Privacy policy
At Torrano Global we respect your privacy and process your personal data in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Data Protection (LOPDGDD) and Law 34/2002 on information society services (LSSI-CE). This policy explains what data we process, for what purpose and on what legal basis, and what rights you have.
1. Data controller
| Controller | Torrano Innovation Group S.L. (trade name: Torrano Global) |
|---|---|
| Tax ID (CIF) | B16833568 |
| Registry details | Madrid Commercial Registry, volume 42396, folio 155, sheet M-750327, 1st entry |
| Registered office | C/ Infante Don Luis 3, 4º B, 28803 Alcalá de Henares (Madrid), Spain |
| info@torranoglobal.com | |
| Phone | +34 919 93 93 32 |
| Data Protection Officer | Not appointed, as the conditions of Art. 37 GDPR do not apply. For any privacy matter, please write to info@torranoglobal.com. |
2. What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering enquiries received by email, phone, WhatsApp or forms | Identification and contact details; content of the enquiry | Consent and pre-contractual steps (Art. 6(1)(a) and (b) GDPR) | As long as needed to reply and then up to 1 year |
| Providing engineering services and managing customers and suppliers (quotes, contracts, invoicing) | Identification, contact, tax and bank details | Performance of a contract and legal obligations (Art. 6(1)(b) and (c)) | During the relationship and the legal periods (6 years commercial, 4 years tax) |
| Training: enrolment, virtual classroom, follow-up, assessment, certificates and, where applicable, FUNDAE/SEPE subsidy management | Identification, contact, academic and employment data needed for the subsidy, platform activity logs | Performance of a contract and legal obligations of subsidised training (Art. 6(1)(b) and (c)) | During the training and the periods required by training and public-funding rules |
| Recording, transcribing and summarising phone calls to handle the enquiry, keep a record of what was agreed and improve our service. You are informed at the start of every call (incoming and outgoing); personal contacts of the management who have a direct line are informed in advance | Phone number, voice, content of the conversation, transcript, translation into Spanish when the call is in another language, and summary | Legitimate interest (Art. 6(1)(f) GDPR). All calls are recorded, as recording is necessary to assist you by phone; if you prefer not to be recorded, we will assist you in writing at info@torranoglobal.com; you may also object afterwards and ask for the recording to be deleted by writing to that address | At most 5 years from the call (general limitation period for claims, Art. 1964.2 of the Spanish Civil Code). Once that period ends, management reviews each recording before deleting it and only keeps those linked to an ongoing claim or contract. In any case, they are deleted when you request it |
| Handling “Call me back” requests from the website | Name, phone number, IP address and source of the visit (for example a partner’s link) | Consent to be called (Art. 6(1)(a) GDPR) and legitimate interest in preventing abuse and knowing where the contact comes from (Art. 6(1)(f)) | 1 year; rejected requests, 30 days |
| Handling calls made with the “Call” button on the website (internet call, no number dialled) and preventing misuse | Name, company or email, phone number (optional), language, IP address and the result of Cloudflare’s anti-bot check when enabled; during the call, the same data as for other calls | Consent when requesting the call (Art. 6(1)(a) GDPR) and legitimate interest in preventing abuse (Art. 6(1)(f)); recording as for other calls | The request: 1 year if the call takes place, 30 days if not; the call, as for other calls |
| Letting you know by WhatsApp that we saw your missed call and will call you back | Phone number | Legitimate interest in answering your call (Art. 6(1)(f) GDPR); a service message, not advertising | Same as the call record |
| Informing you of changes to our contact details (for example a new phone number) if you contacted us in the past | Name and phone number | Legitimate interest in keeping the relationship (Art. 6(1)(f) GDPR); informative message with an opt-out | While the relationship lasts or until you opt out |
| Sending commercial information about our services | Name and contact details | Consent, or legitimate interest with customers (Art. 21 Spanish LSSI) | Until consent is withdrawn or you unsubscribe |
Use of artificial intelligence in calls
Transcription takes place on our own server. To prepare the summary, the transcript is sent to Anthropic’s artificial intelligence service without phone numbers, emails, ID numbers, IBANs, card numbers or the contact’s name (they are replaced by tags). The summary may include an internal assessment of the tone and urgency of the enquiry and of the quality of our own service; it is used only to organise our work and improve our service, is always reviewed by a person and is never used to make decisions about you. No automated decisions or profiling with legal or similarly significant effects are carried out (Art. 22 GDPR). When a call is in English or Chinese, the translation into Spanish is also done on our own server with a machine translation model; only if we enable it is it done by Anthropic’s service, with the same pseudonymised data.
