PRIVACY POLICY

VINCES CONSULTING S.L, in compliance with personal data protection legislation, informs the user of the Fren Platform (hereinafter, the "User" and the "Service" or the "Platform", respectively) that it will process their personal data in accordance with the provisions of this Privacy Policy, having regard to the provisions of Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter, "GDPR"), and Organic Law 3/2018, on the Protection of Personal Data and guarantee of digital rights (hereinafter, "LOPDGDD").

CONTROLLER OF THE PROCESSING OF PERSONAL DATA

VINCES CONSULTING S.L, (hereinafter, "VINCES"), with registered office at Calle de Fortuny,45, 28010, Madrid (Spain), and NIF B85722106.

VINCES has a Data Protection Officer (hereinafter, "DPO"), whom the user may contact to raise any question, request or complaint relating to the processing of their personal data or the exercise of their rights, by writing to the email address privacidad@vincesconsulting.com or by means of a letter sent to the postal address indicated above.

PERSONAL DATA PROCESSED

In the context of the use of the Service, VINCES may process various categories of the User's personal data, arising both from the registration and authentication process and from the interaction with the Platform, as well as from the technical systems necessary for its operation. The data processed is grouped into the following categories:

Identification and contact data: includes the User's first name, surname and email address, as well as any data necessary for the creation, management and maintenance of the account used to access the Service.
Access credentials and account-associated data: comprise the username, password or equivalent identifiers established during the registration process, necessary for the authentication and verification of the User's identity.
Conversational data or prompts: conversational data or prompts are considered to be the texts, messages, questions, instructions or other contributions that the User enters into the Platform in order to interact with the Fren conversational assistant. This data is indispensable for the provision of the Service and for the generation of the responses provided by the system.
Data generated by the Service: includes the responses, texts or results produced by the Platform on the basis of the User's queries, as well as the metadata linked to the processing of this type of interaction.
Usage and analytics data: comprise information linked to the User's behaviour pattern within the Platform, such as the number of queries made, the frequency and duration of sessions, the categories of topics consulted, the Service performance indicators and similar metrics aimed at evaluating the User experience and the operation of the system.
Technical and connection data: data such as the IP address, device identifiers, browser used, operating system, activity logs, technical fingerprints or other data generated automatically as a consequence of the use of the Service and necessary to ensure its operation, security and stability are processed.
Data contained in requests, communications or incidents submitted by the User: comprises the data obtained from the available channels (email, forms or similar) for contacting VINCES included in the messages, as well as any additional information that the User themselves provides in order to manage their request.
Billing and financial transaction data: includes the information necessary to manage the payments associated with the corporate or paid versions of the Service. Although the processing of charges and the issuance of invoices is carried out through external payment service providers, VINCES retains the invoices issued for administrative and accounting purposes and can view only the last four digits of the card used, together with the transaction identifiers, amount, date, payment method and other data associated with the transaction.

Except in the case of the political affinity test described in Purpose 7, the Service does not require nor is it directed at the processing of data belonging to the special categories provided for in article 9 of the GDPR (health data, ideology, trade union membership, religion, sexual orientation and other similar data).

VINCES expressly asks the User not to enter this type of information while using the Service. In the event that, accidentally or unintentionally, the User includes this type of data in interactions with the Platform, VINCES will proceed to delete or anonymise it as soon as it is technically possible.

The data relating to the political affinity test reveal the User's political opinions and will only be processed on the basis of their explicit consent, for the period and with the safeguards described in Purpose 7.

PURPOSE OF THE DATA PROCESSING AND LEGAL BASIS

VINCES will process the User's personal data for the purposes described below, in accordance with the principles established in the GDPR.

Purpose 1. Provision of the Service

Description of the purpose: to allow access to the Service and enable its technical and operational functioning, processing the queries entered by the User and generating the responses provided by the Fren conversational assistant. This purpose includes the management of the User's interactions with the Platform, the processing of prompts, the generation of responses and the basic functioning of the modules and systems that make up the technological solution.
Data processed: conversational data or prompts, data generated by the Service, technical and connection data, and usage and analytics data.
Legal basis: performance of a contract or application of pre-contractual measures (art. 6.1.b GDPR).

Purpose 2. Registration and authentication of the User

Description of the purpose: to manage the creation of the account, authenticated access to the Service, verification of the User's identity and the maintenance of the parameters associated with their profile.
Data processed: identification and contact data, access credentials and account-associated data, technical and connection data.
Legal basis: performance of a contract or application of pre-contractual measures (art. 6.1.b GDPR).

Purpose 3. Handling of requests, communications or incidents related to the Service

Description of the purpose: to manage and respond to the requests, queries, incidents or communications that the User submits through the available channels, as well as to keep a record of the actions taken to ensure proper attention and technical or informational support.
Data processed: identification and contact data, data contained in requests, communications or incidents submitted by the User.
Legal basis: performance of a contract or application of pre-contractual measures (art. 6.1.b GDPR).

Purpose 4. Sending of commercial communications related to VINCES' activity

Description of the purpose: to manage the sending, by electronic means, of commercial communications linked to the activities, services, news or content offered by VINCES or related to the Fren Platform, including newsletters, invitations to events, reports, analyses or communications of a similar nature.
Data processed: identification and contact data.
Legal basis: express consent of the data subject (art. 6.1.a GDPR).

