Salescaling Privacy Policy

Last policy review: 05/13/2025

Who is the Data Controller?

SALESCALING SOFTWARE, S.L.
N.I.F.: B19825488
Postal address: C/ Crujiola, 6-edificio Alsaca, Torre 2, Piso 5, 38530, Candelaria (Santa Cruz de Tenerife)
Email: legal@salescaling.com

If you wish to contact us regarding your Personal Data, you can do so at the address indicated in the previous point.
The Data Controller may also be referred to as “SALESCALING”, the “Controller”, “Platform” or “we”.

Introduction

SALESCALING (owns the domain https://salescaling.com, https://app.salescaling.com) as well as this website and/or the web App and/or any other type of computer program developed, operated and/or maintained by SALESCALING (hereinafter the “Platform”).

Through this text, SALESCALING's Privacy Policy is made available to the User (hereinafter also referred to as “User”, “Data Subject” or “you”) in order to describe the personal information we collect, the purpose for which we use it and, in general, the processes and ways in which we process it during the use and/or of the Platform by Users (both registered and unregistered, depending on the processing) during their navigation through it.

SALESCALING may make this Privacy Policy available to the User in different languages. In such a case, this Spanish version will prevail in case of interpretive conflict.

Processing of personal data on behalf of our clients

When the Platform is integrated by our end clients into their business activity under a service contract, the Platform will process personal data for the provision of services on behalf of said clients, acting as a Data Processor.

In such a case, the referred client will be the Data Controller of the personal data they share with, or enter into, the Platform.

The processing of personal data by SALESCALING as Data Processor will not be governed by this Privacy Policy, but by the provisions of the service provision contract between the Platform and the end client, in accordance with the instructions and purposes specified therein, as well as in the specific Data Processing Agreement and with the privacy policy of the end client that integrates our services, in compliance with current data protection regulations.

Processing and purposes for which we process your data as data controllers

Processing we carry out as Data Controllers:

Platform Functionality

Purpose: To allow the use of the Platform and navigation through it by Users, ensuring the correct functioning of the Platform, allowing technical updates and maintenance, improving navigability, security, and performance.
Categories of data processed:
Platform Usage Data by the User and application and device data; including the following: browsing and usage data, IP address, usage preferences, visits made, language, device information, browser type, device type and operating system, approximate location by region and country of access; as well as cookies; and anonymized statistical data.
Likewise, if the User arrives at the Platform through an external source (such as, for example, through a link from a website or a third-party social network), the Controller will collect statistical and anonymous information about the source from which the visitor comes in order to better understand how users discover and arrive at the Platform and/or to improve the company's marketing and positioning strategies.
Categories of Data Subjects: Registered and unregistered Users who use the Platform.
Method of obtaining: Shared by the User through navigation within the Platform environment.
Legal bases: Our legitimate interest in ensuring the proper, updated functioning and guaranteeing the improvement and security of the Platform and Users, and in knowing the origin and source from which the user comes; or the User's consent otherwise (e.g., regarding cookies that are not necessary to guarantee the functioning of the Platform).
Retention period: Usage Data will be kept for a maximum of 12 months from collection, in accordance with Law 25/2007 on data retention in electronic networks. After this period, the data will be deleted unless required by a public authority. Anonymized statistical data may be stored indefinitely as it does not contain personal data.
Communication: The collected data may be communicated to our technological, IT, and/or data hosting service providers essential to guarantee the purpose for which they were collected. Your data will not be sold to third parties.

