Privacy Policy for AI Powered Document Assistant

1.- Introduction and Scope

SUMAMOOS BI & DIGITAL CHANNELS, S.L. («SUMAMOOS», «we», «us», or «our») is committed to protecting your privacy and ensuring the security of your Personal Information. This Privacy Policy outlines our practices regarding the collection, use, disclosure, and protection of Personal Information when you interact with our listing on the Microsoft Azure Marketplace or AppSource (specifically the «Contact Me» feature) and when you evaluate or use our AI Powered Document Assistant (the «Service»).

This policy acts as a specific supplement to our general corporate Privacy Policy. By requesting information about or using our Service, you acknowledge that you have read and understood this Privacy Policy.

2.- Information We Collect

To provide and manage our Service, we collect Personal Information (data that identifies or can be used to identify you) through the following channels:

• Lead Generation Data («Contact Me»): When you express interest in our Service via the Azure Marketplace «Contact Me» button, request a demo, or contact our sales team, we collect your First Name, Last Name, Business Email Address, Phone Number, Job Title, Company Name, and any other details you choose to provide in your request.
• Usage and Technical Data: When you interact with our Service, we may automatically collect technical data, including your IP address, browser type, operating system, device identifiers, and usage logs to ensure the security and proper functioning of the platform.
• AI Interaction and Document Data: If you proceed to use, pilot, or deploy our AI Document Assistant, you may upload corporate documents and submit text queries (prompts) to the chat interface. We process the text contained within these documents and your chat queries strictly to generate the requested responses.

3.- How We Use Your Information & Legal Basis

Under the General Data Protection Regulation (GDPR) and other applicable data protection laws, we process your information based on the following legal grounds and for the following purposes:

• To respond to your inquiries (Legitimate Interest / Pre-contractual Measures): To process the leads generated via the Azure Marketplace, contact you regarding your request, and provide you with demonstrations, pricing, or deployment options.
• To provide the Service (Performance of a Contract): To set up your tenant, facilitate the deployment of our AI assistant, and provide ongoing technical support.
• To improve our Services and Security (Legitimate Interest): To analyze technical logs, troubleshoot issues, ensure the security of our infrastructure, and prevent unauthorized access.

To comply with legal obligations (Legal Obligation): To maintain accurate business and financial records as required by Spanish and European laws.

4.- AI Processing and Document Confidentiality

Given the nature of the AI Powered Document Assistant, SUMAMOOS enforces strict data boundaries to protect your intellectual property and personal data:

• No Public Model Training: Data inputted into our Service (including uploaded documents, user prompts, and generated chat responses) is strictly excluded and never used to train, retrain, or improve any public Large Language Models (LLMs) or third-party foundational models.
• Tenant Isolation: Your documents and chat queries are processed within a secure, isolated cloud environment. Your corporate data is never shared across different customer tenants or utilized for cross-customer analytics.
• Data Control: Document processing is performed solely to provide the chat functionality to your authorized users, adhering to the access controls and retention policies established by your organization during deployment.

5.- Sharing and Disclosure of Information

We do not sell, rent, or trade your Personal Information. We may share your information only in the following limited circumstances:

• Cloud Service Providers: We engage trusted third-party vendors, primarily Microsoft Azure, to host our infrastructure and provide secure computing environments. These providers are bound by strict data processing agreements (DPAs) and confidentiality obligations, acting solely as data processors.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your Personal Information may be transferred as part of the transaction, subject to standard confidentiality arrangements.

Legal Requirements: We may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of SUMAMOOS, our users, or the public.

6.- International Data Transfers

SUMAMOOS operates primarily in Spain (within the European Economic Area – EEA). However, depending on your deployment preferences and our cloud infrastructure, data may be processed outside the EEA. Whenever we transfer your Personal Information internationally, we ensure it is protected by appropriate legal safeguards, such as the European Commission’s Standard Contractual Clauses (SCCs) or relevant adequacy decisions, ensuring a level of protection equivalent to the GDPR.

7.- Data Security and Retention

We implement robust technical and organizational security measures (including encryption in transit and at rest, role-based access controls, and secure development practices) designed to protect your data against unauthorized access, loss, or alteration.

• Lead Data: Information collected via the «Contact Me» feature is retained for as long as necessary to manage the commercial relationship, or until you withdraw your consent or request deletion.
• Service Data: Documents and chat histories are retained according to the specific configuration of your deployed Service and our contractual agreement, after which they are securely deleted or irreversibly anonymized.

8.- Your Data Privacy Rights

Under the GDPR, you possess specific rights regarding your Personal Information:

• Right of Access: You can request a copy of the Personal Information we hold about you.
• Right to Rectification: You can request that we correct inaccurate or incomplete data.
• Right to Erasure («Right to be Forgotten»): You can request the deletion of your data, subject to certain legal exceptions (e.g., overriding legal retention requirements).
• Right to Restrict or Object to Processing: You can object to our processing of your data, particularly for direct marketing purposes.
• Right to Data Portability: You can request your data in a structured, commonly used, and machine-readable format.

To exercise these rights, please contact us using the details provided in Section 10. We will respond to your request within one month, as stipulated by law. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe your rights have been violated.

9.- Changes to This Privacy Policy

We reserve the right to update this Privacy Policy periodically to reflect changes in our Service, technical practices, or regulatory requirements. We will notify you of material changes by updating the «Effective Date» at the top of this document or via direct communication if you are an active customer.

10.- Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, our use of your information, or our AI data practices, please contact our team:

SUMAMOOS BI & DIGITAL CHANNELS, S.L.

Avda. Jean Claude Combaldieu s/n – Distrito Digital 03008 Alicante, Spain

Cif: B54849930

Email: info@sumamoos.com

Phone: +34 965 555 863