1. Data Controller
The controller of personal data collected on this platform is BPV Abogados.
- Legal name:
- BPV Abogados [NEEDS_INFO]
- Tax ID:
- [NEEDS_INFO]
- Address:
- [NEEDS_INFO: Madrid address]
- Contact email:
- hola@bpv.velentis.ai
- Data Protection Officer (DPO):
- [NEEDS_INFO: DPO contact, or "no DPO required under Art. 37 RGPD"]
⚖️ Pending legal review.
2. Data Processor
The data processor is VELENTIS, which provides the platform's technical service under a Data Processing Agreement (Art. 28 GDPR) signed with the Controller.
- VELENTIS:
- [NEEDS_INFO: legal form + address]
- Technical contact:
- h.sewing@velentis.eu
3. Data collected
We process the following categories of personal data:
| Category | Data |
|---|---|
| Identification data | Name, email, age, nationality, phone |
| Voice data | Temporary recordings transcribed to text and deleted after transcription |
| Transcripts and summaries | Text generated from consultations with the virtual assistant |
| Payment data | Handled directly by Stripe; BPV does not store card details |
| Usage data | Technical logs, IP address, browser, sessions |
4. Purposes and legal basis
Data is processed for the following purposes:
| Purpose | Legal basis |
|---|---|
| Provision of the virtual advisory service | Contract performance (Art. 6.1.b GDPR) |
| Generation of post-consultation summary | Contract performance (Art. 6.1.b GDPR) |
| Voice and recording processing | Explicit consent (Art. 6.1.a GDPR) |
| Billing and accounting compliance | Legal obligation (Art. 6.1.c GDPR) |
| Compliance with attorney-client privilege | Art. 32 Spanish General Statute of the Legal Profession |
5. Retention periods
Data is retained for the following periods:
| Category | Retention period |
|---|---|
| Voice recordings | Deleted immediately after transcription |
| Consultation transcripts | [NEEDS LEGAL REVIEW: 30 days? BPV's internal policy?] |
| Text summaries | [NEEDS LEGAL REVIEW: 3 years for attorney-client privilege?] |
| Accounting and billing data | 6 years (Art. 30 Spanish Commercial Code) |
| Profile identification data | Until user requests deletion |
⚖️ Pending legal review.
6. Recipients and processors
Data is processed by VELENTIS (main Processor) and by the following sub-processors, all with DPAs and, where applicable, Standard Contractual Clauses (SCC):
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting infrastructure | Germany (EU) |
| Supabase Inc. (via AWS Frankfurt) | Database and authentication | Germany (EU) |
| Anthropic PBC | AI processing (summary generation) | USA — SCC |
| ElevenLabs Inc. | Voice processing | USA — SCC |
| Resend Inc. | Transactional email delivery | USA — SCC |
| Stripe Payments Europe Ltd. (+ Stripe Inc.) | Payment processing | Ireland (EU) + USA — SCC |
7. International transfers
Transfers to the USA are made under Standard Contractual Clauses (SCC) approved by the European Commission, per article 46 GDPR. All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
8. User rights
You have the right to:
- Access your data (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure / right to be forgotten (Art. 17 GDPR)
- Object (Art. 21 GDPR)
- Data portability (Art. 20 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Withdraw consent (Art. 7.3 GDPR)
You can exercise these rights:
- From your account, at /account/data-export (export)
- From your account, at /account/data-delete (full deletion)
- By email to hola@bpv.velentis.ai
9. Complaints to AEPD
If you believe the processing of your data does not comply with regulations, you have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).
10. Attorney-client privilege
The data processed on this platform is subject to attorney-client privilege (Art. 32 of the Spanish General Statute of the Legal Profession). BPV Abogados and VELENTIS, along with all their processors and sub-processors, are contractually obliged to respect this privilege.
11. Changes to this policy
This policy may be updated at any time. Material changes will be notified to users by email and renewed consent will be requested when appropriate.