Security and fraud prevention

Purpose: We collect and analyze Data Subject data to ensure the security of our Users, prevent fraud, conduct timely investigations, and use the information for possible claims in our own interest or that of third parties. This processing includes:
- Traffic data collection: We collect information about visits to our website, including IP addresses, browser type, pages visited, time spent, and other browsing data.
- Behavioral pattern analysis: We use analytical tools to identify unusual or suspicious behavioral patterns that may indicate fraud attempts or unauthorized access.
- Threat Detection: We implement intrusion detection systems and other threat analysis tools that analyze traffic in real-time to identify and block malicious activities.
- Identity verification: We use traffic data to verify user identity and ensure that transactions and accesses are legitimate.
- We maintain detailed records of accesses and activities on our website to conduct security audits and respond quickly to any incident.
- Collaboration with authorities: In case of detecting fraudulent or suspicious activities, we may collaborate with competent authorities by providing the necessary information for the investigation in compliance with a legal obligation. These processes allow us to protect the integrity of our website and the security of our Users, ensuring a safe and reliable digital environment.
Categories of data processed:
Browsing and usage data, IP address, access logs, failed login attempts and suspicious activity, device information, browser type, device type and operating system, approximate location by region and country of access.
Category of data subjects: Users who use the Platform.
Method of obtaining: Shared by the User through navigation on the Platform.
Applicable legal basis:
Compliance with legal obligations regarding access and activity logging.
The processing will be based on the Controller's legitimate interest in investigating, detecting, preventing, and prosecuting fraud, protecting its interests or those of third parties; as well as defending its interests against possible claims for contractual breaches or non-compliance with applicable regulations by Users and in ensuring the correct and secure functioning of the Platform, Users, and third parties.
Retention period:
Access and activity logs will be kept for 1 year, in accordance with Law 25/2007 on data retention in electronic networks. After this period, the data may be blocked for the legally established periods to comply with regulatory obligations and legal limitation periods if we consider that there may be a risk of receiving a claim.
Communications to third parties:
The collected data may be communicated to our technological, IT, and/or data hosting service providers essential to guarantee the purpose for which they were collected, as well as to public authorities and security forces, when required.

Provision of contracted services

Purpose:
The processing is carried out to guarantee the provision of the Platform's services consisting of:
- The recording of conversations via video calls in video and audio format, as well as their transcription into text format and storage of recordings and transcriptions. The data subject must be authorized to record and transcribe conversations in which third parties appear and must inform them of this circumstance and their data protection rights.
- The processing of the data subject's calendars whose access has been explicitly granted.
- The processing of the data subject's emails whose access has been explicitly granted.
- The processing will include the management of requests, mandates, or prior arrangements during contracting and the making of communications about the service's operation.
- Likewise, data processing will be carried out to ensure registration on the Platform and to manage payments, among other derived processing that allows guaranteeing the provision of services and executing the contract.
- If consent is obtained and the User configures it on their device, they may receive notifications on their device.
Categories of data processed:
- Billing identification data: name and surname, identity or tax number, passport or similar
- Contact data: including email address and phone number
- Service-related information, including audio and video recordings, which may contain images and voice recordings of the data subject and third parties participating in the conversation
- Payment data, including some digits of the bank card, security code, and card expiration date, if contracting services through the Platform. However, payment data will be shared by the User and stored by the payment gateway provider made available to the User to make payment for the services.
- Access data of registered Users, such as username, email address and, where applicable, the avatar designated by them on the third-party platform through which they log in or register with SALESCALING (such as, for example, Google or Microsoft).
Categories of Data Subjects:
Registered Users who contract and use the Platform's services and third parties who participate in conversations with the data subject; and employees or dependent personnel of end clients who contract the Platform's services to integrate it into their company.
Method of obtaining:
- Directly from the data subject when the data is entered by them through the use of the Platform.
- Through companies that have integrated the Platform's services into their company and share data with the Platform for the provision of services.
Legal bases:
The processing is necessary for the performance of a contract to which the Data Subject or the company is party or in order to take steps at the request of the data subject prior to entering into a contract.
Retention period:
While the services are being provided and, after their termination, your data may be blocked for the legally established periods to comply with regulatory obligations, including tax, commercial, and anti-money laundering regulations, as well as during legal limitation periods.
Video and/or audio recordings will be kept for the period agreed in the service provision contract and/or by the plan or subscription contracted by the User.
Communications to third parties:
Your data will not be communicated generally.
However, it may be communicated to our external technological, essential IT service providers, including cloud service providers, payment services, communications, generative artificial intelligence, and/or communications when necessary to guarantee the purpose in compliance with the execution of the service provision contract. And, likewise, it may be shared with authorities when required by legal obligation or judicial order.

Sending commercial communications

Purpose:
Sending commercial communications, offers, promotions, or similar, of the products offered by the Controller, according to the different possibilities:
- Email communications: Sending promotions and/or offers to the User's email address. The User may object to receiving commercial communications at any time by contacting the Controller's email address or, where applicable, through the option enabled in the email itself.
- "Push" notifications: Sending promotions and/or offers to Users' devices when they voluntarily configure it and with their consent. The user can stop receiving this type of notification by configuring their device accordingly.
- Third-party communications: Users may receive communications from third parties only when they have previously given their consent. They may withdraw their consent at any time through the Controller's contact addresses.
- Personalized communications: The sending of personalized communications according to Users' interests and preferences will require prior consent from them, and can be withdrawn at any time.

