Privacy Policy

OUR PRIVACY POLICY AT A GLANCE

Who are we? We are HUMAN DATA INSTITUTE, S.L. and we process your data as data controller. This means that we are responsible for how your personal data is used and protected.

What do we use your data for? We use the data you provide to us to respond to your enquiries, manage your access to the website and to your personal area, enable you to take tests and questionnaires, generate personalised reports and results, keep your history, process contracts or licences and improve our services. The data may also be processed to enable client companies and authorised partners to manage campaigns, evaluations, organisational studies, onboarding, offboarding, assessment or recruitment processes through the platform, as well as to generate reports, aggregated metrics, sector comparisons, benchmarks and statistical research linked to the services provided by HUMAN DATA INSTITUTE, S.L.

Why do we hold it? We are entitled to process your data for different reasons, depending on the specific purpose: your consent, the performance of a contract or the application of pre-contractual measures, compliance with legal obligations and, in certain cases, our duly balanced legitimate interest.

Who do we share your data with? We will only share data with partner companies in order to handle the requests received and provide our services or supply the products, with banking entities and with bodies required by law. Under no circumstances do we sell your data to third parties.

What rights do you have? You have the right to access, rectify or erase your personal data. You also have the right to object to the processing of your data in certain cases, to request the restriction of its processing, to data portability and not to be subject to decisions based solely on automated processing, including profiling, where they produce legal effects concerning you or similarly significantly affect you.

In processing your personal data, we apply the following principles to guarantee you the highest level of protection:

• Principle of lawfulness, fairness and transparency: We will always process your personal data on the basis of a legitimate ground provided for in the regulations and we will inform you in advance, clearly and transparently, of the purposes of the processing.
• Principle of data minimisation: We will only request data that is strictly necessary in relation to the purposes for which we require it. The minimum possible.
• Principle of storage limitation: data will be kept for no longer than is necessary for the purposes of the processing; depending on the purpose, we will inform you of the corresponding retention period. In the case of subscriptions, we will periodically review our lists and delete records that have been inactive for a considerable time.
• Principle of integrity and confidentiality: Your data will be processed in a manner that ensures appropriate security and confidentiality of personal data. Please be aware that we take all necessary precautions to prevent unauthorised access to or misuse of our users' data by third parties.

In this privacy policy you will find more detailed information about how we use the personal data of our clients, suppliers, users, survey participants and, in general, of everyone who is in contact with us, regardless of the means they have used to communicate with us (online form, telephone, email or in person).

We like to be transparent about what we do with your personal data, so that you understand the implications of the uses we make of it and the rights you have in relation to your data. For this reason, we keep our Privacy Policy, Legal Notice and Cookie Policy up to date; you can consult this information on this website.

If you have any questions or would like more information about the privacy policy, please read on.

1. WHO IS THE CONTROLLER OF YOUR DATA?

The controller of your data is HUMAN DATA INSTITUTE, S.L.:

Identity: HUMAN DATA INSTITUTE, S.L. - B02764652
Address: Agustín de Foxá 40, 28036 - Madrid (Madrid)
Website: www.dathum.com
Email: gdpr@dathum.io
Data Protection Officer: Aixa Corpore, S.L.
DPO email: aixa4291@dpocanarias.com

HUMAN DATA INSTITUTE, S.L. informs users that the data they provide by browsing our website, through the various data collection forms or by sending emails will be processed by HUMAN DATA INSTITUTE, S.L. and that such processing is included in the Record of Processing Activities managed by HUMAN DATA INSTITUTE, S.L. in accordance with the GDPR.

2. WHAT IS YOUR PERSONAL DATA USED FOR?

At www.dathum.io, we process data from both the users of our website and third parties who have relationships with us. To help you understand how we process your data, we have distinguished the purpose for which we use the data, the types of data and the legal basis according to the category of persons whose data we process. Below, we classify the persons whose data we process according to the type of relationship they have with HUMAN DATA INSTITUTE, S.L.

WEBSITE USERS

What data do we collect from users of our website?

