Privacy Policy.

Identification of the Data Controller

The controller responsible for the processing of personal data is:

What information do we collect from the user?

We collect the following personal information:

• Identification and contact data: name, surname, email address, phone number.
• Browsing data: IP address, browser type, visit duration, pages visited, device used, approximate location.
• Data provided through forms: information supplied when filling in contact or subscription forms.
• Information collected via cookies and similar technologies: more details in our Cookies Policy.

We do not collect specially protected data or information from minors without consent from their parents or guardians.

Purposes for which we process your data

We will use your personal data for the following purposes:

• To contact you when you request it.
• Sending commercial communications, provided that you have given us your express consent.
• Improving the user experience by analysing browsing data.
• Complying with legal obligations when required.

Legal bases for the processing of personal data

The processing of your personal data will be based on:

• Your express consent, when completing forms or accepting cookies.
• The application of pre-contractual measures.
• Performance of a contract, in the event that you acquire our services.
• The legitimate interest of Neuronal AI Group, S.L.
• Compliance with a legal obligation.

You may withdraw your consent at any time by sending an email to dpo@neuronus.ai.

When do we share your information with third parties?

We may share your information with:

• Technology or support service providers.
• Public authorities and legal bodies, when there is a legal obligation.
• Companies of the Neuronal AI group, when necessary for the provision of the service.

International Data Transfers

At Neuronal AI Group, S.L. we process your data within the European Economic Area (EEA) —formed by the countries belonging to the European Union, in addition to Iceland, Liechtenstein and Norway— and, in general, we contract service providers also located within the EEA or in countries that have been declared to have an adequate level of protection.

Notwithstanding the above, we may need to transfer your information to service providers in countries outside the EEA or to countries that have been declared to have an adequate level of protection.

This type of data transfer may occur if:

• Our servers (that is, where we store data) or our service providers are located in countries outside the EEA or countries that have not been declared to have an adequate level of protection.
• You use our services and products during visits to countries outside the EEA.

If Neuronal AI sends your information to a country that is not part of the EEA or to countries that have been declared to have an adequate level of protection, we will ensure that your information is appropriately protected. We will always ensure the existence of an appropriate contract covering the data transfer.

Furthermore, if the country is deemed not to have laws equivalent to EU data protection standards, we will ask the third party to enter into a legal agreement reflecting such standards.

In addition, where necessary, we will request prior authorisation from the Spanish Data Protection Agency to be authorised to carry out the international transfer.

Exercise of Rights

You may exercise the following rights by sending an email to dpo@neuronus.ai:

• Access: to know what data we hold about you and access it.
• Rectification: to correct incorrect data.
• Erasure: to delete your personal data.
• Objection: to prevent the processing of your data.
• Restriction: to limit the use of your data.
• Portability: to receive your data in a structured format.

If you are not satisfied with the response, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Retention period for Personal Data

Personal data will be retained for as long as necessary, depending on the legal basis for which they have been collected.

Ultimately, we will retain your data only to comply with legal obligations and to allow the formulation, exercise or defence of claims during the limitation period of actions arising from contractual relationships.