Open platform Request a demo

Privacy Notice

Effective

On this page
  1. 1. CONTROLLER
  2. 2. SCOPE AND ROLES
  3. 3. DATA AND SOURCES
  4. 4. PURPOSES AND LEGAL BASES
  5. 5. REQUIRED DATA
  6. 6. DATA PROCESSED FOR CUSTOMERS
  7. 7. RECIPIENTS
  8. 8. INTERNATIONAL TRANSFERS
  9. 9. RETENTION
  10. 10. SECURITY
  11. 11. AUTOMATED DECISIONS
  12. 12. RIGHTS
  13. 13. LANGUAGE

1. CONTROLLER

  • Arfima Financial Services, S.L. (“Alpha-Klima”)
  • Tax identification number: B87038659
  • Registered office: Calle Cardenal Marcelo Spínola, 42, 2nd floor, 28016 Madrid, Spain
  • Contact address: Calle José Bardasano Baos, 9, 28016 Madrid, Spain
  • Privacy and rights email: contact@alpha-klima.com
  • Website: alpha-klima.com

Alpha-Klima has not appointed a data protection officer. Privacy enquiries are handled through the email address above.

2. SCOPE AND ROLES

This Notice applies to the website, forms, professional and promotional communications, platform accounts and usage data processed by Alpha-Klima for its own purposes.

Alpha-Klima acts as controller when it determines the purposes and essential means of processing. It acts as processor when it handles personal data on a customer’s behalf and under documented customer instructions. The classification depends on the actual function of each operation, not only the name of the contract. When acting as processor, Alpha-Klima may select non-essential technical and organisational means within the instructions and contracted service. Processing on a customer’s behalf is also governed by the relevant data processing agreement and contract.

3. DATA AND SOURCES

Depending on the relationship and service, Alpha-Klima processes:

  • professional identity and contact data: name, email, telephone, position, organisation and country;
  • enquiries and communications: messages, interests, requested services and meeting content;
  • contract and administration data: representatives, authorisations, orders, billing, payments and support;
  • account and authentication data: identifier, name, email and access information;
  • technical and security data: IP, session, date, browser, device, authentication events, errors and incidents;
  • platform usage data: modules, resources, queries, API use, downloads, exports, volume, performance and administrative actions;
  • communication preferences and evidence of consent, objection or unsubscribe.

Data come from the individual, the organisation for which they work or which they represent, contractual relationships, lawful professional referrals or publicly accessible professional sources. Where data are not obtained directly, Alpha-Klima provides the information required by Article 14 GDPR, unless a legal exception applies, within one month, at the first communication with the individual or before the first disclosure to another recipient, whichever occurs first.

4.1. Enquiries, demonstrations and contracting

Alpha-Klima answers enquiries, prepares demonstrations and proposals and manages contracting.

  • For professionals contracting personally, the basis is taking pre-contractual steps or performing the contract.
  • For employees and representatives of organisations, the basis is the legitimate interest in managing the B2B professional relationship.

4.2. Accounts, service and support

Alpha-Klima administers users, provides the service and support, bills and maintains the relationship with the customer organisation. The bases are performance of a contract where the professional is a party, legitimate interests in managing corporate representatives and users, and compliance with legal obligations.

4.3. Authentication, security and compliance

Alpha-Klima verifies identities, protects accounts and systems, records activity, applies limits, investigates incidents and prevents fraud, abuse, extraction and unauthorised use. The bases are performance of the service, compliance with legal security duties and legitimate interests in protecting the service, customers, intellectual property and third-party rights.

4.4. Operation and improvement

Alpha-Klima processes technical and usage metrics to operate the service, resolve errors, plan capacity and provide support. The bases are performance of the service and legitimate interests in maintaining its quality, security and efficiency. Aggregated or anonymised information is used for analysis and improvement. Customer data and outputs are not used to train machine-learning models without a written agreement and sufficient legal basis.

4.5. Marketing

Alpha-Klima sends communications about webinars, events, publications, solutions and services where optional consent has been given. Consent may be withdrawn at any time.