1. Data of users who fill in any of the available forms: The personal data requested by HUMAN DATA INSTITUTE, S.L. includes:
   • Identification data: name and surname, telephone number, postal and email address
   • Data relating to the request
2. Data of users who browse our website: Data provided by cookies and by Google Analytics.
3. Data provided through the conversational assistant: identification and contact data (name, email address, telephone number, company, tax ID or similar), as well as any information the user voluntarily provides during the conversation, including that necessary to answer enquiries, prepare quotes or provide information about the products and services of HUMAN DATA INSTITUTE, S.L.

For what purposes will we process your personal data?

We will process the personal data provided by the user where necessary to handle their request, manage the pre-contractual or contractual relationship, comply with legal obligations or, where applicable, on the basis of the consent given, for the following processing operations:

• Sending the information and providing the service requested through the various forms available on our website.
• Preparing statistical studies to assess the success of campaigns / the channels through which the user learned about a service provided by HUMAN DATA INSTITUTE, S.L. This data is collected for statistical purposes only and is for the internal use of HUMAN DATA INSTITUTE, S.L.
• Enabling the use of the artificial intelligence-based conversational assistant to answer commercial enquiries, provide information about our products and services and guide the user on the features of the platform.
• Preparing personalised quotes, handling pre-contractual requests and maintaining communications relating to the information or financial proposal requested.
• Automatically generating responses using artificial intelligence based on the information voluntarily provided by the user during the conversation.

How do we obtain your data?

We obtain your data through:

• The form completed by the website user for the purpose stated therein. The form is subject to acceptance of this privacy policy by ticking the box provided.
• The voluntary use of the conversational assistant available on the website and the information the user enters during the conversation.

What is the legal basis for processing your data?

The express consent of the user (Article 6.1.a GDPR), given by completing the various forms and ticking the box, is what legitimises the processing by HUMAN DATA INSTITUTE, S.L. The user may withdraw the consent given at any time; however, withdrawal of consent does not affect processing carried out prior to the withdrawal.

The legitimate interest in creating browsing profiles and detecting preferences through the installation of cookies.

The performance of a contract or the adoption of pre-contractual measures when the client makes a request through the various forms available to the user on our website or requests information about the services provided by HUMAN DATA INSTITUTE, S.L.

When the user uses the conversational assistant to request information, commercial advice or a quote, the processing of data will also be based on the application of pre-contractual measures requested by the data subject and, where applicable, on the consent given through the voluntary use of that feature.

TEST AND PERSONAL PORTAL USERS

What data do we collect?

1. Identification data provided by the user: name and surname, email address and, where applicable, login or registration data for the personal area.
2. Data derived from taking tests, questionnaires or surveys: responses provided by the user, results obtained, reports generated and historical evolution of results.
3. Demographic and professional data provided by the user, such as age range, gender, employment status, sector of activity or other similar data necessary to contextualise the results or make aggregated comparisons.
4. Technical data associated with the use of the personal portal, such as logins, language, interactions with the platform and report downloads.

How do we obtain your data?
We obtain your data through:

• The test access form available on the website.
• The user's registration and sign-up in their personal portal or area.
• The voluntary completion of additional questionnaires or demographic data.
• The continued use of the personal portal and the periodic updating of tests or surveys.

For what purposes will we process your personal data?

• Enabling the requested test or questionnaire to be taken.
• Generating, displaying and sending the user their personalised results and reports.
• Managing the registration, authentication and maintenance of their account on the personal portal.
• Keeping the history of results and enabling it to be consulted, downloaded and tracked over time.
• Offering indicative comparisons with results aggregated by groups or sectors, without identifying third parties or entities.
• Enabling the user to periodically update their questionnaires and view the evolution of their results over time.
• Handling enquiries, technical incidents or requests related to the use of the platform.
• Improving the quality, functionality and reliability of the service.
• Enabling the user to take part in campaigns, evaluation processes, organisational studies or recruitment processes managed by client companies or authorised partners through the platform.
• Generating aggregated metrics, indicative comparisons, benchmarks and statistical analyses linked to sectors, profiles or reference groups, applying pseudonymisation, minimisation and data aggregation measures.
• Enabling the use of artificial intelligence-based conversational assistance features integrated into the platform to answer queries related to the reports, results, features or information available to the user.
• The queries made by the user, as well as any information they voluntarily enter or upload through documents or files, may be processed solely for the purpose of generating the requested response, improving the user experience, ensuring the security of the service and resolving technical incidents.
• Users are advised not to enter personal data of third parties, special categories of data, confidential information or trade secrets unless strictly necessary for the query made. In any case, the user must limit the information provided to what is strictly necessary to formulate their query.

