Commitment to Data Protection
AgenteUno complies with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation — GDPR) and Spanish Organic Law 3/2018, of December 5, on Personal Data Protection and Digital Rights Guarantee (LOPDGDD).
Regulations We Comply With
| Regulation | Reference | Scope |
|---|---|---|
| GDPR | Regulation (EU) 2016/679 | Personal data protection |
| LOPDGDD | Organic Law 3/2018 (BOE-A-2018-16673) | National GDPR implementation |
| LSSI-CE | Law 34/2002 (BOE-A-2002-13758) | Information society services, cookies |
| EU AI Act | Regulation (EU) 2024/1689 | AI transparency and governance |
| Robinson List | Art. 23 Law 11/2022 (LGTel) | Right to exclusion from commercial communications |
Servers in the European Union
All our data is stored exclusively on servers located within the European Union, ensuring your data never leaves EEA territory.
- Main infrastructure: Hetzner Online GmbH (Falkenstein and Nuremberg, Germany)
- Infrastructure provider certifications: ISO/IEC 27001, SOC 2 Type II
- Data centers: Tier III+ with 24/7 physical security, redundant power and N+1 cooling
Important note: The ISO 27001 and SOC 2 Type II certifications mentioned correspond to our infrastructure provider (Hetzner). AgenteUno, as a company, operates aligned with the principles of these standards and is in the process of preparing for its own certification.
Technical and Organizational Measures (Art. 32 GDPR)
Encryption
- TLS 1.3 for data in transit
- AES-256 for data at rest
- Encryption of credentials and API tokens
Access Control
- Multi-factor authentication for employees
- Principle of least privilege
- Logging of all access to personal data
- Centralized identity management (Keycloak)
Backup and Recovery
- Daily encrypted backups
- 30-day retention
- Documented disaster recovery plan
Monitoring
- Real-time error detection (Sentry, configured without personal data)
- Security log review
Voice Processing and AI
AI Transparency
Under Regulation (EU) 2024/1689 (EU AI Act):
- Our voice agents inform at the beginning of each call that the user is speaking with an artificial intelligence assistant
- We do not perform biometric recognition, emotion detection or voice-based profiling
- Voice data is processed exclusively for the agreed communication purpose
- Users can request transfer to a human operator at any time
Voice Data
- Voice recordings are stored for a maximum of 90 days (configurable by the client)
- Transcriptions are linked to conversation history (12 months, configurable)
- We do not use call recordings to train AI models
Robinson List Compliance
AgenteUno implements an automated verification system against the Robinson List (Advertising Exclusion Service managed by the Spanish Digital Economy Association):
- Mandatory pre-verification: Before any outbound commercial communication, we verify that the recipient is not registered on the Robinson List
- Updated cache: We maintain a synchronized cache for instant queries
- Audit log: Each verification is recorded in our compliance log
- More information: listarobinson.es
Regulated Contact Hours
We comply with Spanish regulations for commercial telephone communications:
- Monday to Friday: 09:00 — 21:00 (Madrid time)
- Saturdays: 10:00 — 14:00
- Sundays and holidays: No calls made
Contact Limits
- Maximum 3 contact attempts per month per recipient
- 48-hour cooling period between attempts
- Each attempt is recorded in our audit system
International Transfers
Most of our providers operate on European infrastructure. For natural language processing (LLM) we use Groq Inc. (USA) with Zero Data Retention enabled and under Standard Contractual Clauses (Art. 46 GDPR). We continuously evaluate European alternatives to minimize international transfers.
Record of Processing Activities
We maintain an updated record of all personal data processing activities, pursuant to Article 30 of the GDPR, available to the supervisory authority upon request.
Security Breach Notification
In the event of a security breach affecting personal data:
- We will notify the AEPD within a maximum of 72 hours (Art. 33 GDPR)
- We will notify affected individuals without undue delay when the breach poses a high risk (Art. 34 GDPR)
- We will document all breaches and corrective measures taken
Impact Assessments (DPIA)
We conduct Data Protection Impact Assessments (DPIAs) pursuant to Art. 35 GDPR for any processing that may pose a high risk to individuals' rights and freedoms, including AI voice processing.
Your Rights (Arts. 15-22 GDPR)
- Access (Art. 15) — Know what data we hold about you
- Rectification (Art. 16) — Correct inaccurate data
- Erasure (Art. 17) — The "right to be forgotten"
- Restriction (Art. 18) — Restrict how we use your data
- Portability (Art. 20) — Take your data in a standard format
- Objection (Art. 21) — Object to processing
- No automated decisions (Art. 22) — Request human intervention
Exercise your rights: [email protected]
Supervisory Authority
If you believe your rights have not been adequately addressed, you can file a complaint with:
Spanish Data Protection Agency (AEPD)
- Web: www.aepd.es
- Address: C/ Jorge Juan, 6 — 28001 Madrid
- Phone: 900 293 183