If the User wishes to stop receiving commercial communications, they can object at any time by contacting the Controller through their postal address, email, or through the channels enabled for the different communication modalities.

Data processed:
- Identification data: name and surname
- Contact data: email
- Organization data: trade name
- User preference data, if applicable
Method of obtaining: Directly from the User.
- Registered Users or SALESCALING clients: Directly from the Data Subject through their registration on the platform.
- Unregistered Users: Directly from the Data Subject through their subscription to forms, newsletters, and similar.
Legal bases:
- In relation to registered Users or clients: it will be based on the Controller's legitimate interests in informing Users about contracted or similar products and relevant information, unless the User objects to such processing.
- In relation to Users with whom there is no contractual relationship: consent will be necessary.
- Consent will also be necessary for both registered and unregistered Users, for sending push notifications, personalized communications, and third-party communications, until the withdrawal of consent, objection, or account deletion by the User.
Retention period:
Data will be processed until the User withdraws their consent. In case of user inactivity for 24 months, the Controller will stop sending commercial communications and delete the data related to this processing.
After the period or withdrawal of consent, the data may be blocked for the legally established periods to comply with applicable regulatory obligations and legal limitation periods.
Communication:
Your data will not be communicated to third-party companies, except to those that provide IT, technological, and/or technical services, and only to guarantee the aforementioned purposes.
Your data will not be sold or communicated to third parties without prior information to the Data Subject and prior obtaining of their consent.

Resolution of user inquiries

Purpose:
To ensure communication between Users and the Controller to make inquiries with customer service, file complaints, or similar, through any of the Controller's contact points including forms, electronic or postal addresses, or others made available to the User.
Categories of data processed:
Identification data, specifically name and surname and contact data, including email address and/or phone number.
Categories of Data Subjects:
Users who make the inquiry.
Method of obtaining:
Directly from Users, when they contact the Controller directly or through external subcontractors for this purpose.
Legal bases:
Consent of the Users or legitimate interest of the Controller in responding to an inquiry after receiving the request.
Retention period:
Once the purpose for which they were collected has been achieved, the data will be kept for a maximum period of 24 months, unless for reasons of legitimate interest or legal limitation periods, their retention is required for a longer period.
Communication:
Your data may be communicated to our technological, IT, and/or data hosting service providers, which are essential to guarantee the purpose for which they were collected. Your data will not be sold to third parties.

Internal analysis and development

Purpose:
The Controller may collect and process anonymized usage data to analyze the behavior and use of the Platform, browsing patterns, functionalities used by the User in order to improve the user experience and optimize functionalities, analyze usage trends for the development of new tools or services, etc.
Categories of data:
Anonymized data on platform usage, browsing patterns, and functionalities used.
Categories of Data Subjects:
Registered Users and visitors to the platform (in anonymized format).
Legal bases:
Legitimate interests in analyzing statistical and aggregated information to offer improved products and services to Data Subjects.
Method of obtaining:
Data shared by the User in relation to the use of the Services.
Retention period:
In order to fulfill the indicated purpose, the data may be stored and retained indefinitely, always in a dissociated or anonymous form, so that Data Subjects cannot be identified.
Communication:
Your data will not be communicated generally. However, it may be communicated to our external technological, IT, and/or data hosting service providers essential to guarantee the purpose for which they were collected, including automation service providers; or to authorities when required by legal obligation or judicial order. Your data will not be sold to third parties.

Where does your data come from?

As a general rule, unless otherwise indicated in specific sections of this Policy, all data comes from the Data Subject, either through browsing or using the Platform or through a communication made by the User by any of the means made available to them.

To whom do we communicate your data?

As a general rule, the Controller will not communicate your Personal Data to third parties, except when the provision of a service implies the need for a contractual relationship and is strictly necessary for the management and maintenance of the relationship between the User and the Controller and/or to fulfill the purposes.

In such a case, the communication will always be made for the time strictly necessary to allow the purposes and in accordance with data protection principles, by applying the necessary and appropriate measures to guarantee the protection of Personal Data (including the signing of a data processing agreement). Such processing will be carried out under the same or similar conditions, commitments, and responsibilities regarding privacy and data protection to which the Controller is subject. At the end of the transfer, the referred transferees or data processors will return the Personal Data to the Controller and delete any copies in their possession.