What is the legal basis for processing your data?

The legal basis for the processing will be:

The performance of the contractual relationship or the application of pre-contractual measures, when the user requests access to the test, registers on the personal portal or purchases a licence.

The consent of the data subject, for processing operations that require it, in particular when optional data is provided voluntarily.
The legitimate interest of HUMAN DATA INSTITUTE, S.L. in ensuring the security of the platform, preventing misuse and improving the service, always respecting the rights and freedoms of data subjects.

Profiling: Taking tests, questionnaires and evaluation processes involves the use of automated procedures aimed at analysing the responses provided by the user and generating results, classifications, metrics, reports and comparisons according to predefined parameters and rules.

These processing operations may be used by client companies as a support tool in organisational, internal evaluation, professional development, onboarding, offboarding or recruitment processes. HUMAN DATA INSTITUTE, S.L. does not make its own automated decisions producing direct legal effects on the data subject without human intervention by the client entity responsible for the corresponding process.

Use of the Artificial Intelligence-based conversational assistant: The platform incorporates generative artificial intelligence features that allow the user to interact through a conversational assistant to help interpret reports, results and other available features.

The responses generated are produced automatically by artificial intelligence models and are merely informative or supportive in nature, so they should be reviewed by the user before making decisions based on their content.

The responses generated may contain errors, inaccuracies or incomplete information and do not replace any professional, technical or legal advice that may be necessary.

The user is responsible for the information they decide to enter during the conversation and guarantees that they are sufficiently entitled to communicate any personal data they may provide.

HUMAN DATA INSTITUTE, S.L. expressly recommends not entering personal data of third parties, special categories of data under Article 9 of the GDPR, confidential information or trade secrets unless strictly necessary for the provision of the requested service.

To the extent necessary for the provision of the service, the queries and information voluntarily entered by the user may be processed by technology providers specialising in artificial intelligence acting on behalf of HUMAN DATA INSTITUTE, S.L., as data processors or, where applicable, in accordance with the applicable legal regime. These providers will be subject to the safeguards required by data protection regulations and to the corresponding contractual instruments.

The use of the conversational assistant does not involve automated decisions producing legal effects on the user within the meaning of Article 22 of Regulation (EU) 2016/679.

CLIENTS

What data do we collect from our clients?

1. Data of clients who fill in any of the forms available at www.dathum.io or at the physical premises of HUMAN DATA INSTITUTE, S.L.
   • Identification data: name and surname, telephone number, postal and email address
   • Data relating to the request

How do we obtain your data?

If you are an online client, we obtain your data through: The information request form completed by the user. The form is subject to acceptance of this privacy policy by ticking the box provided.

• We obtain browsing data from the various cookies the client accepts when first accessing www.dathum.io.
• Through the online contracting or purchase form.

If you are an in-person client, we obtain your data through:

• The client registration form.
• Acceptance of the quote submitted.
• The signed contract.

For what purposes will we process your personal data?

• Generating and managing the documentation associated with your requests and purchases.
• Providing you with information about offers, products and services related to your purchase.
• Processing your online purchase or the contracting of licences, access or paid features of the platform.

What is the legal basis for processing your data?

The performance of a pre-contract/contract to send you the information and manage the service provided or the product supplied, which would not be possible otherwise.

The user may withdraw the consent given at any time.

SOCIAL MEDIA CONTACTS

What data do we collect?

1. Identification data on the social network: HUMAN DATA INSTITUTE, S.L. will not request any data beyond what you have included in your user profile.

For what purposes will we process your personal data?

Answering and managing your enquiries, requests or petitions.

Interacting with you while you are part of our community of followers.

What is the legal basis for processing your data?

