Privacy Policy
This Privacy Policy describes how Venturalítica S.L. (NIF B23955206), as data controller, collects, processes and protects the personal data of users of this website, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Data Protection (LOPDGDD) and Law 34/2002 on Information Society Services (LSSI-CE).
Who is the controller of your personal data?
Venturalítica S.L. NIF: B23955206 Registered office: C/ Monte Ernio 4, 1.º Izquierda, 20015 Donostia-San Sebastián, Spain Email: info@venturalitica.ai Phone: +34 645 13 40 00 Venturalítica S.L. has not appointed a Data Protection Officer, as none of the cases in Article 37 GDPR applies. For any matter relating to the protection of your personal data, you can write to info@venturalitica.ai.
Processing principles
In accordance with Article 5 GDPR, your personal data will be processed lawfully, fairly and transparently. We apply the principles of purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality. This policy follows the layered information model and the question-and-answer structure recommended by the Spanish Data Protection Agency (AEPD).
For what purposes do we process your personal data?
We process the personal data you provide for the following purposes, distinguished by the channel through which it is collected: • Contact form: to answer the enquiry you send us and, if you tell us how you heard about us (optional question), to measure which channels bring people to us. Submitting it creates a contact in our CRM (Odoo); the form does not send automatic emails. • Web analytics (PostHog, European region): to measure how the site is used —page views, clicks on links and buttons— and its performance in the browser (loading metrics or «web vitals»), in order to improve it. No session recording and no profiles of identified people. This purpose is only activated if you give your consent in the cookie banner. • Technical operation: to keep the strictly necessary features of the site available (language preference and cookie preferences). We do not carry out profiling or automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR.
What is the legal basis for processing your data?
The legal basis for each processing activity is identified separately under Article 6 GDPR: • Enquiries received through the contact form: Article 6(1)(a) GDPR —consent—, which you give by ticking a box that is not pre-ticked. • Commercial communications: we do not send you commercial communications by electronic means without your express consent. • Web analytics with PostHog: Article 6(1)(a) GDPR —consent— given in the cookie banner. Without consent the tool is not initialised and sends no data. • Strictly necessary cookies and technical storage: Article 22(2) LSSI-CE —technical exemption— in conjunction with Article 6(1)(f) GDPR —legitimate interest— in providing the service requested by the user. Consent can be withdrawn at any time by writing to info@venturalitica.ai or, for analytics, from the cookie preferences panel, without affecting the lawfulness of processing before its withdrawal (Article 7(3) GDPR).
To which recipients will your data be disclosed?
Your data is not disclosed to third parties, save for legal obligation. We rely on the following processors to provide the service, all bound by a contract under Article 28 GDPR (concluded electronically, by accepting their terms of service, which include the data processing addendum): • Odoo S.A. (Belgium, EU) — CRM in which the contact is created when you submit the form. Data hosted on the European infrastructure of Odoo Online. • Scaleway S.A.S. (France, EU) — website hosting (containers in Paris). • PostHog, in its European region «PostHog EU Cloud» (Frankfurt, Germany) — web analytics. Only activated with your consent in the cookie banner. Requests go through a path on our own domain (/medida), which forwards them to that European infrastructure. We do not transfer personal data outside the European Economic Area. PostHog Inc. is a company whose parent is in the United States; the analytics data is hosted and processed in its EU region.
How long will we keep your data?
We keep your data for as long as necessary to fulfil each purpose and, afterwards, for the limitation periods of any actions that may arise: • Contact form: until you withdraw your consent or, at most, 36 months without activity. • Contractual relationship: for the term of the contract and the applicable statutory limitation periods (up to 6 years for commercial and tax obligations). • Web analytics: the identifiers stored in your browser, until you withdraw consent (which expires after 24 months) or clear the browser storage; usage data in PostHog, 12 months. • Cookie banner preferences (cookie_prefs): 24 months; after that period, consent is requested again.
What are your rights when you provide us with your data?
Under Articles 15 to 22 GDPR, you have the following rights: • Right of access: to obtain confirmation of whether we process your data and, if so, a copy of it. • Right to rectification: to correct inaccurate or incomplete data. • Right to erasure («right to be forgotten»): to have your data deleted when it is no longer necessary for the purpose for which it was collected. • Right to restriction of processing: to have processing suspended while its accuracy or lawfulness is verified. • Right to data portability: to receive your data in a structured, commonly used and machine-readable format. • Right to object: to object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. • Right not to be subject to automated decisions: Article 22 GDPR (not applicable: we do not make such decisions). You can exercise these rights by writing to info@venturalitica.ai with a copy of a document proving your identity. We will reply within one month at most (extendable by two further months in complex cases, under Article 12(3) GDPR). If you consider that the processing does not comply with the law, you have the right to lodge a complaint with a supervisory authority. In Spain, the Spanish Data Protection Agency —https://www.aepd.es/—. If you habitually reside in another EU Member State, you can contact the competent supervisory authority where you live.
How did we obtain your data?
The personal data we process comes directly from you: you provide it when filling in the contact form, or it is generated while browsing if you accept analytics in the cookie banner. Professional contacts that do not reach us through this website are described in the next section. The categories of data we process are limited to identification and contact data (name and email address), the content of your enquiry, the channel through which you heard about us if you tell us and, where there is consent, technical browsing data and performance metrics linked to a pseudonymous browser identifier.
What happens if you did not give us your data yourself?
Besides people who write to us through this website, we process data of professional contacts who have not given it to us directly (Article 14 GDPR): • Source: public professional profiles and industry trade fairs. • Data: name, company, job title and professional contact details. • Purpose: business-to-business commercial prospecting. • Legal basis: Article 6(1)(f) GDPR —legitimate interest—, with a documented balancing test. • Retention: at most, 36 months without activity. • Recipients: Odoo S.A. (Belgium, EU), as data processor; there are no international transfers. • Rights: you can object to this processing at any time by writing to info@venturalitica.ai, in addition to exercising the other rights described in this policy.
Do we carry out automated decision-making or profiling?
We do not take automated decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR.
What security measures do we apply?
We apply technical and organisational measures appropriate to the risk of the processing (Article 32 GDPR): encryption in transit with TLS 1.3 across the whole website, two-factor authentication for operators at the providers that support it, need-to-know access control, encrypted backups, an incident log and documented procedures to notify breaches to the AEPD within 72 hours where Article 33 GDPR applies.
Do we use cookies or similar technologies?
Yes. We use storage that is strictly necessary for the site to work (language preference and consent management) and, with your express consent, PostHog analytics storage in your browser, which does not use cookies. The detailed description —provider, purpose, type, duration and legal basis of each item— is published in the Cookie Policy. You can manage or withdraw your consent at any time from the «Cookie preferences» link in the footer, as easily as you gave it (Article 7(3) GDPR).
Processing of minors' data
This website is not aimed at people under 14, the minimum age for consent set in Spain by Article 7 LOPDGDD. If you are in another Member State, the minimum age may be up to 16 under Article 8 GDPR. We do not knowingly collect data from minors; if you become aware that a minor has given us data without the consent of the holder of parental responsibility, you can request its deletion by writing to info@venturalitica.ai.
Changes to this policy
We may update this Privacy Policy to reflect regulatory changes, new processors or changes in purposes. The current version will always be available on this page and, for substantial changes, consent will be requested again where appropriate. Last updated: 24 September 2026.