This is an English translation provided for convenience. In the event of any discrepancy, the Spanish version of this document prevails.
This policy (the "Privacy Policy") applies to the processing of personal data carried out by Sofias through the sofias.ai website and the SOFIAS platform (chat.sofias.ai), as well as in the context of its commercial relationships.
No Data Protection Officer has been appointed, as the circumstances legally requiring one do not apply.
It is important to distinguish two situations, because who decides about the data depends on them:
Sofias acts as Data Controller in respect of the data of people who visit the website, use the public conversational assistant, subscribe to the newsletter, submit a job application, contract the platform or take part in the Sofias partner programme ("Sofias Partners Programme"). Those processing activities are the ones described in section 3 ("What data we process, for what purpose and on what legal basis").
Sofias acts as Data Processor in respect of the personal data that the client organisation (hereinafter, the "Client Organisation") enters or makes accessible through the platform. In that case the Client Organisation is the controller and decides on the purposes; Sofias processes that data only following its instructions. That processing is governed by the "General Terms of Use of the SOFIAS Platform", which constitutes the binding legal act required by data protection legislation, and not by this Privacy Policy.
We process the IP address, technical browser data and the pages visited in order to ensure the operation and security of the site, on the basis of our legitimate interest in maintaining a secure and operational service.
With your consent, obtained through the cookie banner, we analyse site use statistically by means of Google Analytics 4. Without consent, the tool is not activated.
We process the content of the messages, a technical conversation identifier and the name and email address you voluntarily provide, in order to handle your enquiry and, where appropriate, route it to the relevant area. The legal basis is our legitimate interest in handling the enquiries received and, where the enquiry relates to contracting, the performance of pre-contractual steps at your request.
The content is processed by means of artificial intelligence systems on infrastructure located in the European Union and is stored encrypted. It is not used to train artificial intelligence models.
We process your email address in order to send you informational and commercial communications, on the basis of your consent, which may be withdrawn at any time free of charge and without justification.
We process the name, email address, curriculum vitae and the information you provide in order to manage the selection process, on the basis of your consent and of the application of pre-contractual measures.
In order to provide the service we process the contact and identification data of the users designated by the Client Organisation, regardless of their profile — Administrator or Operator — on the basis of the performance of the contract entered into with that organisation.
We likewise process the record of those persons' acceptance of the legal texts, including the date and the version accepted, on the basis of compliance with legal obligations and of our legitimate interest in being able to evidence such acceptance.
The data that the Client Organisation enters into the platform through the agents is processed under a processor arrangement, as explained in section 2 ("Sofias's dual role").
We process identification, tax and billing data in order to manage the programme and settle commissions, on the basis of the performance of the contract and of compliance with legal, tax and accounting obligations.
Sofias's infrastructure — both the website and the platform — is hosted in data centres of Hetzner Online GmbH located in Germany.
The processing carried out by the artificial intelligence agents is performed exclusively on providers established in the European Union, and the content of the conversations does not leave the territory of the Union at any point in the process.
Some ancillary services relating to the website, the newsletter and payment processing correspond to providers whose parent company is in the United States, as detailed in the following section. Those services do not take part in the processing carried out by the agents. In those cases the international transfer relies on the applicable adequacy decisions and, failing that, on standard contractual clauses approved by the European Commission.
| Provider | Service | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the website and the platform | Germany |
| Lyceum | AI agent processing (model inference) | Germany |
| OVHcloud | AI agent processing (model inference) | France |
| Regolo | AI agent processing (model inference) | European Union |
| TensorX | AI agent processing (model inference) | European Union |
| Google Ireland Ltd. / Google LLC | Google Analytics 4 and reCAPTCHA | Ireland / USA |
| Salesforce, Inc. | Newsletter form and management of commercial contacts | USA |
| Stripe Payments Europe, Ltd. | Payment processing and settlement of partner commissions | Ireland / USA |
| Microsoft Ireland Operations Ltd. | Corporate email and, if the user authorises it, connectors to their own email and documents | European Union |
The up-to-date list of sub-processors involved in the provision of the platform service is available on the platform itself, in accordance with the provisions of the "General Terms of Use of the SOFIAS Platform".
In addition, your data may be disclosed to public authorities where there is a legal obligation to do so.
You may exercise the rights of access, rectification, erasure, objection, restriction and portability, as well as withdraw any consent given, without this affecting the lawfulness of the prior processing.
Simply write to support@sofias.ai stating the right you wish to exercise and enclosing a document evidencing your identity. We will respond at the latest within one month of receipt of the request. That period may be extended by a further two months where necessary.
If your data has been entered into the platform by a Client Organisation, address your request to that organisation, which is the controller. If it reaches us, we will tell you who to address it to and will assist that organisation in handling your request.
If you consider that your request has not been dealt with properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
We apply technical and organisational measures appropriate to the risk: encryption of communications and of the content of stored conversations, role-based access control, activity logging and separation of each Client Organisation's data.
The assistants and agents generate responses automatically, but Sofias does not take automated decisions producing legal effects concerning individuals or significantly affecting them. Any decision with contractual effects requires human intervention.
Where a Client Organisation uses the agents for high-risk purposes — for example, in staff selection or performance evaluation processes — it is the Client Organisation itself that assumes the status of deployer and the obligations arising therefrom, including effective human oversight, as detailed in the "General Terms of Use of the SOFIAS Platform".
The use of cookies and equivalent storage technologies is described in the "Cookie Policy".
We may amend this Privacy Policy to adapt it to regulatory or service changes. The version in force is the one published, with its version number and date. Where the change is material, we will communicate it through the available contact channels.
Sofias Tech, S.L. — support@sofias.ai — Paseo Miramón 170, 3rd floor, 20014 Donostia – San Sebastián