Security & Privacy Policy

At AITRIX (AI AVIATRIX, S.L.), we are committed to protecting personal data, safeguarding our clients' information and maintaining the highest standards of confidentiality and information security.

As a LegalTech company handling information subject to professional confidentiality obligations, we recognise that privacy and information security are fundamental to the trust our clients place in us.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), Spain's Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), and other applicable data protection legislation.

This Privacy Policy explains how we collect, use, store and protect personal data when you interact with our website and services, as well as our commitments to information security.

1. Data Controller

The entity responsible for processing personal data collected through this website is:

• Company name: AI AVIATRIX, S.L.
• Trading name: AITRIX
• Registered office: Calle José Abascal 44, 1º D, 28003 Madrid, Spain
• Telephone: +34 91 451 80 97
• Email: azahara@ai-trix.com

Where AITRIX processes personal data on behalf of its clients through its LegalTech solutions, it may act as a data processor under the GDPR, in accordance with the relevant contractual and data processing arrangements.

2. Personal Data We Collect

We only collect and process personal data that is necessary for legitimate business purposes, responding to enquiries, providing our services and maintaining the security of our systems.

Depending on how you interact with us, we may process:

• Identification and contact details: name, surname, company, professional role, email address and telephone number.
• Professional information: company name, job title and business area.
• Website usage and technical data: IP address, browser and device information, pages visited, access times and referring URLs, where applicable.

We do not intentionally collect special categories of personal data through our website, nor is our website intended for minors.

Personal data processed through our LegalTech solutions on behalf of clients is governed by the applicable contractual arrangements, data processing agreements and relevant privacy notices.

3. Purposes and Legal Bases for Processing

We process personal data for the following purposes:

Contact and enquiries

To respond to enquiries submitted through our website, by email or through other communication channels.

Legal basis: our legitimate interest in responding to enquiries or, where applicable, consent or pre-contractual measures.

Pre-contractual and contractual management

To arrange demonstrations, prepare proposals, assess service requests and manage existing commercial relationships.

Legal basis: performance of a contract or steps taken prior to entering into a contract.

Service improvement and security

To maintain and protect our website and systems, prevent unauthorised access, detect security incidents and improve the functionality of our services.

Legal basis: our legitimate interests and, where applicable, compliance with legal obligations.

Marketing communications

To provide information about our services, products and relevant developments where you have expressly consented or where another applicable legal basis permits such communications.

You may withdraw your consent or object to marketing communications at any time.

4. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal obligations.

In particular:

• Contact and enquiry data is retained for the period necessary to manage the request and any relevant follow-up.
• Contractual and commercial information is retained for the duration of the relationship and any applicable statutory limitation periods.
• Technical logs and security records are retained for the periods necessary to maintain system security and integrity, in accordance with applicable retention requirements.

When personal data is no longer required, it is securely deleted or anonymised, unless further retention is required by law.

5. Data Recipients and International Transfers

We do not sell personal data.

Personal data may be disclosed to:

• Trusted service providers supporting our hosting, IT infrastructure, email, analytics, security and other business operations, acting under appropriate contractual and data protection arrangements.
• Public authorities, courts or other competent bodies where disclosure is legally required.

Our LegalTech infrastructure is designed to keep client information within the European Economic Area (EEA). Client information is hosted and processed within the EEA, on servers located in Spain, including the artificial intelligence systems used to process that information.

Where other processing activities, such as website administration or communications, involve international transfers of personal data outside the EEA, we ensure that appropriate safeguards are implemented in accordance with the GDPR, including adequacy decisions or Standard Contractual Clauses, as applicable.

6. Our Commitment to Information Security

Information security is an essential part of how AITRIX operates.

We maintain an Information Security Management System (ISMS) based on the ISO/IEC 27001 standard and are currently undergoing the certification process.

Our approach combines technical, organisational and contractual safeguards to protect the confidentiality, integrity and availability of information.

Our key commitments include:

Confidentiality and professional secrecy

We handle our clients' information with strict confidentiality and respect for professional secrecy and legal professional privilege, where applicable.

Data protection and minimisation

We process personal data in accordance with the GDPR and the LOPDGDD, limiting processing and retention to what is necessary for the relevant purposes.

European data hosting

We host and process client information within the EEA, using servers located in Spain, including for the artificial intelligence systems used in our services.

Encryption and access control

We implement device encryption, two-factor authentication and access controls based on the principle of least privilege, ensuring that access to information is restricted to authorised individuals according to their responsibilities.

Backups and recovery

We perform regular backups and verify our ability to restore information to support data availability and business continuity.

Security incident management

We maintain procedures for identifying, managing and responding to information security incidents, including personal data breach notification where required under the GDPR.

Trusted service providers

We select providers that offer appropriate security guarantees and establish contractual and data processing arrangements to safeguard information entrusted to them.

Continuous improvement

We regularly review and improve our information security measures, procedures and controls to address evolving risks and maintain the effectiveness of our Information Security Management System.

Our commitment to information security extends to our personnel, technology, service providers and the information entrusted to us by our clients.

7. Your Data Protection Rights

Under the GDPR, you may exercise the following rights, subject to the applicable legal conditions:

• Access: obtain confirmation of whether we process your personal data and access that information.
• Rectification: request the correction of inaccurate or incomplete personal data.
• Erasure: request the deletion of your personal data where legally applicable.
• Restriction: request the restriction of processing in certain circumstances.
• Data portability: receive your personal data in a structured, commonly used and machine-readable format, where applicable.
• Objection: object to certain processing activities, including processing based on legitimate interests and direct marketing.
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise your rights, please contact us at azahara@ai-trix.com, indicating "Data Protection" in the subject line.

Where we have reasonable doubts about your identity, we may request additional information necessary to verify it.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es or with another competent supervisory authority.

8. Cookies and Similar Technologies

Our website may use essential cookies necessary for its operation and, where applicable, analytics or other non-essential cookies to understand website usage and improve performance.

Where consent is required, non-essential cookies will only be used after obtaining your consent. You may accept, reject or manage your cookie preferences through the mechanisms provided on our website.

For further information, please consult our Cookies Policy.

9. Minimum Age

Our website and services are intended for professional and business use and are not directed at minors.

If we become aware that personal data has been collected from a minor without the necessary legal authorisation, we will take appropriate steps to delete that information.

10. Third-Party Links

Our website may contain links to third-party websites or services that are not operated or controlled by AITRIX.

We are not responsible for the privacy or security practices of those third parties and recommend reviewing their respective privacy policies before providing personal information.

11. Policy Updates

We may update this Privacy Policy to reflect changes in applicable legislation, our services, business operations or information security practices.

The latest version will be available on our website, together with its date of revision. Where legally required, we will provide additional notice or obtain consent before implementing relevant changes to personal data processing.

12. Contact

For any questions regarding this Privacy Policy, the processing of your personal data or our information security practices, please contact:

AI AVIATRIX, S.L. (AITRIX)
Calle José Abascal 44, 1º D, 28003 Madrid, Spain
Email: azahara@ai-trix.com
Telephone: +34 91 451 80 97