1. INTRODUCTION
At Dopin we respect the privacy of the people we deal with. This Privacy Policy explains which personal data we process, for what purposes and on what legal bases, how long we keep them, with whom we share them and how you can exercise your rights, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD") and Spanish Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce ("LSSI-CE").
This English version is provided for information purposes only. In the event of any discrepancy, the Spanish version shall prevail.
2. DATA CONTROLLER
Company name: Northern Automations, S.L. ("Dopin")
Tax ID (NIF): B27699818
Registered office: Margallo 3, Bajos A, L'Ametlla de Mar, Tarragona, Spain
Privacy contact e-mail: eric.daniel@dopin.ai
Website: https://www.Dopin.ai
Dopin is not required to appoint a Data Protection Officer under Article 37 GDPR and Article 34 LOPDGDD. For any question regarding this Policy, please contact us at the e-mail address above.
3. SCOPE
This Policy applies to the processing operations for which Dopin acts as data controller, in particular in respect of:
Visitors to the Dopin.ai website.
People who request information or a demo, or who contact Dopin through any channel.
Representatives and professionals of companies potentially interested in our services (B2B business prospecting).
Representatives, contact persons and Authorised Users of our clients.
Representatives and contact persons of our suppliers and partners.
Subscribers to our commercial communications.
3.1. Data processed on behalf of our clients
When our clients use the Dopin platform to receive and manage orders (for example, via WhatsApp or e-mail), the personal data of the senders of those orders (our clients' customers, suppliers and business contacts) are processed by Dopin as a data processor, in accordance with Article 28 GDPR and the Data Processing Agreement incorporated into our General Terms and Conditions of Contract. In that case, the data controller is Dopin's client company, whose privacy policy the data subject should consult and before which they may exercise their rights. If Dopin directly receives a request to exercise rights relating to such data, it will forward it without delay to the relevant client.
4. PURPOSES, LEGAL BASES AND RETENTION PERIODS
The processing operations we carry out as controller are detailed below:
4.1. Handling requests for information, contact and demos
| Data processed | Full name, company, job title, e-mail address, telephone number and content of the enquiry. |
|---|---|
| Legal basis | Taking steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR) and, otherwise, our legitimate interest in responding to enquiries received (Art. 6(1)(f) GDPR). |
| Retention period | For as long as necessary to handle the request and, if no contractual relationship is formalised, for a maximum of two (2) years from the last contact. |
4.2. B2B business prospecting
| Data processed | Professional data: full name, job title, company, sector, business e-mail address and telephone number, public professional profile (e.g. LinkedIn) and history of interactions with Dopin. |
|---|---|
| Legal basis | Dopin's legitimate interest in making its services known to companies and professionals who, because of their activity, may be interested in them (Art. 6(1)(f) and Recital 47 GDPR), balanced against the data subject's rights. Processing is limited to professional data and the data subject may object at any time, easily and free of charge, in every communication. Electronic commercial communications are sent in accordance with Article 21 LSSI-CE. |
| Retention period | Until the data subject objects and, in any event, for a maximum of two (2) years from the last interaction. The minimum data of those who have objected will be kept blocked in a suppression list to ensure they are not contacted again (Art. 23 LOPDGDD). |
4.3. Recording and transcription of sales meetings
| Data processed | Voice, image (where applicable), name, company and content of the meeting. |
|---|---|
| Legal basis | The data subject's consent (Art. 6(1)(a) GDPR), which will be requested at the start of the meeting. Refusal will not prevent the meeting from taking place. |
| Retention period | Up to twelve (12) months from the meeting, unless it becomes part of the documentation of a contract, or until consent is withdrawn. |
4.4. Management of the contractual relationship with clients
| Data processed | Identification and contact details of representatives and Authorised Users, access credentials, billing and payment data, communications and support requests, and platform usage logs. |
|---|---|
| Legal basis | Performance of a contract (Art. 6(1)(b) GDPR). For representatives and contact persons of legal entities, legitimate interest pursuant to Article 19 LOPDGDD. |
| Retention period | For the term of the contract and, after its termination, blocked for the limitation periods of the applicable legal actions. |
4.5. Compliance with legal obligations
| Data processed | Billing, accounting and tax data. |
|---|---|
| Legal basis | Compliance with legal obligations (Art. 6(1)(c) GDPR), in particular tax and commercial legislation. |
| Retention period | Six (6) years pursuant to Article 30 of the Spanish Commercial Code and, where applicable, the periods laid down in tax legislation. |
4.6. Commercial communications and newsletter
| Data processed | Name, e-mail address, company and communication preferences. |
|---|---|
| Legal basis | The data subject's consent (Art. 6(1)(a) GDPR) or, for clients, legitimate interest in sending communications about products or services similar to those contracted (Art. 21(2) LSSI-CE). |
| Retention period | Until consent is withdrawn or the data subject objects. |
4.7. Security, operation and improvement of the website and platform
| Data processed | IP address, device and browser identifiers, access and activity logs. |
|---|---|
| Legal basis | Legitimate interest in ensuring the security, availability and proper operation of our systems and in improving our services (Art. 6(1)(f) GDPR). Service improvements are preferably based on aggregated and anonymised data. |
| Retention period | As a general rule, up to twelve (12) months, unless needed to investigate a security incident. |
4.8. Cookies and similar technologies
| Data processed | Browsing data and preferences. |
|---|---|
| Legal basis | Technical cookies are used because they are necessary for the website to function. Analytics or advertising cookies are only set with the user's consent (Art. 22(2) LSSI-CE), which may be withdrawn at any time from the cookie settings panel. |
| Retention period | As indicated in our Cookie Policy. |
4.9. Management of suppliers and partners
| Data processed | Professional identification and contact details of representatives and contact persons. |
|---|---|
| Legal basis | Performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest pursuant to Article 19 LOPDGDD. |
| Retention period | For the duration of the relationship and, thereafter, blocked for the statutory limitation periods. |
Where processing is based on legitimate interest, Dopin has carried out a balancing test between that interest and the rights and freedoms of data subjects. You may request information about that assessment at the contact address indicated.
