Privacy policy

Data controller

The controller of your personal data is RENEWEARTH SL, Tax ID (NIF) B26785923, registered at Paseo de Reding 43, 1º Izq, 29016 Málaga, Spain, trading as AutomationLab through the website automationlab.agency ("AutomationLab", "we", "us").

For any data protection matter, contact us at legal@automationlab.agency or by post at the address above, marked "Data protection".

Data Protection Officer (DPO). Given the nature and scale of our processing, RENEWEARTH SL is not required to appoint a DPO under Article 37 GDPR and Article 34 LOPDGDD. If one is appointed, their contact details will be published here.

Applicable law

We process your data in accordance with:

• Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).
• Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
• Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).
• Spanish Organic Law 1/1982 of 5 May on the civil protection of the right to honour, personal and family privacy and one's own image, regarding images and voice.
• Regulation (EU) 2024/1689 (the AI Act), where applicable.

Personal data we process

We only process the data needed for each purpose (data minimisation). Depending on how you interact with us, this may include:

• Identification and contact data: name, surname, email, phone, company, job title, country.
• Business and billing data: company name, tax ID, billing address, payment details needed for invoicing (we do not store full card numbers).
• Message content: what you send us via forms, email, direct messages and comments.
• Social and channel data: public username, profile picture, comments and interactions with our YouTube, TikTok, Instagram, Facebook or other channels.
• Image and voice: when you take part in recordings, interviews or audiovisual productions.
• Candidate and collaborator data: CV, portfolio, experience and details you share in a recruitment process or creator collaboration.
• Technical and browsing data: IP address, device and browser type, pages visited, date and time of access, collected via server logs and cookies (see section 15).

Special categories. We do not request special category data (health, beliefs, religion, ethnic origin, sexual orientation, etc.). Please do not include it in your messages. If we receive it unrequested, we will delete it unless a legal basis exists to keep it.

Data provided by third parties. If you give us data about other people (for example, colleagues), you confirm you have informed them and have a lawful basis to do so. Where we obtain data not directly from you (for example, publicly available business contact details), we will inform you under Article 14 GDPR in our first communication.

Purposes and legal bases

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Where it is based on legitimate interest, we have assessed that your interests and rights do not override it, and you may object at any time.

Fields marked as required in our forms are necessary to handle your request; if you do not provide them, we cannot process it.

Retention periods

• Enquiries and contacts: as long as needed to reply and, at most, 12 months from the last communication if no relationship begins.
• Clients: for the duration of the contract and then 6 years for commercial records (Art. 30 Spanish Commercial Code) and 4 years for tax records (Art. 66 General Tax Law), plus any applicable limitation period for legal claims.
• Newsletters and marketing: until you withdraw consent or unsubscribe. We keep your email on a suppression list to honour your opt-out.
• Applications: 12 months from receipt, unless you authorise us to keep them longer.
• Audiovisual content: for the agreed term of the rights assignment or until you revoke consent, under Art. 2.3 Organic Law 1/1982.
• Technical and security logs: up to 12 months.
• Cookies: as stated in the Cookie policy.

After these periods, data will be kept blocked for as long as liabilities may arise, available only to courts, the Public Prosecutor or competent authorities (Art. 32 LOPDGDD), and then securely deleted.

Recipients and processors

We do not sell your personal data. We only disclose it:

• To the Spanish Tax Agency, courts, law enforcement and other authorities where legally required.
• To banks and payment providers to handle payments.
• To tax, accounting and legal advisers bound by confidentiality.
• To clients and brands, only where necessary to deliver a project you take part in, and with your knowledge.

We also use processors who provide services to us and access data only on our instructions, under contracts meeting Article 28 GDPR. By category: web hosting and domain; cloud email and productivity tools; CRM and email marketing tools; workflow automation tools; artificial intelligence providers; analytics and advertising tools; payment and invoicing platforms; and external production and operations staff and contractors, including those based in Latin America.

You can request the current list of processors at legal@automationlab.agency.

International transfers

Some providers and collaborators are located outside the European Economic Area (for example, in the United States, the United Kingdom or Colombia). In those cases we only transfer data with an appropriate safeguard under Articles 44–49 GDPR:

• A European Commission adequacy decision (for example, the United Kingdom, or US companies certified under the EU-U.S. Data Privacy Framework).
• Standard contractual clauses approved by the European Commission, with supplementary measures where needed.
• Exceptionally, the derogations in Art. 49 GDPR, such as your explicit consent or necessity for performing a contract with you.

You can request information about the safeguards in place from our privacy contact.