Purpose 5. Continuous improvement of the service

Description of the purpose: to evaluate the performance of the system and improve the quality of the responses generated by the conversational assistant. The data will not be used to train the AI models integrated into the Fren Platform unless expressly authorised by the User, who may voluntarily activate the "share data to train Fren" feature.
Data processed: conversational data or prompts, data generated by the Service, usage and analytics data.
Legal basis: legitimate interest of VINCES in maintaining and improving the quality of the Service (art. 6.1.f GDPR).

Purpose 6. Security of the Service

Description of the purpose: to ensure the technical and operational security of the Platform, prevent fraudulent or abusive uses, detect anomalous behaviour, and monitor the integrity of the system.
Data processed: technical and connection data, usage and analytics data.
Legal basis: legitimate interest of VINCES in ensuring the security of the Service (art. 6.1.f GDPR).

Purpose 7. Management of the political affinity test and its results

Description of the purpose: to allow the User to use in Fren the results of the political affinity test taken on Demócrata or on the Platform itself through two features, at their choice: (i) saving them to their account in order to ask the conversational assistant about them; and (ii) sharing them through a link with the people they choose, who, after registering in Fren and taking the test, may obtain together with the User a joint assessment at group level. The test result is calculated in the User's own browser and is purely informative; it does not constitute a voting recommendation. The data will be kept for thirty (30) days from their storage and will be used exclusively for this purpose. They will not be used to train the AI models integrated into Fren, even if the User has activated the "share data to train Fren" feature.
Data processed: data relating to the political affinity test, data generated by the Service linked to the test results, identification and contact data, conversational data or prompts and technical and connection data.
Legal basis: explicit consent of the User, given specifically for each of the features described (arts. 6.1.a and 9.2.a GDPR).

For how long will your data be processed?

Personal data will be retained exclusively for the period necessary to fulfil the purposes for which the data is processed, in accordance with the provisions of the previous section.

Once the data is no longer necessary for the legitimate purpose pursued, it will be deleted in accordance with the provisions of data protection legislation. On occasion, the total deletion of the personal data will be preceded by a blocking phase during the period in which the personal data is blocked, with such data remaining available only at the request of Judges and courts, the Public Prosecutor's Office or the competent Public Administrations, during the limitation period of the actions that may arise. Once the blocking period has elapsed, the data will be completely deleted.

In relation to the conversational data or prompts entered by the User and the data generated by the Service, their retention will be limited to the time strictly necessary for the provision of the Service itself. However, in the case of Users of the free version, said data will be used during the time the "share for model improvement" option remains active, in order to allow the improvement and training of the artificial intelligence systems used by VINCES. When this option is deactivated, the conversational data will be retained solely to enable the basic functioning of the Service, after which it will be deleted or anonymised.

In any case, the User may at any time exercise the possibility of requesting the deletion of their conversations or downloading their history of use of the Service, through the mechanisms available in the Platform.

RECIPIENTS AND INTERNATIONAL TRANSFERS

As a general rule, the User's personal data will not be disclosed to third parties, except in those cases in which such disclosure is necessary for the correct provision of the Service, in order to comply with legal obligations, or where it is necessary to respond to valid requirements of competent authorities.

Nevertheless, in order to ensure the technical functioning of the Platform and enable the processing of certain queries, VINCES may rely on external providers acting as processors, in accordance with the provisions of article 28 of the GDPR. These providers will only process the personal data following documented instructions from VINCES, and may not under any circumstances use it for their own purposes.

In certain cases, the use of this type of technological services necessary for the operation of the Platform may involve the carrying out of international data transfers outside the European Economic Area. In these cases, we guarantee that the providers involved offer an adequate level of protection, applying for this purpose the safeguards provided for in articles 44 to 49 of the GDPR, such as the signing of Standard Contractual Clauses approved by the European Commission or other additional measures that ensure a level of protection equivalent to that established by European legislation.

USER RIGHTS

The User may exercise the following rights:

Access: you have the right to access your data in order to know what personal data concerning you we are processing.
Rectification or erasure of your data: in certain circumstances, you have the right to rectify those personal data concerning you that you consider inaccurate and that are processed by VINCES, as well as the right to request the erasure of your data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
To request the restriction of the processing of your data: in certain circumstances, you will have the right to request that we restrict the processing of your data, in which case we inform you that we will retain only the data for which you have requested restriction of processing for the exercise or defence of claims.
Data portability: in certain circumstances, you will have the right to receive the personal data concerning you, and that you have provided to us, in a structured, commonly used and machine-readable format.
Objection to the processing of data: in certain circumstances, you will have the right to object to the processing of your data, in which case we would stop processing it unless we must continue to do so for compelling legitimate grounds or for the exercise or defence of possible claims.

You may exercise your data protection rights by writing to VINCES at the following email address privacidad@vincesconsulting.com or at the registered office indicated at the beginning of this Privacy Policy.

In addition, Users are informed of their right to lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) in the event of disagreement https://www.aepd.es/.