The performance of a pre-contract/contract binding you to the relevant social network and in accordance with its privacy policies:

Facebook http://www.facebook.com/policy.php?ref=pf

Instagram https://help.instagram.com/155833707900388

Twitter http://twitter.com/privacy

LinkedIn http://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

Pinterest https://about.pinterest.com/es/privacy-policy

YouTube https://policies.google.com/privacy?hl=es&gl=es

www.dathum.io will at all times endeavour to establish appropriate mechanisms to obtain the User's consent for the installation of cookies that require it. When a user accesses our website, a pop-up appears informing them of the existence of cookies and that, if they continue browsing our site, they consent to the installation of cookies. Accepting the installation of cookies entails accepting that the IP address will be stored in the records of www.dathum.io, together with the date of acceptance, for a period of one year, in order to demonstrate the consent given. You can find more information in our “Cookie Policy”.

SURVEY PARTICIPANTS

What data do we collect?

1. Corporate or personal email address provided by the participant or by a client company entitled to carry out the corresponding study, evaluation or process.
2. Demographic data provided by the participant or by the client.

How do we obtain your data?

We obtain your data through the client company that provides access to the study or evaluation, or directly from the participant through the form or questionnaire they voluntarily complete on the website or in their personal portal.

For what purposes will we process your personal data?

a) In the case of team engagement surveys for a client company, preparing aggregated and pseudonymised reports for the client company.

b) In the case of individual studies or personalised assessments, preparing individual and personalised reports for the client company and/or for the participant who requests them.

c) Preparing reports, comparative analyses, research and demographic or sociological studies, always in an aggregated, pseudonymised and/or anonymised form, avoiding the direct identification of natural persons and, where applicable, of client entities.

d) Ensuring the quality and reliability of the study.

e) Managing the sending of electronic communications linked to campaigns, questionnaires, evaluation processes or participation in organisational studies promoted by client companies or authorised partners through technology tools integrated into the platform.

What is the legal basis for processing your data?

The express consent of the user (Article 6.1.a GDPR), given by completing the various forms and ticking the box, is what legitimises the processing by HUMAN DATA INSTITUTE, S.L. The user may withdraw the consent given at any time; however, withdrawal of consent does not affect processing carried out prior to the withdrawal.

The legitimate interest of the client company in evaluating internal aspects or for professional assessment.

The performance of a pre-contract/contract to send you the information and manage the service provided or the product supplied, which would not be possible otherwise.

3. HOW LONG DO WE KEEP YOUR DATA?

WEBSITE USERS

Data processed on the basis of the website user's consent will be kept for as long as it remains relevant to the purpose for which it was collected and consent has not been withdrawn.

For data processed on the basis of legitimate interest, the retention period will be linked to the reason for which the data was collected, always ensuring appropriate safeguards and respect for the rights and freedoms of data subjects.

For data processed on the basis of the performance of a contract or the adoption of pre-contractual measures, the retention period will be the period during which the contractual relationship remains in force, plus any further period for which it must be kept by legal obligation.

The IP address obtained through cookies will be kept for one year in order to demonstrate the user's consent.

For the retention period of cookies, you can find more information on our website in the “Cookie Policy” section.

TEST AND PERSONAL PORTAL USERS

Account and personal portal data will be kept for as long as the user keeps their account active or for as long as it is necessary to provide the requested service.

Historical results will be kept for as long as the user keeps their account active and, once the relationship has ended, for the legally required periods to address any possible liabilities.

Conversations held through the conversational assistants available on the platform or on the website will be kept only for as long as necessary to provide the service, handle technical incidents, ensure the security of the platform or comply with legal obligations, after which they will be deleted or anonymised where possible.

Aggregated or anonymised data, or data that does not allow the data subject to be identified, may be kept for statistical, service improvement or research purposes.

CLIENTS

Data processed on the basis of the client's consent will be kept for as long as it remains relevant to the purpose for which it was collected and consent has not been withdrawn.

For data processed on the basis of legitimate interest, the retention period will be linked to the reason for which the data was collected, always ensuring appropriate safeguards and respect for the rights and freedoms of data subjects.

Data processed on the basis of a contract, or where part of the processing is based on a legal obligation, will be kept for as long as the contractual relationship remains in force. Once it has ended, where the processing is linked to a legal obligation, the retention period will be that provided for by law, and the data subject may not revoke the processing of the data except in the cases of blocking provided for by law.

