1. Data controller
- Controller: Global de Innovaciones, S.L. (hereinafter, “GDI”)
- Tax identification number (NIF): B85236289
- Address: Calle Velázquez 27, 1.º Izquierda, 28001 Madrid, Spain
- Data protection email: lopd@gdi.live
- Registration details: registered with the Madrid Commercial Registry, Volume 24,861, Folio 18, Sheet M-447.555
GDI has not appointed a Data Protection Officer because none of the circumstances set out in Article 37 of Regulation (EU) 2016/679 (hereinafter, the “GDPR”) applies. Questions about this policy may be sent to lopd@gdi.live.
2. Scope
This policy explains how GDI processes the personal data of people who visit www.gdi.live, complete its forms, interact with the artificial intelligence conversational assistant available on the website, or engage in commercial communications with GDI. It is complemented by the Cookie Policy and Legal Notice, both available on the website.
3. Processing activities
Contact form
Data processed: name, email address, telephone number, company and message content.
Purpose: to respond to requests for information and, where appropriate, send a commercial proposal.
Legal basis: pre-contractual measures (Article 6(1)(b) GDPR) and consent (Article 6(1)(a) GDPR).
Retention: 12 months from the last contact if no commercial relationship begins; if a relationship begins, for its duration and for 6 years afterwards (Article 30 of the Spanish Commercial Code).
Artificial intelligence conversational assistant
Data processed: conversation content, session identifier, IP address, technical data and any contact details provided by the user.
Purpose: to answer enquiries, guide users, generate commercial opportunities and audit service quality and security.
Legal basis: legitimate interests (Article 6(1)(f) GDPR), pre-contractual measures (Article 6(1)(b) GDPR) and consent when users provide their data (Article 6(1)(a) GDPR).
Retention: 12 months from the last interaction.
Commercial communications and newsletter
Data processed: name, email address and company.
Purpose: to send information about GDI’s services, content and events.
Legal basis: consent (Article 6(1)(a) GDPR) and, for customers, Article 21(2) of the LSSI in relation to similar services.
Retention: until the recipient unsubscribes or objects.
Cookies and service preferences
Data processed: IP address, session identifiers and technical device data.
Purpose: to remember user preferences, enable browsing and activate the conversational assistant only when authorised by the user.
Legal basis: storage necessary to manage the user’s choice and prior consent to activate the optional assistant, as described in the Cookie Policy.
Retention: as specified for each item in the Cookie Policy.
Commercial relationship management, invoicing and regulatory compliance
Data processed: identification, contact and billing details.
Purpose: contract performance, accounting and tax obligations, and defence against claims.
Legal basis: contract performance (Article 6(1)(b)), legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)).
Retention: the applicable statutory limitation periods in each case.
Where processing is based on consent, users may withdraw it at any time without affecting the lawfulness of earlier processing. Where processing is based on legitimate interests, users may object on grounds relating to their particular situation, in accordance with Article 21 GDPR.
Form fields marked as mandatory are necessary to handle the request. If they are not completed, GDI will be unable to process it.
4. Artificial intelligence conversational assistant
The website includes an artificial intelligence conversational assistant (hereinafter, the “Assistant”). In accordance with Article 50(1) of Regulation (EU) 2024/1689 on Artificial Intelligence, users are expressly informed that, when using the Assistant, they are interacting with an artificial intelligence system and not with a human being.
- Data processed: the content of messages entered by users, generated responses, session identifier, timestamp, language, IP address and technical device data, together with any identification or contact details that users voluntarily provide during the conversation.
- Purpose: to answer questions about GDI’s services, guide users, generate and qualify commercial opportunities, and audit and improve the Assistant’s quality and security.
- Legal basis: GDI’s legitimate interest in answering potential customers’ enquiries and maintaining service security (Article 6(1)(f) GDPR); pre-contractual measures when users request information or a proposal (Article 6(1)(b) GDPR); and consent when users voluntarily provide contact details in order to be contacted (Article 6(1)(a) GDPR).
- Retention: conversations are retained for a maximum of twelve (12) months from the last interaction, unless a commercial relationship results from the conversation, in which case they are retained as specified in the corresponding section above, or unless retention is necessary for the establishment, exercise or defence of legal claims. Conversation content is stored on the service platform’s servers, not in the user’s browser.
- No automated decisions: the Assistant does not make automated decisions that produce legal effects concerning users or similarly significantly affect them within the meaning of Article 22 GDPR. Every proposal, quotation or contractual commitment is reviewed and issued by a member of the GDI team.
