Privacy Policy

1. Identification of the Data Controller

The controller of the personal data collected through this website and the Lueira platform is:

• Company name: MALADETA STUDIO, S.L.
• Tax ID (NIF): B02697837
• Registered office: Plaça Naua, 1, Planta 2, Módulo 8, 25538 Casau (Lleida), Spain
• Contact email: rgpd@maladetastudio.com
• Website: www.lueira.com

2. Scope of this policy

This privacy policy describes how MALADETA STUDIO, S.L. (hereinafter, "Lueira") processes personal data as data controller, i.e. when it collects and uses data for its own purposes. This includes:

• The data of visitors to the website www.lueira.com.
• The data of people who request information, a demo, or contact Lueira.
• The data of users who subscribe to and use the Lueira platform (Lueira's customers: companies, self-employed individuals or professionals).

Processing of end-customer data through the platform: When Lueira's customers use the platform to manage the data of their own customers, students or participants (for example, booking, check-in or billing data), Lueira acts as a data processor on behalf of those customers, who are the data controllers. This processing is governed by the Data Processing Agreement (DPA) and not by this privacy policy.

3. Data we collect

Depending on your relationship with Lueira, we may collect the following personal data:

Website visitors:

• Browsing and usage data (through cookies and similar technologies; see our Cookie Policy).

Information and demo requests:

• Identification data: full name.
• Contact data: email address, phone number.
• Company data: company name, sector and, where applicable, tax ID.

Lueira platform users (contracting customers):

• Identification data: full name, username and password (encrypted).
• Contact data: email address, phone number and postal address.
• Company data: company name, sector and tax ID.
• Billing and transaction data: subscription history, amounts, dates and payment references.
• Bank data: account number (IBAN) and holder, when necessary for direct debit of the subscription fee or for managing payments on the platform. The legal basis for this processing is the performance of the subscription contract (art. 6.1.b GDPR) and compliance with tax and accounting legal obligations (art. 6.1.c GDPR).

Users of the WhatsApp AI Assistant:

• When a user interacts with Lueira's automated WhatsApp assistant (for enquiries, demos or support), we collect the content of the messages exchanged, the phone number and data relating to the enquiry or request made. This processing is based on Lueira's legitimate interest in attending to requests from its customers and potential customers (art. 6.1.f GDPR) or performance of the contract when the user is already a customer (art. 6.1.b GDPR).

4. Legal basis for processing

The processing of your personal data is based on the following legal grounds, depending on the specific purpose:

• Performance of a contract (art. 6.1.b GDPR): When data is necessary to provide the contracted service, manage the subscription, issue invoices or handle incidents.
• Compliance with legal obligations (art. 6.1.c GDPR): To comply with tax, accounting or data protection regulations.
• User consent (art. 6.1.a GDPR): To send commercial communications, newsletters or information about product updates. The user may withdraw consent at any time by writing to rgpd@maladetastudio.com.
• Lueira's legitimate interest (art. 6.1.f GDPR): To handle enquiries and information requests from potential customers, and to improve the services provided, provided such interest does not override the rights and freedoms of the data subject.

5. Purposes of processing

The personal data collected may be used for the following purposes:

• To enable access to and the proper functioning of the Lueira platform and the provision of contracted services.
• To manage the sign-up, renewal and cancellation of subscriptions.
• To issue invoices and manage subscription payments, including direct debit where applicable.
• To handle enquiries, demo requests and support incidents.
• To send service communications (technical notices, renewal reminders, changes to terms), which do not require prior consent as they are linked to the contractual relationship.
• To send commercial communications and product updates, only when the user has given prior consent.
• Automated management via AI Assistant: When a user interacts with Lueira's artificial intelligence assistant integrated with WhatsApp, their data is used to respond to the enquiry, manage a demo request or provide support. The system may generate responses automatically. The user may request at any time that their enquiry be handled by a person, by contacting us at support@lueira.com or +34 690 168 045.
• To comply with applicable legal obligations (tax, accounting, data protection).

Lueira will not use its customers' personal data to train its own artificial intelligence models or for any analysis or product development purpose beyond those described in this section.