SOCIAL MEDIA CONTACTS

Data of social media contacts will be kept for as long as the user and HUMAN DATA INSTITUTE, S.L. remain connected on the social network. As the processing of the data does not depend directly on HUMAN DATA INSTITUTE, S.L., we can only consult or remove your data in a limited way. We will process your data for as long as the social network user is connected with HUMAN DATA INSTITUTE, S.L. as 'friends', 'likes', 'follows' or uses similar buttons.

HUMAN DATA INSTITUTE, S.L. will not be responsible for rectifying your data, restricting information or the posts you share; this must be done by the social network user themselves through their profile settings, in accordance with the privacy policy of the social network itself.

Regardless of the legal basis on which the data was collected, it may be processed for scientific, historical or statistical research purposes, always implementing appropriate safeguards and respecting the rights and freedoms of data subjects.

SURVEY PARTICIPANTS

Data processed on the basis of the participant's consent will be kept for as long as it remains relevant to the purpose for which it was collected and consent has not been withdrawn.

For data processed on the basis of the client company's legitimate interest, the retention period will be linked to the reason for which the data was collected, always ensuring appropriate safeguards and respect for the rights and freedoms of data subjects.

Data processed on the basis of a contract with the client company, or where part of the processing is based on a legal obligation, will be kept for as long as the contractual relationship remains in force. Once it has ended, where the processing is linked to a legal obligation, the retention period will be that provided for by law, and the data subject may not revoke the processing of the data except in the cases of blocking provided for by law.

4. ADDITIONAL INFORMATION ON DATA PROCESSING

Only persons over 14 years of age may provide data through our website and by email. If you are under this age, you must have the consent of your parents or legal guardians.

The User guarantees the authenticity and accuracy of all data they communicate to HUMAN DATA INSTITUTE, S.L., declares that they are over 14 years of age and will be solely responsible for any false or inaccurate statements they make.

HUMAN DATA INSTITUTE, S.L. does not deliberately request special categories of data through its general forms. However, certain questionnaires, evaluations or responses provided by users could indirectly reveal particularly sensitive information related to the work, emotional, organisational or psychosocial environment, in which case such data will be processed with the enhanced safeguards required by the applicable regulations.

Voluntary information is information that the user is not obliged to provide in order to contact us.

Fields marked with an asterisk (*) or with the word (required) in our forms are mandatory; failure to provide them will make it impossible to provide the service or handle your request.

If you provide us with data of third parties, you declare that you have their consent and undertake to pass on to them the information provided in this clause, releasing HUMAN DATA INSTITUTE, S.L. from any obligation in this regard. However, HUMAN DATA INSTITUTE, S.L. may carry out checks to verify that the third party has been informed, adopting the due diligence measures established in data protection regulations.

Certain data requested in questionnaires or forms may be mandatory because it is necessary to provide the service or to properly contextualise the results obtained. Other data will be optional and, where appropriate, the user will be offered the option of not providing it or of selecting equivalent options such as “prefer not to answer”.

5. TO WHICH RECIPIENTS WILL YOUR DATA BE DISCLOSED?

Data will not be disclosed to third parties except where required by law or where necessary to handle your request.

The recipients to whom your data may be disclosed include:

• Public authorities and bodies when required by tax, labour, Social Security or any other applicable regulations. Companies acting as data processors (fraud detection and prevention providers, technology services, customer service, advertising and marketing services and, in general, third-party providers necessary for the provision of the services offered by HUMAN DATA INSTITUTE, S.L., such as courier and transport service providers, etc.).
• In addition, certain technology providers necessary for the provision of the service, such as hosting, storage, authentication, electronic communications, analytics or payment gateway services, may have access to the data as data processors and, where applicable, as independent controllers with regard to the operation of their own service.
• These providers may include cloud hosting services, electronic communication platforms, authentication tools, analytics services, generative artificial intelligence providers, where necessary to provide the functionality requested by the user, and other technology providers necessary for the provision of the contracted services, who will only access the data when necessary for the provision of the service and under the safeguards provided for in Regulation (EU) 2016/679.

