Helena

GDPR overview

GDPR implementation is concrete and documented. The policy is titled "Política de Privacidad y protección de datos RGPD" and recalls that the Regulation has applied directly since 25 May 2018. A data protection officer is designated, with a support team, a postal address and a dedicated mailbox. The controller is named, its legal bases are set out one by one — contract performance, legitimate interest for marketing to existing customers, consent for non-customers — and retention is described per purpose. Data subject rights are listed in full, including the right not to be subject to solely automated decisions, and each one has its own online form. Postal and email routes are given, and the right to complain to the supervisory authority is stated. No Article 27 representative is named, which is consistent with a controller established in Spain.

Who owns the data?

The controller is Editorial Jurídica Sepín, S.L., based at C/ Mahón 8, Las Rozas, Madrid, with a designated data protection officer reachable at delegadodeprotecciondedatos@sepin.es. The privacy policy states that Helena neither stores nor keeps the original files users upload, whatever their format, and that they are deleted automatically once processing ends. Only the extracted content stays attached to the conversation, and the user can remove it at any time through the "eliminar chat" option. Sepín undertakes not to disclose personal data to third parties except where the law requires it or the user has consented beforehand, and says it informs customers when a separately contracted tool involves such a transfer.

Reuse rights

The published terms grant use of the site and its contents for the customer's own personal and professional purposes only. Reproduction, distribution, public communication or any other form of exploitation of the contents, commercial or not, requires Sepín's prior written authorisation, and automated or bulk extraction by bots or scripts is expressly forbidden. So the end user cannot freely reuse or redistribute the publisher's material without asking. As for the customer's own inputs, the privacy policy limits their use strictly to producing the answer requested: they are not used to train any model and serve no other purpose. Sepín also reserves the right to monitor consumption and to terminate the contract early where it detects abusive or fraudulent usage patterns.

Data retention & training

Hosting summary

The site makes no statement about where customer data is hosted. Neither the privacy policy, the legal notice nor the terms name a hosting country, a region, a hosting provider or a subprocessor, and there is no mention of standard contractual clauses or of transfers outside the European Economic Area. What can be established is jurisdictional rather than technical: the controller, Editorial Jurídica Sepín, S.L., is established in Madrid, Spain, disputes are placed before the Madrid courts under Spanish law, and the processing is therefore governed by the GDPR. A purely technical observation, which concerns the marketing website and not the Helena platform, is that the site resolves to an address in Madrid served from a Spain Central cloud region. That says nothing about where documents submitted to Helena are processed or stored, and it should not be read as a hosting commitment. Firms with data residency obligations will need to obtain this in writing from the vendor.