HGLO Sistemas Privacy Policy

Last updated: 11 October 2026

This English version is provided for information only. In the event of any discrepancy, the Spanish version shall prevail. Ver la versión en español.

This Privacy Policy explains how we process the personal data of people who visit hglosistemas.com, write to us, use the AI assistant, book a call, create an account or purchase a product or service through the website.

Information about the use of cookies and similar technologies is provided separately in our Cookie Policy.

1. Data controller

The data controller is Carlos Falconi, who carries out their activity under the trade name HGLO Sistemas.

• Tax ID (NIF/NIE): Y6982199B.
• Address: Calle Corona 19, 28054 Madrid, Spain.
• Email for contact and for exercising your rights: contacto@hglosistemas.com.

This policy refers to the HGLO Sistemas corporate website. The HGLO Sistemas Academy platform must provide information about its specific processing —such as enrolment, training and student follow-up— in its own policy or in a section expressly dedicated to it.

2. What data we process

Depending on how you interact with the website, we may process:

• Identification and contact data: name, email address, telephone number and, where you provide it, your company or professional activity.
• Enquiry and project data: information you include in forms, messages, proposals or communications with us.
• Booking data: the service chosen, date and time, the data needed to manage the appointment and communications related to it.
• Account data: information needed to create, authenticate and manage access to the services available on the website.
• Order and billing data: products or services purchased, amounts, payment status and the data needed to issue receipts or invoices. Full card details are entered, where applicable, in the payment gateway and not in an HGLO Sistemas form.
• Data from conversations with the AI assistant: the messages you write and the information needed to answer you or to process a request you decide to make through the chat.
• Technical and security data: IP address, session identifiers, date and time of access and the logs needed for the operation of the website, abuse prevention and security.

Please do not include especially sensitive data, passwords or card details in forms or conversations unless they are necessary for your enquiry.

3. What we use the data for and on what legal basis

Answering enquiries and assessing projects

We use the data you send us by form, email or chat to reply to you, understand your needs, prepare a proposal and keep the necessary communications about it.

The legal basis is taking steps at your request prior to entering into a contract when you ask about a possible project or service. For general questions and the ordinary handling of correspondence, we may rely on our legitimate interest in answering the requests we receive, always respecting your rights.

Managing bookings

We process the data needed to show availability, record the appointment, send you information related to it and manage changes or cancellations. The legal basis is taking pre-contractual steps or performing the service you request.

Managing accounts, purchases and contracted services

When you create an account or purchase a product or service, we process the data needed to manage access, process the order, provide the service and deal with any issues. The legal basis is the performance of the contract.

Complying with legal obligations

We process and keep the documentation needed to comply with tax, accounting and other applicable legal requirements. The legal basis is compliance with a legal obligation.

Protecting the website and preventing misuse

We may process technical data and activity logs to maintain security, prevent unauthorised access, detect abusive submissions and protect our systems and their users. The legal basis is our legitimate interest in keeping the service secure and operational.

Sending marketing communications

We will only send you promotional communications by electronic means when you have requested or authorised them, or when there is a prior contractual relationship and the legal requirements for informing you about our own products or services similar to those purchased are met. You can stop receiving them easily and free of charge at any time.

Sending an enquiry, booking an appointment or using the assistant does not in itself mean subscribing to advertising. The messages needed to answer your request, manage a booking or provide a service are not considered a marketing subscription.

Managing optional cookies

Where cookies or technologies that are not necessary for the website to work are used, the processing will be based on the preferences you express in the cookie management system. You can see the details and change your choice in the Cookie Policy.

4. How the AI assistant works

The chat uses artificial intelligence to answer questions about HGLO Sistemas and help guide requests. What you write may be sent to the technology provider that processes the conversation in order to generate an answer. For this reason, avoid sharing sensitive information or personal data of third parties that is not necessary.

The AI provider is DeepSeek, whose servers are located in the People’s Republic of China. The data from the contact forms is also sent to it so it can be classified internally. China does not have an adequacy decision from the European Commission: using the assistant is optional and, by writing to it, you expressly consent to this transfer (art. 49.1.a GDPR) after having been informed of its possible risks. If you prefer, you can email us instead of using the chat. To find articles and services related to your question, OpenAI’s vector service (United States) is used, under the Data Privacy Framework.

The assistant can provide information or guide you to a form or a booking. An appointment suggested in the chat does not in itself create a booking: you will need to complete the corresponding booking process.

The assistant’s answers do not replace review by a person where this is necessary. We do not use the chat to take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

5. If you have to provide your data

The fields marked as mandatory are needed to process the corresponding operation. If you do not complete them, we may not be able to answer your enquiry, manage your booking, create your account or provide the service requested.

The optional fields help us understand your case better, but you can leave them blank. Where an operation requires accepting terms or giving specific consent, you will be asked at the appropriate time.

6. Who we share the data with

We do not sell your personal data. We may disclose it when necessary to provide a service or comply with the law:

• To public administrations, authorities and courts where there is a legal obligation.
• To banks or payment providers when you make a payment.
• To technology providers that provide services on our behalf, such as web hosting, database and authentication, transactional email, protection against automated submissions and processing of the assistant’s conversations.

Depending on the feature used, the documented HGLO Sistemas architecture includes services such as Vercel, Supabase, Resend, Cloudflare Turnstile, Stripe and an AI provider. The final list of providers that access personal data on this website must match the services actually enabled and their contractual terms.

7. International transfers

Some technology providers may process data, or allow access to it, from countries outside the European Economic Area. Where there is an international transfer, it must be covered by an applicable adequacy decision or by the safeguards required by the GDPR, such as standard contractual clauses, depending on the provider and the specific service.

You can write to us at contacto@hglosistemas.com to request information about the providers that apply to your case and the safeguards for the transfer. We do not use Privacy Shield as a legal basis.

8. How long we keep the data

We keep data only for as long as necessary for the purpose for which it was collected and, afterwards, for the periods required by law or needed to deal with possible liabilities. In particular:

• Enquiries and conversations that do not lead to a contractual relationship: for the time needed to deal with them and follow them up, in accordance with the deletion period that HGLO Sistemas sets and actually applies.
• Bookings, accounts and contracts: while the relationship or service lasts and, afterwards, for the applicable legal or limitation periods.
• Accounting documentation and business records: for the legally required periods; the Spanish Commercial Code generally requires books and business documentation to be kept for six years, without prejudice to special rules.
• Data processed for marketing communications based on consent: until you withdraw it or unsubscribe, except for the minimum retention needed to prove and respect that decision.
• Security logs: for a time proportionate to their purpose and in accordance with the actual configuration of the system.

Where data must be kept to comply with obligations or deal with claims, its use will be limited to those purposes.

9. Your rights

You can request access to, rectification or erasure of your data, as well as restriction of processing, object to it and request portability where applicable. If processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of what was done before you withdrew it.

Write to us at contacto@hglosistemas.com stating which right you wish to exercise. You do not have to attach a copy of your ID automatically; we may only ask for proportionate additional information if there are reasonable doubts about your identity.

You can also lodge a complaint with the Spanish Data Protection Agency (https://www.aepd.es/) if you consider that we have not properly respected your rights.

10. Security and changes to this policy

We apply proportionate technical and organisational measures to protect data against unauthorised access, loss or alteration. No system connected to the Internet can guarantee zero risk.

We may update this policy when services, providers or processing change. The current version will be available on this page with its last updated date.