6. ARE THERE ANY INTERNATIONAL DATA TRANSFERS?

As a general rule, personal data will be processed within the European Economic Area. However, certain technology providers used by HUMAN DATA INSTITUTE, S.L., such as cloud services, analytics tools, electronic communications or payment gateways, may involve international data transfers or access from third countries.

In such cases, HUMAN DATA INSTITUTE, S.L. will adopt the appropriate safeguards required by the applicable regulations, including, where appropriate, adequacy decisions, standard contractual clauses or other valid mechanisms in accordance with Articles 46 et seq. of the GDPR.

In particular, when the user uses artificial intelligence features integrated into the platform, certain processing operations may involve access to or processing of information by technology providers located outside the European Economic Area. In these cases, HUMAN DATA INSTITUTE, S.L. will ensure that such international transfers are carried out in accordance with the mechanisms provided for in Articles 45 to 49 of the GDPR.

Data subjects may request additional information about these safeguards via the contact email address indicated in this Privacy Policy.

HUMAN DATA INSTITUTE, S.L. never sells its users' data to third parties.

7. STATISTICAL PROCESSING, BENCHMARKING AND SERVICE IMPROVEMENT

HUMAN DATA INSTITUTE, S.L. may use aggregated, pseudonymised and/or anonymised information derived from the services provided to carry out statistical studies, sector benchmarks, organisational research, methodological validation and improvement of its models, metrics, algorithms and services. Under no circumstances will such processing be intended to individually identify natural persons or to make individualised decisions about data subjects outside the scope of the contracted service.

Where applicable, technical and organisational measures will be adopted to minimise the risk of re-identification and ensure the confidentiality of the information processed.

8. WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?

The user may exercise the following rights before HUMAN DATA INSTITUTE, S.L.:

1. Access their personal data
2. Rectify it when it is inaccurate or incomplete
3. Request the erasure or deletion of the data when, among other reasons, it is no longer necessary for the purposes for which it was collected
4. Object to its processing
5. Request the restriction of the processing of their data when any of the conditions provided for in the regulations are met
6. Request the portability of their data in the cases provided for in the regulations
7. Not be subject to a decision based solely on automated processing of their data, including profiling, which produces legal effects concerning them or similarly significantly affects them
8. Withdraw the consents given

With regard to processing involving profiling, the data subject may request additional information about the general criteria applied and object to the processing where appropriate in accordance with the applicable regulations.

To exercise their rights, the user must send a written request indicating the right they wish to exercise, together with a document proving their identity and a postal or email address for notification purposes. This request can be made either by post to: HUMAN DATA INSTITUTE, S.L., Agustín de Foxá 40, 28036 - Madrid (Madrid), or by email to: gdpr@dathum.io.

HUMAN DATA INSTITUTE, S.L. must respond to the request to exercise rights within one month of receipt of the request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. We will inform you of any extension within one month of receipt of the request, stating the reasons for the delay.

Data subjects also have the right to lodge a complaint with the competent Supervisory Authority (Spanish Data Protection Agency) when they consider that HUMAN DATA INSTITUTE, S.L. has infringed the rights granted to them by data protection regulations, at www.aepd.es

9. IS MY DATA SECURE?

HUMAN DATA INSTITUTE, S.L. has a contract in force with the hosting company Amazon Data Services Ireland for the hosting of its website. It is a European company and has the latest security systems.

In any case, HUMAN DATA INSTITUTE, S.L. guarantees the adoption of the appropriate measures to ensure the confidential processing of your data, given its confidential nature, undertakes to keep such data secret, treating it with the utmost discretion, and declares that it has implemented in its information system the security policies corresponding to the type of data handled in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

All data provided through our platform is collected via a secure protocol. Our website has an SSL certificate, so that when a user visits our website and exchanges information with us, an encrypted connection is established.

10. LINKS TO OTHER WEBSITES

If you choose to leave our website through links to other websites not belonging to our organisation, HUMAN DATA INSTITUTE, S.L. will not be responsible for the privacy policies of those websites or for the cookies they may store on the user's computer.

Date: 14/07/2026

Version: V.1.0