Your rights

You may exercise the following rights at any time, free of charge:

• Access: find out whether we process your data and get a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when no longer needed, among other cases.
• Objection: object to processing based on legitimate interest and, always, to direct marketing.
• Restriction: ask us to suspend processing in certain cases.
• Portability: receive the data you gave us in a structured format, or have it sent to another controller.
• Not to be subject to automated decisions with legal or similarly significant effects (see section 13).
• Withdraw consent at any time.

How to exercise them. Email legal@automationlab.agency or write to Paseo de Reding 43, 1º Izq, 29016 Málaga, Spain, stating which right you are exercising. We will only ask for additional information to confirm your identity if we have reasonable doubts about it. If you act through a representative, proof of representation is required.

We will reply within one month of receipt, extendable by two further months given the complexity or number of requests, in which case we will tell you within the first month (Art. 12.3 GDPR).

Complaints to the supervisory authority

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the supervisory authority in your EU Member State of residence. We encourage you to contact us first so we can try to resolve it.

Minors

Our commercial services and forms are intended for adults. Under Article 7 LOPDGDD, children under 14 cannot consent to the processing of their data; the consent of their parents or guardians is required. If we find we have received data from a child under 14 without such authorisation, we will delete it.

Participation of minors in audiovisual productions always requires written consent from their legal representatives and, where the minor is mature enough, from the minor too (Art. 3 Organic Law 1/1982), with the safeguards of Organic Law 1/1996 on the legal protection of minors.

Marketing communications

We will only send you marketing by email or equivalent means if you have given express consent, or if you are a client and the communications concern products or services similar to those you contracted (Art. 21 LSSI-CE). Every message includes a simple, free way to unsubscribe. You can also unsubscribe by emailing legal@automationlab.agency.

Image, voice and audiovisual content

AutomationLab produces and publishes audiovisual content across several channels. If you take part in a recording, we will first tell you its purpose, the channels where it will appear, and the duration and territorial scope of the assignment, and we will obtain your express written consent or sign a rights assignment agreement with you.

You may revoke your consent at any time (Art. 2.3 Organic Law 1/1982). We will remove the content from our own channels within a reasonable time, without prejudice to any compensation for justified damages that may apply by law, and excluding copies made by unrelated third parties.

People appearing incidentally in public places, or public figures in the course of their public activity, are treated within the limits of Art. 8 Organic Law 1/1982.

Artificial intelligence and automated decisions

We use artificial intelligence and automation tools for tasks such as drafting and translating text, editing content, sorting enquiries and analysing aggregated audience metrics. These providers act as processors and, where available, we configure their services so your data is not used to train their models.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). A person is always involved in relevant decisions.

When you interact with a conversational assistant or AI system operated by us, we will make that clear. Likewise, when we publish AI-generated or AI-manipulated image, audio or video content depicting real people, we will label it in line with applicable transparency obligations.

Social media and third-party platforms

We are present on platforms such as YouTube, TikTok, Instagram, Facebook and LinkedIn. When you interact with our profiles, each platform processes your data under its own privacy policy. For page insights statistics, we act as joint controller with the platform where the law and CJEU case law so establish.

We will use your public profile data and interactions only to manage our community and reply to you within the platform, and will not extract them for other purposes without informing you and having a legal basis.

Cookies and similar technologies

Our site uses technical cookies needed for it to work and, only with your prior consent, analytics, preference and advertising cookies (Art. 22.2 LSSI-CE). You can accept, reject or configure cookies from the banner and change your choice at any time. Details of each cookie, its purpose, owner and duration are in our Cookie policy.

Security

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), such as HTTPS encryption, access control with two-factor authentication, least-privilege permissions, backups and confidentiality undertakings signed by our staff and collaborators (Art. 5 LOPDGDD).

If a personal data breach poses a risk to your rights, we will notify the AEPD within 72 hours and, where the risk is high, notify you without undue delay (Arts. 33 and 34 GDPR).

Deceased persons and digital rights

Under Articles 3 and 96 LOPDGDD, people linked to a deceased person for family or de facto reasons, and their heirs, may contact us to request access to, rectification or erasure of that person's data, unless the deceased expressly prohibited it or the law provides otherwise.

Accuracy of data

You guarantee that the data you provide is true and up to date, and agree to tell us of any changes. Under Article 4 LOPDGDD, we are not responsible for inaccuracies in data you provided directly to us.

Changes to this policy

We may update this policy to reflect changes in law, case law or our services. We will publish the new version on this page with its update date and, where changes are significant, inform you by appropriate means.

In the event of any discrepancy between the Spanish and English versions of this policy, the Spanish version shall prevail.