Where a prior contractual relationship exists and Alpha-Klima lawfully obtained the recipient’s contact details from that recipient, it may send communications about its own services similar to those contracted. At collection and in every message, it provides a valid electronic address or another simple and free means of objection.

4.6. Compliance and claims

Alpha-Klima complies with legal duties and requests and establishes, exercises or defends claims. The bases are compliance with legal obligations and legitimate interests in protecting legal rights.

The legitimate interests stated above apply after considering the necessity of the processing, its impact and individuals’ reasonable expectations. Individuals may request further information about that assessment and object as described in section 12.

5. REQUIRED DATA

Mandatory fields are necessary to handle the request or provide the service. Marketing consent is optional, and refusal does not prevent form submission, contracting or platform use.

6. DATA PROCESSED FOR CUSTOMERS

The customer determines the lawfulness, necessity, accuracy and proportionality of data uploaded to the platform and informs affected individuals. Alpha-Klima processes those data under documented instructions and the data processing agreement.

Special-category data, criminal-offence data, children’s data, credentials, medical information or identification biometrics are processed only where the contract expressly authorises them and establishes the relevant legal basis and safeguards.

7. RECIPIENTS

The following recipients access data where necessary:

  • hosting, infrastructure, storage, backup, security, monitoring and support providers;
  • authentication and electronic-communications providers;
  • legal, accounting and tax advisers and auditors;
  • authorities, courts and public bodies where legally required;
  • purchasers or successor entities in a lawful corporate transaction, subject to applicable safeguards.

Processors act under contract, confidentiality and instructions. Providers that determine their own purposes and essential means act as independent controllers for those operations.

An up-to-date list of the processors used for each service, including their location, is available on request at contact@alpha-klima.com.

8. INTERNATIONAL TRANSFERS

Where a recipient processes data outside the European Economic Area, Alpha-Klima uses an adequacy decision, Article 46 GDPR safeguards or another valid Chapter V mechanism. Individuals may request information and, where applicable, a copy of the relevant safeguards.

9. RETENTION

  • Enquiries, demonstrations and unconverted opportunities: up to 24 months after the last substantive interaction.
  • Marketing: until consent is withdrawn or the person objects. Evidence and the minimum suppression record are retained as necessary to demonstrate and honour the decision.
  • Accounts and customer relationship: for the relationship and applicable legal periods.
  • Contracts, billing and commercial records: six years, without prejudice to other tax or limitation periods.
  • Ordinary platform, form and security logs: up to 12 months.
  • Incident, fraud, abuse or claim records: for the investigation and applicable liability periods.
  • Data processed for customers: for the service term and according to the return or deletion instructions in the data processing agreement.

At the end of the applicable period, data are deleted or anonymised. Where law requires retention or liabilities may arise, data remain blocked and restricted to that purpose for the relevant period.

10. SECURITY

Alpha-Klima applies technical and organisational measures appropriate to risk. Depending on the system and processing, these include access control, authentication, encryption in transit, session and secret management, logical separation, activity logging, recovery, vulnerability management, supplier review and incident response.

11. AUTOMATED DECISIONS

Alpha-Klima does not make solely automated decisions that produce legal or similarly significant effects on individuals. Automated security and usage-limit rules are subject to human review where they produce a significant measure.

12. RIGHTS

Individuals may exercise access, rectification, erasure, restriction, portability where applicable and objection, and withdraw consent without retroactive effect, by writing to contact@alpha-klima.com and identifying their request.

An objection to direct marketing is honoured in all cases. For other processing based on legitimate interests, Alpha-Klima stops processing unless it demonstrates compelling legitimate grounds or the data are needed for legal claims.

Alpha-Klima requests only the information needed to verify identity, responds within the legal time limit and handles rights requests free of charge unless a request is manifestly unfounded or excessive under the law.

Individuals may also complain to the Spanish Data Protection Agency, www.aepd.es, or another competent supervisory authority.

13. LANGUAGE

If the versions differ, the Spanish version prevails.