Privacy Policy

We keep your data only for as long as necessary for each purpose:

• Inquiry without follow-up or continuation: 12 months from the last contact. After that period, data is deleted or anonymised.
• Active or initiated commercial relationship: up to 5 years from the last effective contact, aligned with the limitation period for personal actions (Art. 1964 Spanish Civil Code).
• Commercial communications: until you revoke consent or unsubscribe.
• Accounting and tax obligations: 6 years (Art. 30 Spanish Commercial Code) and 4 years (Art. 66 Spanish General Tax Act) where applicable.
• Aggregated analytics: 26 months, per Google Analytics 4 configuration.
• Consent snapshot: while we retain the associated data, as documentary evidence under Art. 7.1 GDPR.

You may request early deletion of your data at any time by writing to compliance@utilia.ai.

Some of our providers (Resend, OpenAI, Anthropic and Google) are located in the United States. International transfers are made with double safeguards:

• EU-U.S. Data Privacy Framework (Adequacy Decision 2023/1795 of the European Commission), with periodic verification of each provider's adherence at dataprivacyframework.gov.
• Standard Contractual Clauses approved by the European Commission (Implementing Decision 2021/914), as a subsidiary safeguard.
• Data Processing Agreements (DPAs) signed with each provider, including specific clauses against use for model training.

As an AI-specialised company, in some internal processes we may use generative AI models to better prepare the response to your inquiry. This processing takes place only if you expressly authorise it when submitting the form.

Functionalities covered

• Drafting and summarisation assistant: an AI copilot helps the commercial team generate response drafts and summarise the inquiry history.
• Assistants connected to the CRM: via secure protocols with authentication and audit logging, authorised employees can consult the lead context from external AI tools.
• Commercial profile enrichment: queries to AI models with public information about the data subject's company.

AI providers used

• OpenAI, LLC (United States): adhered to the EU-U.S. Data Privacy Framework, with signed SCCs and contractual clause prohibiting the use of your data for training models.
• Anthropic, PBC (United States): adhered to the EU-U.S. Data Privacy Framework, with SCCs automatically incorporated in their Commercial Terms of Service and contractual clause prohibiting the use of your data for training models.

Commitments and clarifications

• No training: our AI providers do not use your data to train their models, per the DPAs signed with UTILIA.
• Brief security retention: OpenAI and Anthropic may retain inputs and outputs for up to 30 days for the sole purpose of abuse prevention and security, except in flows where zero-retention has been activated.
• Meaningful human supervision: no response or decision regarding your inquiry is executed without review and approval by a member of the UTILIA team. There are no solely automated decisions in the sense of Art. 22 GDPR.
• Transparency (Art. 50 EU Regulation 2024/1689 — AI Act): when you interact with content prepared or assisted by generative AI, we inform you in advance.
• Right to revoke: you can withdraw consent to AI use at any time by writing to compliance@utilia.ai, without affecting the handling of your inquiry.

We apply appropriate technical and organisational measures to protect your data:

• SSL/TLS encryption for all communications.
• Restricted access to personal data under the principle of least privilege.
• Strong authentication and audit logging in internal systems.
• DPAs signed with all sub-processors.
• Continuous staff training on data protection and AI literacy (Art. 4 AI Act).
• Periodic audits and review of measures as the state of the art evolves.