Privacy policy

1. Controller

This policy applies to winchange.io (including the private client and partner areas and the documentation) and to peopleagenda.es.

2. When we are not the controller

Two situations have to be told apart, because rights are exercised before a different entity in each one:

• We are the controller of the data of anyone who writes to us, requests a demo, accesses the client or partner area, or subscribes to PeopleAgenda. That is what this policy describes.
• We are the processor of the data of the employees who take part in a programme within the WinChange platform. There, the controller is the organisation that contracts the service: it is that organisation which decides what data is loaded, for what purpose and for how long, and which must inform its workforce. We process the data following its instructions, under the processing agreement provided for in Article 28 GDPR. If you take part in a programme and want to exercise your rights, address your employer; if you write to us, we will pass the request on.

3. Processing activities we carry out

Enquiries, demo requests and commercial contact

When you write to us or request a demonstration, we process your data in order to deal with your request and, where appropriate, to prepare a proposal.

Data

Name, email, telephone, company, job title and the content of your message.

Legal basis

Pre-contractual measures taken at the data subject's request, and legitimate interest in dealing with enquiries.

Retention

One year from the last contact, unless the relationship results in a contract.

Private client area

It allows the authorised personnel of a client organisation to check the status of their programme, their active users and an estimate of billing.

Data

Access credentials, user identifier, associated organisation and access logs.

Legal basis

Performance of the contract signed with the organisation.

Retention

For the duration of the contractual relationship and, thereafter, the limitation period for legal claims.

Partner portal

This covers both the application to join and the subsequent access of the consultancies and firms that work with us.

Data

Name and professional contact details, company, access credentials and activity in the portal.

Legal basis

Pre-contractual measures and performance of the collaboration agreement.

Retention

For the duration of the collaboration; applications that are not accepted, one year.

PeopleAgenda: event alerts by email

This is a free service that sends a periodic summary of the Human Resources events matching the preferences you indicate. Signing up requires double confirmation: until you confirm from the email we send you, you receive nothing.

Data

Email, name (optional) and preferences as to format, city, price and mode of attendance. We keep the date, the IP address and the version of the text you accepted, as evidence of consent.

Legal basis

Consent of the data subject.

Retention

Until you unsubscribe or withdraw your consent. Evidence of the consent and of the unsubscription is kept for three years as proof against claims.

You can unsubscribe using the link included in every message, without giving reasons and at no cost.

PeopleAgenda: WhatsApp notifications

This is an optional channel, separate from email: it is only activated if you expressly tick its box and give us a mobile number.

Data

Mobile telephone number and the same preferences as the alert.

Legal basis

Specific consent, separate from the consent given for email.

Retention

Until you reply BAJA (unsubscribe) or withdraw it by any other means.

PeopleAgenda: event submissions

Anyone can submit an event by pasting its link. If you give us your email, we use it solely to raise queries with you about that submission; it does not subscribe you to anything.

Data

The submitted URL and, if you provide it, your email.

Legal basis

Legitimate interest in reviewing and publishing the submitted content.

Retention

One year from the submission.

In order to fill in the event record, the public content of the page you point us to is sent to an artificial intelligence provider which extracts the date, place, format and organiser. That provider does not receive your email or any of your contact details.

Site audience measurement

We measure traffic in aggregate form in order to know which content is read and where visits come from. We do not use cookies or store identifiers on your device, and we do not build profiles or track specific individuals across visits.

Data

Page visited, referral source, country, device type and browser, in aggregate form.

Legal basis

Legitimate interest in understanding the use of the site and improving it.

Retention

Aggregate data, kept for up to 12 months.

You have the details in the cookie policy.

Security and access logs

Data

IP address, date and time, and the operation carried out in the services requiring authentication.

Legal basis

Legitimate interest in the security of the systems and compliance with legal obligations.

Retention

Twelve months.

4. Source of the data

The data comes from you, except for the data provided to us by a client organisation about its workforce, in which case we act as processor (section 2). If you provide us with data about third parties, you undertake to have informed them beforehand.

5. Who we share your data with

We do not sell or disclose personal data for advertising purposes. It is shared with us, as processors and under contract, by the suppliers needed to provide the service:

• Vercel — hosting and delivery of the websites and aggregate audience measurement.
• Xano — hosting of the database and of the application logic.
• Twilio SendGrid — sending of transactional email and of the PeopleAgenda summary.
• Twilio — sending of the WhatsApp notifications, where you have activated them.
• OpenAI — extraction of the event details from the public page submitted.

In addition, we may disclose data to public authorities, to the courts and to law enforcement bodies where there is a legal obligation to do so.

6. International transfers

Some of these suppliers are established in the United States. The transfers rely on the standard contractual clauses approved by the European Commission or on the applicable adequacy decision, together with any supplementary measures required. You may request a copy of these safeguards by writing to dpo@winchange.io.

7. Your rights

You may exercise at any time, and free of charge, the rights of access, rectification, erasure, objection, restriction of processing and portability, as well as the right not to be subject to decisions based solely on automated processing and to withdraw any consent you have given, without this affecting the lawfulness of the processing carried out beforehand.

Write to dpo@winchange.io or to Plaza de Olavide 12, 2ºC, 28010 Madrid, stating the right you wish to exercise. We may ask you to prove your identity. We will reply within one month.

If you consider that we have not dealt with your request properly, you may lodge a complaint with the Agencia Española de Protección de Datos (the Spanish data protection supervisory authority, www.aepd.es).

8. Minors

Our services are aimed at professionals and are not intended for children under fourteen. If we detect that we have collected data from a minor without the authorisation of the holder of parental responsibility or guardianship, we will delete it.

9. Security

We apply technical and organisational measures appropriate to the risk, among them encryption in transit, role-based access control and logging of the operations carried out on the authenticated services.

10. Changes to this policy

We may update this policy when the services or the legislation change. The date of the last revision appears at the top and, if the change affects you significantly, we will notify you by email.