Privacy policy
This is an English translation provided for convenience. In case of any discrepancy, the Spanish version prevails.
1. Data controller
- Identity: CUMPLIFAI, S.L.
- Tax ID (CIF): B93928588
- Registered office: Calle Cerro del Campo, 28052 Madrid, Spain
- Registration details: Madrid Commercial Registry, Section 8, Sheet M-895868, 1st Entry
- Trade name: Cumplifai (brand / project)
- Contact email: hola@cumplifai.com
The data controller is a commercial company incorporated under Spanish law and registered with the Madrid Commercial Registry, operating under the trade name Cumplifai.
2. Processing, categories of data, purposes and legal basis
We only process personal data when you actively provide it and tick the box accepting this policy in the relevant form. The legal basis for all the processing described is the consent of the data subject (Article 6.1.a GDPR). You can withdraw it at any time by contacting us, without affecting the lawfulness of processing based on consent before its withdrawal.
| Collection point | Categories of data | Purpose | Legal basis |
|---|---|---|---|
| Contact form | Identification: name. Contact: email address. Professional profile: type of business (optional). Marketing: campaign attribution parameters (UTM, gclid, referrer, etc.) where available. | To answer your enquiry, respond about SimplifiAML and offer you information adapted to your sector. | Consent of the data subject (Art. 6.1.a GDPR) |
| Risk calculator / quiz | Identification: name. Contact: email, phone (optional), company (optional). Profile: business sector, answers to the questionnaire, score, exposure level, estimated volume. Marketing: attribution data. | To give an indicative assessment of whether your activity may be subject to AML obligations, show you a personalised result and carry out commercial follow-up. | Consent of the data subject (Art. 6.1.a GDPR) |
| PDF guide downloads (lead magnet) | Identification: name. Contact: email, phone (optional). Profile: sector of the guide, identifier of the requested document. Marketing: attribution data. | To provide the guide you requested, send you the link by email and carry out commercial follow-up related to the sector. | Consent of the data subject (Art. 6.1.a GDPR) |
| Partner programme | Identification: name. Contact: email, phone (optional). Professional: firm or company (optional), approximate number of obliged clients (optional). Marketing: attribution data. | To manage your application to join the partner programme and contact you to explain the terms and next steps. | Consent of the data subject (Art. 6.1.a GDPR) |
| Campaign attribution (linked to forms) | Marketing: UTM parameters, ad click identifiers (gclid, gad_campaignid, gbraid, wbraid), landing URL (landing_path), referring site (referrer). | To attribute each request to its originating campaign and measure the effectiveness of digital marketing. | Consent of the data subject (Art. 6.1.a GDPR) |
Demo bookings (Cal.com / Calendly): if you use the booking widget or links, the data you enter will be processed directly by those providers as independent controllers, under their own privacy policies.
3. Retention period
We keep your data for as long as necessary to fulfil the purpose for which it was collected (answering enquiries, delivering guides, commercial follow-up or managing the partner programme) and, thereafter, for the limitation period of legal liabilities, up to a maximum of 3 years from the last interaction, unless a longer retention period is required by law.
Attribution data remains linked to the record of the request in our database for the same period. You can request earlier erasure by exercising your rights (section 6).
4. Processors and international transfers
We do not sell your data. We only share information with the processors that provide us with technology or communication services, or with independent controllers when you book a demo:
Neon
Purpose: Database hosting (web requests, site records)
Location: May involve processing in the EEA and/or the US.
Safeguards: Data processing agreement and standard contractual clauses where applicable
Resend
Purpose: Sending transactional and notification emails
Location: European Union
Safeguards: Data processing agreement
Vercel
Purpose: Hosting, deployment and delivery of the website
Location: EEA and/or US
Safeguards: EU-US Data Privacy Framework and/or standard contractual clauses
Google (Tag Manager / Analytics)
Purpose: Analytics measurement of website use
Location: EEA and/or US
Safeguards: Only activated with cookie consent; transfers under Google’s safeguards and the DPF where applicable
Google (Places API)
Purpose: Internal B2B prospecting (business data from public sources)
Location: EEA and/or US
Safeguards: Internal use by the controller; not linked to public forms; Google’s contractual safeguards
Cal.com and Calendly
Purpose: Managing demo and meeting bookings
Location: EEA and/or US (depending on the provider)
Safeguards: They act as independent controllers when you book; see their privacy policies
Anthropic
Purpose: Internal automated processing (content generation and support for commercial management)
Location: US
Safeguards: Only on data already stored in our systems; it does not directly receive public form submissions; standard contractual clauses
When a provider processes data outside the European Economic Area, we adopt the safeguards required by the GDPR: standard contractual clauses approved by the European Commission, certification under the EU-US Data Privacy Framework or other equivalent measures, depending on the provider and the nature of the processing.
5. Security measures
The controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration, including, among others: encrypted transmission (HTTPS/TLS), access control to administrative panels, storage with providers holding security certifications, passwords and access credentials restricted to the controller, and minimisation of the data collected in each form.
No system is completely infallible. If you detect an incident affecting your data, you can report it to hola@cumplifai.com.
6. Rights of the data subject
Under the GDPR and the LOPDGDD, you have the right to:
Access
Find out whether we process your data and obtain information about it
Rectification
Correct inaccurate data or complete incomplete data
Erasure
Request the deletion of your data where applicable
Objection
Object to processing in the cases provided for by law
Restriction
Request the restriction of processing in certain cases
Portability
Receive your data in a structured format and transmit it to another controller
To exercise your rights, send an email to hola@cumplifai.com stating the right you wish to exercise, together with sufficient information to identify you. We will respond within a maximum of one month, which may be extended by two further months in particularly complex cases.
You have the right to withdraw your consent at any time, free of charge and without disproportionate consequences.
If you consider that the processing infringes data protection law, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).
7. Cookie policy
We use cookies and similar technologies stored on your device. Strictly necessary and preference cookies remember your choice about analytics. Google Tag Manager analytics cookies are only loaded if you expressly accept them in the cookie banner.
cumplifai_consent
Technical / preferences (first-party) · 1 year
Purpose: Stores whether you have accepted or rejected analytics cookies
cumplifai_attr
Attribution / marketing (first-party) · 90 days
Purpose: Records campaign parameters (UTM, gclid, etc.) to link your form submissions to their advertising source
Google Tag Manager / Google Analytics
Analytics (third-party; requires consent) · According to Google’s cookie policy
Purpose: Measures traffic, pages visited and usage events on the website, in aggregate
The cumplifai_attr cookie is first-party, lasts 90 days and stores campaign parameters to attribute the requests sent from the forms. Its processing is based on the consent you give when accepting this policy in each form.
You can change your decision about analytics cookies by deleting your browser cookies or by clicking Manage cookies in the footer, which shows the preferences banner again.
Last updated: 5 June 2026