Data protection and GDPR rights

1. Scope of this document

This document supplements CIA — Compañía de Inteligencia Artificial's Privacy Policy and explains the additional rights and criteria that may apply when personal data processing falls within the scope of the European Union's General Data Protection Regulation, known as the GDPR.

The ability to access https://la-cia.com.ar from a European country does not, by itself, make the GDPR applicable. Its scope depends on the specific circumstances of the processing, including whether there is an establishment in the European Economic Area, whether goods or services are specifically offered to people there, or whether their behaviour within that territory is monitored.

Where the GDPR does not apply, processing is governed by CIA's Privacy Policy and the relevant Argentine legislation.

2. Relationship with the Privacy Policy

The general Privacy Policy describes:

What data CIA may collect.
How it uses that data.
Who it may share it with.
How long it may retain it.
The general measures taken to protect it.
How personal data rights can be exercised.

This document should be read alongside that policy. In the event of a difference, where the GDPR applies to a particular processing activity, its mandatory provisions take precedence.

3. Data controller and contact channel

CIA — Compañía de Inteligencia Artificial is the brand and commercial identity used on this website.

Questions and requests relating to data protection can be sent to:

Email: hola@la-cia.com.ar
Website: https://la-cia.com.ar

This document does not represent that CIA has an establishment, a data protection officer or a designated representative in the European Economic Area. If a future activity requires any of these, the relevant information must be added before that processing begins.

4. Data and purposes

CIA may process data provided through the form, email or other contact channels, as well as technical information necessary for the website's operation and security.

Depending on the interaction, the purposes and legal bases may be:

Purpose	Potential legal basis
Receiving and responding to an enquiry	Pre-contractual steps requested by the individual, or a legitimate interest in responding to the communication
Arranging a meeting, demonstration or discovery session	Pre-contractual steps requested by the individual
Preparing a proposal or providing a service	Performance of a contract or steps taken before entering into one
Maintaining security and preventing abuse	Legitimate interest in protecting the website, its systems and users
Complying with legal obligations	Compliance with an applicable legal obligation
Sending news or promotional material	Consent, where required

Where processing relies on a legitimate interest, CIA will assess whether that interest is improperly overriding the individual's rights and freedoms.

5. Required data and marketing communications

Fields marked as required are needed to receive and respond adequately to an enquiry. People may choose not to provide this information, although CIA may then lack sufficient information to assist them.

Marketing communications are optional and are not a condition for submitting an enquiry or entering into a service agreement. Consent can be withdrawn at any time by emailing hola@la-cia.com.ar or using the unsubscribe mechanism included in the communication.

6. Recipients and providers

CIA may use providers of hosting, infrastructure, email, forms, CRM, scheduling, video conferencing, storage, security and support. These providers may receive only the data needed to perform the contracted function and must process it under appropriate confidentiality and data protection conditions.

Data may also be disclosed where required by law, a valid order from a competent authority, or where necessary to establish, exercise or defend rights.

CIA does not sell personal data.

7. International transfers

Collected data may be stored or processed in Argentina. The European Commission currently recognises Argentina as providing an adequate level of personal data protection for transfers covered by that decision.

Some technology providers may process information in other countries. Where the GDPR applies and the destination is not covered by an adequacy decision, safeguards permitted by law, such as standard contractual clauses or another valid mechanism, will be used unless a statutory exception applies.

8. Retention

Data will be retained only for as long as necessary to fulfil the purpose for which it was collected and, afterwards, for the periods required to meet legal or contractual obligations or address potential claims.

Data used solely for promotional communications will be retained until the person withdraws consent or unsubscribes, unless another legal basis supports retaining certain information.

9. Individuals' rights

Where the GDPR applies, individuals may request:

Access: to find out whether their data is being processed and obtain a copy.
Rectification: to correct inaccurate data or complete incomplete data.
Erasure: to have their data deleted where applicable.
Restriction: to temporarily restrict certain processing activities.
Portability: to receive certain data in a structured, commonly used and machine-readable format, where applicable.
Objection: to object to processing based on legitimate interests and, at any time, to direct marketing.
Withdrawal of consent: to withdraw consent without affecting the lawfulness of prior processing.
Human review: not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where the law provides otherwise.

These rights are not absolute and may be subject to statutory conditions or exceptions.

10. How to exercise your rights

Requests should be sent to hola@la-cia.com.ar and state:

The requester's name.
The right you wish to exercise.
The information needed to identify the data concerned.
A way to receive the response.

CIA may request reasonable additional information where necessary to verify the person's identity and prevent unauthorised access or changes.

Requests will be answered without undue delay and, in principle, within one month of receipt. This period may be extended where a request is particularly complex or multiple requests have been made, with the person informed within the initial period.

Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive within the meaning of the GDPR.

11. Automated decisions

The website does not use data submitted through its form to make solely automated decisions that produce legal or similarly significant effects on the individual.

The terms applicable to data processed by a CIA agent when delivering business services will be agreed with the client in the relevant proposal, contract or addendum.

12. Complaints to a supervisory authority

Where the GDPR applies, individuals have the right to lodge a complaint with the data protection authority in the European Economic Area country where they habitually reside, work or believe a possible infringement occurred.

A list of authorities is available on the European Data Protection Board website.

Before lodging a complaint, individuals may contact CIA at hola@la-cia.com.ar to try to resolve the issue.

13. Security

CIA applies reasonable technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised disclosure or access, taking into account the nature of the information and the risks of processing.

No system can guarantee absolute security. If an incident could create a risk for individuals, appropriate assessment, containment, documentation and notification measures will be taken in accordance with applicable law.

14. Changes to this document

CIA may update this document to reflect legal, technical or operational changes. The current version will be published with its last updated date.

15. Contact

For questions or requests relating to this document, email us at hola@la-cia.com.ar.