3. Recipients
We do not share data with third parties except where required by law (Spanish Tax Agency, FUNDAE, SEPE, banks) or with providers acting as processors under a contract compliant with Art. 28 GDPR (hosting and servers, email, accounting firm, training platform, telephone operator, Meta’s WhatsApp, Zoom for live classes in our virtual classroom, Mobilo and Zapier to receive the contact details you share through our digital business card, Cloudflare for the anti-bot check of the website’s “Call” button and, for call summaries, Anthropic’s artificial intelligence service). Call recordings are only accessible to the company’s management. International transfers: Anthropic PBC (United States), for call summaries, Meta Platforms (WhatsApp), Zoom Communications (live classes), Cloudflare Inc. (website anti-bot check) and Mobilo and Zapier (digital business card) may process data outside the European Economic Area. These transfers rely on the European Commission’s standard contractual clauses included in their data processing agreements (and, where they are certified, on the EU-US Data Privacy Framework). You can request more information and a copy of the safeguards at info@torranoglobal.com.
4. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time (without affecting the lawfulness of prior processing), by writing to info@torranoglobal.com or by post to our registered office, stating the right you wish to exercise. We will only ask you to prove your identity by proportionate means and, only in case of reasonable doubt, for an additional document (sending a copy of your ID is generally not required). We will respond within one month, extendable by two further months for particularly complex requests (Art. 12 GDPR). If you believe your rights have not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), without prejudice to contacting us first.
5. Security
We apply technical and organisational measures appropriate to the risk: encrypted communications, access control, encrypted backups and activity logs. However, no system is entirely infallible: we cannot guarantee absolute security against unlawful access resulting from causes beyond our diligence (for example, third-party attacks or the misuse of your credentials by you or by anyone who accesses them). In the event of a security incident, we will act in accordance with the law, notifying the Spanish Data Protection Agency and, where appropriate, the affected individuals (Arts. 33 and 34 GDPR).
6. Minors
Our services are aimed at businesses and at people over 18. They are not directed to minors; we do not knowingly process the data of anyone under 18, and if we find that we have received a minor’s data without the consent of their parents or guardians, we will delete it.
7. Accuracy of data and obligation to provide it
The data requested in forms, contracts or training procedures is necessary for the purpose indicated in each case; if you do not provide it, we will not be able to handle your request, provide the service or comply with the associated legal obligations. You warrant that the data you provide is truthful, accurate and up to date and undertake to notify us of any change. If you provide third-party data, you declare that you have their consent and have informed them of this policy. You are liable for any damage arising from providing false, inaccurate or incomplete data, or third-party data without authorisation.
8. Third-party links and services
Our channels may include links to third-party websites or services (for example WhatsApp, Zoom, social networks or payment platforms) which have their own privacy policies, over which Torrano Global has no control and for which it accepts no responsibility. We recommend that you review them before providing your data.
9. Cookies
The use of cookies and similar technologies on this website is described in our Cookies policy.
10. Applicable law and changes
This policy is governed by Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD), Law 34/2002 (LSSI-CE) and other applicable Spanish and EU legislation, subject to the courts having jurisdiction under the law. Torrano Global may amend this policy to adapt it to legislative or case-law changes or to changes in its processing activities; the version in force will at all times be the one published on this page, identified by its update date. We recommend that you review it periodically.