to delete such data or regularize the processing, as appropriate.

23. Third-party data

Where a user provides personal data of a third party, they must have a sufficient legal basis for doing so and must limit the information to that which is necessary and relevant.

Where JA2E is required to inform the third party directly under Article 14 GDPR, it will do so within the legally established time limits, unless an applicable exception applies.

24. Accuracy and updating

Data subjects should ensure that the data they provide is accurate and reasonably up to date.

Where relevant data changes in a way that affects the handling of an inquiry or professional relationship, they may notify JA2E of the corresponding change.

25. Third-party sites and services

The Website may contain links to pages, platforms, or services belonging to third parties.

This Policy applies exclusively to processing carried out under JA2E's responsibility.

Where a user accesses an external service, they should consult that third party's privacy policy.

26. Cookie Policy

The use of cookies and other technologies for storing or accessing information on the device is regulated in JA2E's Cookie Policy.

Certain technical operations may take place without using cookies. For this reason, the Cookie Policy and this Privacy Policy serve complementary purposes.

27. International activity

JA2E provides services with an international scope but is established in Spain.

Processing linked to its establishment will be subject to the GDPR, the LOPDGDD, and other applicable Spanish and European regulations.

The mere fact that a person accesses the Website from another country does not automatically mean that JA2E becomes fully subject to the privacy regime of that territory.

Where foreign regulations are mandatorily applicable based on legal connecting factors, JA2E will adopt the corresponding additional measures.