Danelfin

GDPR overview

The privacy policy is built explicitly on the GDPR and adds the Spanish LOPD (Organic Law 3/2018 of 5 December) and the LSSICE (Law 34/2002 of 11 July). A Data Protection Officer is designated and contactable at dpo@danelfin.com. The listed rights are access, rectification, erasure, objection, restriction in four enumerated situations, and portability in electronic format. Exercising them is free, although a copy of an identity document is required, and consent can be withdrawn at any time through the DPO. Users are told they may complain to the competent supervisory authority. The company is established in Spain, so no Article 27 representative applies. Two gaps are worth noting: no Data Processing Agreement is published and no subprocessor list is disclosed.

Who owns the data?

The data controller is Danelfin Technologies, S.L., registered at Via Augusta 200, 3rd Floor, 08021 Barcelona, Spain, with NIF B67228528 and entered in the Barcelona Mercantile Registry under volume 46481, folio 104, sheet B521422. A Data Protection Officer is named and reachable at dpo@danelfin.com. The privacy policy commits the company never to share personal data with anyone unless the law requires it or the user gives express consent. Users remain responsible for the accuracy of what they submit. On the product side, the API terms state that all rights in the API and in the scores and data it returns remain the exclusive property of Danelfin.

Reuse rights

Processing rests on consent, given when a visitor submits a form, opens an account, subscribes to a paid plan, registers for an event, sends a CV, signs up to a newsletter or downloads a document. Stated purposes are account communication, commercial notifications, answering enquiries, satisfaction surveys, user experience analysis through cookies, event management, recruitment, audience measurement from IP addresses, and segmentation or profiling, which the policy describes as having no significant effect on user rights. The categories handled include identifying data, academic and professional data, traffic and location data, electronic communications metadata, commercial data, and economic, financial and banking data. No special categories are collected. Card payments are processed by Stripe. On the output side, users may view, print, copy and store site content for strictly personal and private use; reproduction, distribution or public communication for commercial purposes is expressly prohibited without authorisation, and API subscribers may not redistribute, resell or sublicense any data or scores obtained through the API. Nothing in the documents states that customer data is used to train the models.

Data retention & training

Hosting summary

The terms of use name the web host as OVH Hispano SLU, at Calle Alcala 21, 5th floor, 28014 Madrid, Spain, reachable at support@ovh.es. That places hosting inside Spain, and therefore inside the European Union, under the same jurisdiction as the publisher: Danelfin Technologies, S.L. is registered in Barcelona and the terms state that the relationship is governed by Spanish law, with disputes settled by the competent Spanish courts. The API terms repeat this, applying Spanish law and Spanish courts. No other hosting country or region is mentioned anywhere on the site, and no broad region such as the EU is named as such. Data in transit is protected by an SSL certificate, and the company acknowledges it cannot guarantee absolute security while committing to notify users of any incident it becomes aware of. Beyond Stripe, which is identified as the payment processor, no third-party processor is named and no subprocessor list is published.