6. User rights

The user has the right to:

• Access their personal data and obtain information about its processing.
• Rectify inaccurate or incomplete data.
• Request the deletion of their data, when it is no longer necessary for the purpose for which it was collected or when they withdraw their consent.
• Restrict the processing of their data in the cases provided for in art. 18 of the GDPR.
• Object to the processing of their data, in particular when based on Lueira's legitimate interest.
• Request portability of their data in a structured, commonly used format.
• Not be subject to automated decisions with significant effects without human intervention. To request human review of any decision made by the AI Assistant, you may contact support@lueira.com.

To exercise any of these rights, please send an email to rgpd@maladetastudio.com indicating the right you wish to exercise and attaching a copy of your ID document or other valid identity document. Lueira will respond to your request within a maximum of 1 month of receipt, extendable by a further 2 months in cases of special complexity, in accordance with article 12 of the GDPR.

If you consider that your rights have not been properly addressed, you may file a complaint with the Spanish Data Protection Agency (AEPD), through its electronic office at www.aepd.es.

7. Data retention

Personal data will be retained for the periods indicated below, depending on its category:

Once the above periods have elapsed, the data will be blocked and subsequently deleted securely, unless there is a legal obligation for additional retention.

8. Security measures

MALADETA STUDIO adopts technical and organizational measures appropriate to the risk of processing to protect personal data against unauthorized access, loss, alteration or destruction. These include:

• Encryption of data in transit via HTTPS/TLS.
• Encryption of sensitive data at rest (in particular, bank data and passwords).
• Role-based access control with secure authentication.
• Regular backups hosted within the European Economic Area.
• Internal security incident management procedures.
• Regular staff training on data protection matters.

User data is hosted on servers located entirely within the European Economic Area (EEA).

However, the user must be aware that no internet security system is completely infallible.

9. International data transfers

In general, personal data processed by Lueira is hosted and processed within the European Economic Area.

However, some of the providers that Lueira uses to provide its services and operate its website may transfer data to third countries. In these cases, Lueira guarantees that such transfers are carried out with the appropriate safeguards in accordance with Chapter V of the GDPR:

For more information about the safeguards applied to these transfers, you may contact rgpd@maladetastudio.com.

10. Disclosure of data to third parties

Personal data will not be disclosed to third parties without the user's prior consent, except in the following cases:

• Sub-processors necessary to provide the service: Lueira works with technology infrastructure, payment processing and communications providers in order to provide its service. These providers act as sub-processors and are bound to Lueira by the corresponding confidentiality and data protection agreements. The up-to-date list of sub-processors is available in the Data Processing Agreement (DPA).
• Legal obligation: When necessary to comply with a court order, a request from a competent authority or a legally enforceable obligation.
• Website analytics and marketing tools: The website lueira.com uses third-party analytics tools (such as Google Analytics and Meta Pixel) that may collect information about visitor behavior. The use of these tools is subject to user consent and is detailed in our Cookie Policy.

11. Minors

Lueira's services are aimed at companies and professionals. The platform is not intended to be used directly by persons under 14 years old.

If Lueira detects that a registered user is under 14, it will cancel their account and delete their data. For users between 14 and 18 years old accessing the platform, supervision by a parent or legal guardian is recommended.

When Lueira's customers use the platform to manage the data of minors (students, activity participants, etc.), they, as data controllers, are solely responsible for obtaining any legally required consents (in Spain, article 7 of the LOPDGDD establishes that minors under 14 require the consent of their legal representative). Lueira will not assume any responsibility arising from its customers' failure to comply with these obligations.

12. Cookies and tracking technologies

The website lueira.com uses first-party and third-party cookies for the proper functioning of the site, traffic analysis and, with the user's consent, for content personalization and the measurement of advertising campaigns.

For more information about the cookies used, their purposes, durations and how to manage your preferences, see our Cookie Policy.

13. Contact and complaints

For any query about this privacy policy or to exercise your rights, you may contact us through:

• Email: rgpd@maladetastudio.com
• Postal address: Plaça Naua, 1, Planta 2, Módulo 8, 25538 Casau (Lleida), Spain

If you consider that the processing of your data does not comply with applicable regulations, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

14. Changes to this policy

Lueira may update this privacy policy to adapt it to regulatory or case-law changes, or changes to the service's features. When changes are significant, we will notify you through a notice on the platform or by email at least 30 days in advance.

We recommend that you review this policy periodically. The date of the last update always appears at the bottom of this page.