Privacy Policy

1 Data controller

Company

CARABELA AI SL

Tax ID (NIF)

B26870923

Registered office

Paseo del Club Deportivo, 1, Edificio 4, 1st floor, 28223 Pozuelo de Alarcón (Madrid), Spain

Privacy contact

general@carabela.ai

2 Data we process

Depending on the interaction, we may process the following categories of data:

• Professional identification and contact data: name, surname, email, phone, company and job title.
• Request and communication data: content of messages, queries, demo requests and scheduled meetings.
• Customer and billing data: contracting entity, contact person, tax and payment information.
• Platform access and usage data: credentials, activity logs, IP address, technical identifiers and usage metrics.
• Customer-uploaded content: documents, tender specifications, proposals and other materials the customer chooses to process through the service.
• Browsing data: obtained through cookies and similar technologies, as detailed in our Cookie Policy.

We do not request special categories of data. We recommend not including such information in communications or in documents uploaded to the platform unless strictly necessary.

3 Purposes of processing

• Responding to enquiries, information requests and demo requests.
• Managing the contractual relationship with customers and providing the SaaS service.
• Enabling access, use and administration of the platform.
• Billing and compliance with accounting, tax and commercial obligations.
• Sending commercial communications about our services where there is a legal basis to do so.
• Ensuring security, availability and improvement of the service.
• Compliance with legal obligations and responses to requests from competent authorities.

4 Legal basis

• Performance of a contract or pre-contractual measures (art. 6.1.b GDPR): handling requests, onboarding and provision of the service.
• Compliance with legal obligations (art. 6.1.c GDPR): accounting, tax, commercial and cooperation obligations with authorities.
• Legitimate interest (art. 6.1.f GDPR): platform security, fraud prevention, service improvement and commercial communications about similar products to existing customers (art. 21.2 LSSI).
• Consent (art. 6.1.a GDPR): commercial communications to non-customers, subscriptions and non-essential cookies. Consent may be withdrawn at any time.

5 Processing within the SaaS platform

With respect to personal data and documents that the customer enters or generates within the platform, Carabela AI acts as a data processor on behalf of the customer, who remains the data controller. Such processing is governed by the corresponding service agreement and by a Data Processing Agreement (DPA) pursuant to article 28 GDPR, made available to the customer and which may be executed upon request.

Carabela AI processes such information solely on the documented instructions of the customer, for the sole purpose of providing the contracted service, and applies appropriate technical and organisational measures to ensure confidentiality and integrity.

6 Use of artificial intelligence

The platform incorporates artificial intelligence features (including third-party language models) to assist customers with tender analysis, search, drafting and similar tasks.

• Customer content is processed solely for the purpose of delivering the requested service.
• Customer data and documents are not used to train general AI models, except with express, separate and informed authorisation.
• Where third-party AI model providers are used, they are engaged under terms that prohibit the use of customer content for training their models.
• AI-generated outputs may contain inaccuracies; the customer remains responsible for reviewing them before use.

The Site’s conversational assistant

The Site includes a conversational assistant. When you write to it, the content of your messages is sent to a language-model provider in order to generate the reply. This processing is distinct from the one described in the previous section: here Carabela AI acts as data controller, not as a processor on behalf of a client.

Please do not enter third-party personal data, tender documentation or confidential information into the assistant. It is a commercial information channel, not the environment in which the contracted service is delivered.

Tender search plugin for ChatGPT

When you use the Carabela AI plugin in ChatGPT, we receive the text of your search and any filters you set (countries, amounts, dates, CPV codes) solely in order to return public tenders to you. We do not keep the search text or the values of the filters. For the security of the service and to prevent abuse, we log the IP address, the client identifier, the date, the number of results and the types of filter used (legitimate interest, art. 6.1.f GDPR); this data is kept for 365 days in our audit logs and for 14 days in the web server logs. To interpret your search, the text is processed by an artificial intelligence provider (OpenAI) acting as a data processor. The plugin is free, requires no registration and collects no account data. Tender data comes from official public sources.

7 Recipients and processors

We do not transfer personal data to third parties except where legally required. To deliver the service, we engage providers acting as data processors, duly bound by contract under art. 28 GDPR. Categories of providers include, as required:

• Cloud infrastructure and hosting.
• Artificial intelligence model providers.
• Web analytics tools (including Google Analytics).
• Customer communication and meeting scheduling solutions.
• Billing and payment platforms.
• Support, CRM and transactional email tools.

An up-to-date list of sub-processors used in the provision of the service may be made available to customers upon request as part of the DPA.

8 International transfers

Some providers may be located outside the European Economic Area. In such cases, transfers are made under appropriate safeguards provided by the GDPR, in particular European Commission adequacy decisions or Standard Contractual Clauses (SCCs), supplemented where necessary by additional measures ensuring an equivalent level of protection.

9 Retention periods

• Commercial contacts and leads: while there is mutual interest and, in any case, until deletion is requested.
• Customer and platform data: for the term of the contract and, after termination, for the applicable statutory limitation periods.
• Customer-uploaded content: as set out in the contract and DPA; on termination, returned or deleted in accordance with the customer's instructions.
• Data subject to legal obligations (tax, accounting, commercial): for the periods required by applicable law.
• Commercial communications: until consent is withdrawn or unsubscription is requested.

10 Rights of data subjects

Data subjects may exercise their rights of access, rectification, erasure, objection, restriction of processing, portability and not to be subject to automated individual decisions, as well as withdraw any consent given.

Requests may be sent to general@carabela.ai, indicating the right to be exercised. Where the data relates to processing in which Carabela AI acts as processor, the request will be forwarded to the controller customer or handled in accordance with their instructions.

Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they consider that their rights have not been duly addressed.

11 Security

We implement appropriate technical and organisational measures pursuant to art. 32 GDPR to ensure the confidentiality, integrity, availability and resilience of systems and services, including access control, encryption in transit, activity logging, backups and incident management processes.

12 Commercial communications

We only send electronic commercial communications where prior consent exists or, in the case of customers, where they relate to products or services similar to those contracted, in accordance with art. 21.2 LSSI. Recipients may object or unsubscribe at any time, simply and free of charge, via the link included in each communication or by writing to general@carabela.ai.

13 Cookies

The use of cookies and similar technologies on the website is governed by our Cookie Policy, which details their type, purpose and how to manage consent.

14 Minors

Our services are aimed at professionals and organisations (B2B environment) and not at minors. We do not knowingly collect data from minors. Should we become aware of such processing, we will proceed to delete the data.

15 Changes to this Policy

This Policy may be updated to reflect regulatory, case-law or service changes. The version in force will be the one published on the website, indicating the date of the last update.