- Data processor: the Assistant is provided through a conversational assistant technology platform acting as a data processor under an agreement entered into in accordance with Article 28 GDPR. The platform hosts data on servers and databases located in the European Union, encrypted at rest and in transit.
- Sub-processors: the platform uses sub-processors to deliver the service, including a language model provider established in the United States, as well as infrastructure and content delivery providers. GDI will provide an up-to-date list of sub-processors to anyone requesting it at lopd@gdi.live.
- Providers’ use of data: under the contractual terms agreed with the platform, data is processed only on GDI’s instructions, is not disclosed to third parties without consent, and is not used for commercialisation or advertising purposes.
- Assistant limitations: its responses are for general information and guidance only, may contain errors or outdated information, and do not constitute professional, technical, legal, tax or financial advice or create any obligation for GDI. Users may request assistance from a member of the GDI team at any time by emailing info@gdi.live or using the contact form.
- Data that should not be entered: users are advised not to provide the Assistant with special categories of personal data under Article 9 GDPR (including health data, beliefs, trade union membership or biometric data), third parties’ personal data without their consent, access credentials, payment details or confidential information about their organisation.
- Minors: the Assistant and website are not intended for children under fourteen (14). GDI does not knowingly collect data from children below that age; if identified, such data will be deleted.
5. Data recipients
GDI does not disclose personal data to third parties unless required by law. The following types of providers are involved in operating the website and delivering its services:
- Hosting, content delivery and contact enquiry management provider: Netlify (including Netlify Forms).
- Security services associated with external providers, including Cloudflare within the conversational assistant service.
- The conversational assistant technology platform, hosted in the European Union, and its sub-processors, including the language model provider.
- Email and, where applicable, commercial communications provider: GoDaddy.
- GDI’s accounting, tax and legal advisers, where necessary.
Data may also be disclosed to public authorities, courts and law enforcement bodies where there is a legal obligation to do so.
6. International data transfers
Although the conversational assistant platform hosts data on servers located in the European Union, some sub-processors involved in delivering the service are established outside the European Economic Area, particularly the language model provider and certain infrastructure, security and content delivery providers based in the United States. This may also apply to other providers listed above. In such cases, GDI relies on one of the following safeguards under Chapter V GDPR:
- A European Commission adequacy decision applicable to the country or relevant certification framework, where available.
- Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, supplemented where appropriate by additional technical and organisational measures following the relevant transfer impact assessment.
Users may request information about the safeguards applied and a copy of them by emailing lopd@gdi.live.
7. User rights
Users may exercise the following rights free of charge:
- Access: to find out what personal data GDI processes and obtain a copy.
- Rectification: to request correction of inaccurate or incomplete data.
- Erasure: to request deletion of data when it is no longer necessary or when consent is withdrawn.
- Restriction of processing: to request that data be retained but not processed in the circumstances provided for by law.
- Data portability: to receive data in a structured, commonly used format or request its transmission to another controller.
- Objection: to object to processing based on legitimate interests, including commercial profiling, and to object at any time, without giving reasons, to processing for direct marketing purposes.
- Not to be subject to individual automated decisions producing legal or similarly significant effects.
- To withdraw consent at any time, without retroactive effect.
To exercise these rights, send a request to lopd@gdi.live or Calle Velázquez 27, 1.º Izquierda, 28001 Madrid, identifying the right you wish to exercise and enclosing a document establishing your identity. GDI will respond within one month, which may be extended by two further months in particularly complex cases.
Users may unsubscribe from commercial communications at any time using the link included in each message or by emailing lopd@gdi.live.
If users consider that their rights have not been properly addressed, they may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid; www.aepd.es), the competent supervisory authority in Spain.
8. Information security
GDI has adopted appropriate technical and organisational measures to ensure a level of security proportionate to the risk, in accordance with Article 32 GDPR. These include HTTPS encryption, role-based access controls, data minimisation and the engagement of providers offering sufficient safeguards. If a personal data breach occurs that is likely to result in a high risk to individuals’ rights and freedoms, GDI will notify the supervisory authority and the affected individuals within the legally prescribed time limits.
9. Data accuracy and policy updates
Users warrant that the data they provide is true, accurate and up to date, and undertake to notify GDI of any changes. When providing third parties’ data, users warrant that they have previously informed those parties of this policy’s content.
GDI may amend this policy to reflect changes in legislation, case law or website operations. The applicable version will always be the one published on the website, indicating the date of its latest update.