In this regard, and strictly for the purpose of fulfilling the purposes described in this Policy, the Controller may communicate your Personal Data to the categories of recipients indicated below:

Essential service providers, including IT and technological services, such as, for example, payment gateway providers, cloud storage, communication sending, authentication and security services, and artificial intelligence technology providers, among other similar ones that are necessary to guarantee the purposes.
Public authorities, by judicial order or legal imperative.
Companies and/or consultants that help us in the management of our services and in the fulfillment of purposes.

You can request additional information about the communications made to the Controller through any of the contact points indicated in this Policy.

Do we transfer data to third countries or international organizations?

As a general rule, no transfers of Personal Data to third countries or international organizations (“TTI”, hereinafter) will be made.

However, in order to guarantee the purposes, TTI may be carried out to our service providers that are essential to guarantee the purpose(s) for which they were collected. Likewise, regardless of whether SALESCALING does not carry out such TTI directly, such TTI may be carried out by service providers.

In such a case, the Controller will contract with providers that comply with the GDPR and by applying some of the guarantees provided in arts. 44 GDPR and following, to ensure an adequate level of security for the processing of Personal Data, including the adequacy decision (list of countries based on an adequacy decision) or through European Commission Standard Contractual Clauses (“SCC”, hereinafter).

For more information on international data transfers and the specific guarantees applied, you can contact us through the contact details indicated in this Privacy Policy.

Do we process special categories of personal data?

The Controller will not request or process "special categories of personal data", understood as data revealing "racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation", in accordance with Articles 9 and 10 of Regulation (EU) No. 2016/679.

However, if the user decides to share such information, such processing will be carried out in accordance with their consent.

Processing method

The processing of the data provided is based on the principles of lawfulness, transparency, purpose limitation and storage, data minimization, accuracy, integrity, and confidentiality, and will be carried out, in any case, subject to the provisions in this regard in Regulation EU 2016/679 and in Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights.

In particular, the processing may be carried out using paper, computer, and telematic tools, also in accordance with the provisions of Article 29 of Regulation EU 2016/679 and, in any case, with appropriate means to guarantee its security and confidentiality in accordance with the provisions of Article 32 of the same EU Regulation No. 2016/679.

Automated decisions

There is no automated decision-making process, not even for profiling purposes, in accordance with Article 13.2(f) of Regulation EU No. 679/2016.

Cookies

In addition to the processing described in this Policy, the Controller may also collect Personal Data through the use of cookies and other similar tracking technologies, as described in the Cookie Policy accessible via the following link.

Retention of your personal data

As a general rule, the Controller will retain your Personal Data only for as long as necessary for the purpose for which it was initially collected, and for the maximum periods indicated for each of the processing operations referred to in this Policy.

Retention periods according to data type, purposes, and applicable regulations:

Document/Data Type	Legal basis / applicable regulations	Retention period
Contractual documentation with clients	Commercial Code	6 years from contract termination
Money laundering	Law 10/2010	10 years
Platform and website users	GDPR and LOPDGDD	5 years or until deletion request
Traffic data (IP, IMSI, IMEI, etc.)	LSSI and Data Retention Law	1 year
Cookies and similar technologies	LSSI	18 months
Internal analysis and development (anonymized)	Art. 4.1 and Recital 26 GDPR	Indefinite
General legal limitation periods	Art. 1967 of the Civil Code	5 years

After the aforementioned periods, the data will be automatically deleted, without prejudice to its subsequent blocked retention when necessary for the fulfillment of certain obligations, due to legal provisions or liability, or requests and/or orders issued by Public Administrations and/or Control Authorities, for any of the reasons indicated in the previous sections.

In relation to anonymous information, the Controller will apply what is described in Recital 26 of the GDPR, which states that "Therefore, the principles of data protection should not apply to anonymous information, namely information that does not relate to an identified or identifiable natural person or to data rendered anonymous in such a way that the data subject is not or no longer identifiable." Consequently, this Regulation does not affect the processing of such anonymous information, including for statistical or research purposes.

What are your rights regarding your data?

In accordance with the GDPR, the Data Subject has the following rights in relation to their Personal Data:

Access to your data, which you can also consult in the "my data" section.
Rectification of your data, because we also want to ensure that your information is accurate and up-to-date.
Deletion of your data.
Restriction of the processing of your data.
Objection to the processing of your data, when the legal