// LEGAL

Privacy Policy

We're based in the EU, so data protection isn't optional for us. Here's exactly what we collect, why, and what we do with it.

Last updated: March 2026 · Effective date: March 2026

Controller: RZZ Consulting S.L.U., registered in Spain. This policy governs the processing of personal data in connection with the Polpo 8 platform and website (polpo-8.com). It is written to comply with the General Data Protection Regulation (GDPR) and applicable Spanish data protection law.

1. Who We Are

Polpo 8 is a product of RZZ Consulting S.L.U., a company incorporated and registered under Spanish law. When this policy refers to "we," "us," or "our," it refers to RZZ Consulting S.L.U. as the data controller.

Contact for data protection matters: privacy@polpo-8.com

2. Data We Collect

2.1 Information you provide

  • Contact form submissions: name, email address, company name, the message content you write, and any other information you choose to include.
  • Account information (if applicable): credentials, profile details, and preferences for accessing the Polpo 8 platform.
  • Communications with us via email or other channels.

2.2 Information collected automatically

  • Server logs: IP address, browser type, operating system, referring URL, pages visited, and timestamp of visits.
  • Analytics data: aggregated information about how visitors interact with the website. We use privacy-respecting analytics that do not build persistent individual profiles.
  • Technical data necessary for the platform to function.

2.3 Client data processed on your behalf

When you use Polpo 8 as a business client, you may provide data for the platform to process — documents, datasets, content, customer information. For this data, you are the data controller and we act as data processor. Our processing is governed by the Data Processing Agreement (DPA) signed as part of your client contract.

3. Legal Bases for Processing

Under GDPR, we process your personal data under the following legal bases:

  • Contract performance (Article 6(1)(b)): Processing necessary to provide the Polpo 8 service you have engaged.
  • Legitimate interests (Article 6(1)(f)): Responding to inquiries, maintaining website security, and improving our service, where this does not override your rights.
  • Legal obligation (Article 6(1)(c)): Where processing is required to comply with EU or Spanish law.
  • Consent (Article 6(1)(a)): Where we specifically request consent (e.g., for marketing communications). You may withdraw consent at any time.

4. How We Use Your Data

  • To respond to your contact form submissions and enquiries.
  • To provide, operate, and improve the Polpo 8 platform and services.
  • To send transactional communications relating to your use of our services.
  • To comply with legal and regulatory obligations.
  • To detect and prevent fraud, security breaches, and abuse.
  • To conduct internal analytics to understand how our website and platform are used in aggregate.

We do not sell your personal data. We do not use personal data for targeted advertising on third-party platforms.

5. Data Sharing

We share personal data only in the following circumstances:

  • Service providers: Third-party processors who provide infrastructure, hosting, email, or analytics services, operating under data processing agreements with appropriate safeguards.
  • AI model providers: Specifically, OneFirewall.ai, whose models power Polpo 8's AI capabilities. Data shared with them is governed by applicable data processing agreements.
  • Legal requirements: Where disclosure is required by law, court order, or competent regulatory authority.
  • Business transfers: In the event of a merger, acquisition, or sale, with notice to you as required by law.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes outlined in this policy, or as required by law:

  • Contact form data: retained for up to 3 years, or until you request deletion.
  • Client account data: retained for the duration of the client relationship plus 6 years for legal and financial compliance purposes.
  • Server logs: retained for up to 90 days for security purposes.

7. Your Rights

Under GDPR, you have the following rights regarding your personal data:

  • Right of access — request a copy of the personal data we hold about you.
  • Right to rectification — request correction of inaccurate or incomplete data.
  • Right to erasure — request deletion of your data, subject to legal retention requirements.
  • Right to restriction — request that we limit processing of your data in certain circumstances.
  • Right to data portability — receive your data in a machine-readable format.
  • Right to object — object to processing based on legitimate interests or for direct marketing.
  • Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, contact us at privacy@polpo-8.com. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at aepd.es.

8. Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our AI infrastructure via OneFirewall.ai includes enterprise-grade security controls designed for regulated industries.

No transmission over the internet is completely secure. While we do our best, we cannot guarantee the absolute security of data transmitted to us.

9. International Transfers

We are based in Spain (EU) and aim to process data within the EEA where possible. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) as required by GDPR Chapter V.

10. Cookies

This website uses minimal cookies necessary for the site to function correctly (session management, security). We do not currently use third-party advertising cookies or cross-site tracking cookies. Analytics, where used, are configured to avoid storing personally identifiable information.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by updating the "last updated" date and, where appropriate, via direct communication to clients.

12. Contact

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, contact us at:

RZZ Consulting S.L.U.
Email: privacy@polpo-8.com
Jurisdiction: Spain, European Union