Once the retention periods have elapsed, the data will be deleted or anonymised. Where required by law, they will remain blocked, available exclusively to judges and courts, the Public Prosecutor's Office or the competent Public Administrations, for the limitation period of any potential liabilities (Art. 32 LOPDGDD).
5. SOURCE OF THE DATA
As a general rule, data are obtained directly from the data subject or from the company they represent. In the case of B2B business prospecting, professional data may be obtained from publicly accessible sources (such as corporate websites, commercial registers or public professional profiles) and from B2B commercial data providers that state they have obtained them lawfully. In these cases, Dopin will provide the data subject with the information required by Article 14 GDPR at the latest at the time of the first communication addressed to them. The categories of data obtained in this way are those indicated in section 4.2.
6. MANDATORY DATA
Fields marked as mandatory in our forms are necessary to handle your request or provide the service; if they are not provided, we will be unable to do so. The data subject warrants that the data provided are true and up to date and undertakes to notify any changes. Where you provide data of third parties (for example, other Authorised Users of your organisation), you represent that you have informed them and have a sufficient legal basis to do so.
7. RECIPIENTS OF THE DATA
Dopin does not sell or disclose personal data to third parties. Data may only be disclosed to:
Providers that render services to Dopin as data processors, with which the relevant agreements under Article 28 GDPR have been entered into, belonging to the following categories: cloud hosting and infrastructure; e-mail and communications (including the WhatsApp Business platform of Meta Platforms, Inc.); artificial intelligence services; CRM, prospecting and sales automation tools; meeting recording and transcription; payment gateway; and accounting, tax and legal advisers.
Public Administrations, Courts and other competent authorities, where there is a legal obligation.
Banks and financial institutions, for the management of collections and payments.
Where applicable, third-party acquirers or successors in the context of a corporate transaction (merger, acquisition or transfer of the business), subject to appropriate safeguards.
You may request the up-to-date list of providers at the contact address indicated.
8. INTERNATIONAL TRANSFERS
Some of our providers (for example, of cloud infrastructure, communications, artificial intelligence or sales tools) may be located, or may access the data, outside the European Economic Area, in particular in the United States. In such cases, transfers are carried out with the safeguards provided for in Chapter V GDPR: adequacy decisions of the European Commission (including the EU-U.S. Data Privacy Framework in respect of certified entities) or, failing that, the standard contractual clauses approved by the European Commission, together with any necessary supplementary measures. You may request further information or a copy of those safeguards at the contact address indicated.
9. ARTIFICIAL INTELLIGENCE AND AUTOMATED DECISION-MAKING
Dopin uses artificial intelligence systems to provide its services, always with human oversight. Dopin does not take, in respect of the data subjects covered by this Policy, decisions based solely on automated processing, including profiling, which produce legal effects concerning them or similarly significantly affect them (Art. 22 GDPR). Personal data processed as controller are not used to train third-party artificial intelligence models.
Where a person interacts with a Dopin artificial intelligence system (for example, an assistant that drafts or replies to messages), they will be clearly informed of this at the latest at the time of the first interaction, in accordance with Article 50 of Regulation (EU) 2024/1689 on Artificial Intelligence.
10. DATA SUBJECTS' RIGHTS
Any person may exercise the following rights in relation to their personal data:
Access: to know whether we process their data and obtain a copy.
Rectification: to correct inaccurate data or complete incomplete data.
Erasure: to request deletion of their data where, among other reasons, it is no longer necessary.
Objection: to object to processing based on legitimate interest and, in all cases, to processing for direct marketing purposes.
Restriction of processing: to request that processing be suspended in the cases provided for by law.
Portability: to receive the data provided in a structured, commonly used and machine-readable format and transmit them to another controller, where processing is based on consent or a contract and carried out by automated means.
Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
Not to be subject to automated individual decision-making under the terms of Article 22 GDPR.
To exercise your rights, you may send a request to eric.daniel@dopin.ai or by post to the address indicated in section 2, stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it. We will respond within one (1) month of receipt of the request, which may be extended by a further two (2) months where necessary, taking into account the complexity and number of requests, in which case we will inform you. Exercising these rights is free of charge.
You may unsubscribe from our commercial communications at any time using the link included in each communication or by replying to it.
If you consider that the processing of your data does not comply with the applicable legislation, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid; www.aepd.es) or with the supervisory authority of your Member State of residence. We invite you to contact us first so that we can try to resolve any issue.
11. SECURITY
Dopin applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, including encryption of communications, least-privilege access control, user authentication, backups and confidentiality obligations for staff. In the event of a personal data breach, Dopin will act in accordance with Articles 33 and 34 GDPR.
12. MINORS
Dopin's services are aimed exclusively at companies and professionals. Dopin does not knowingly collect data from children under fourteen (14) years of age. If you become aware that a minor's data have been provided to us, please let us know so that we can delete them.
13. LINKS TO THIRD-PARTY SITES
Our website may contain links to third-party websites or social networks (for example, LinkedIn). Dopin is not responsible for the privacy practices of those third parties, so we recommend that you review their respective policies.
14. CHANGES TO THIS POLICY
Dopin may update this Policy to adapt it to legislative or case-law changes or to changes in its services. The current version will always be available at Dopin.ai/privacidad, indicating its date of update. Where changes are substantial, we will notify you through the usual channels.