Privacy policy

Data controller

The data controller for the personal data collected through this website and the autonomia360 platform is Autonomia 360 S.L., Spanish tax ID (NIF) B88812243, with registered office at C. Portal de Cerdanya 3, 25700 La Seu d'Urgell (Lleida), Spain (hereinafter, "the Company"). If you have any questions about your data, you can write to us at hola@autonomia360.es. The Company has not appointed a data protection officer, as it is not required to do so.

What data we process and why

• Beta access application: name, email, phone number, NIF (optional, so that we can check that you are self-employed), town and province, the type and a description of your business activity, how many years you have been self-employed, how you heard about us, how you currently run your business and, where applicable, where your visit came from (UTM campaign parameters). Purpose: to assess and select applications to join the private beta, manage your access and keep you informed about the launch.
• Contact form: name, email, phone number and message, so that we can reply to your enquiry.
• Browsing and analytics: if you accept analytics cookies, we use Google Tag Manager and Google Analytics 4 to obtain aggregated statistics on how the site is used. No measurement tool is activated until you accept it in the banner; the details are set out in the cookies policy.
• Advertising and remarketing: if you accept advertising cookies, we use Google Ads and Meta Pixel to measure our campaigns and show you autonomia360 ads on Google, Facebook and Instagram based on your visit to this site. Nothing is activated until you accept it in the banner, and we do not use it to make automated decisions with legal effects.
• Platform users: account and tax profile data, billing and subscription details, support and operational communications, in order to provide the service you have contracted and to comply with the Company's legal obligations, in particular its tax and accounting obligations.

Automatic reading of receipts (OCR with AI)

If you upload images or PDFs of receipts and invoices to have them read automatically, we process them using a Google Cloud artificial intelligence service (Vertex AI, European Union region) acting as a sub-processor, solely in order to extract the tax data they contain. You always review and confirm the result: no decision is taken solely by automated means (Article 22 of the GDPR, Regulation (EU) 2016/679), and your documents are not used to train artificial intelligence models.

Service usage data

To know whether the application is actually used and to improve it, we record per user and day the minutes of use with the tab open, the time of the last access and the number of documents created (invoices, expenses, quotes, contacts, files, tax forms and tickets). We do not record the content of what you do or the screens you visit. This information is only accessible to autonomia360 administrator staff, protected by two-factor authentication, and is used in aggregate per company. Per-person data is kept for 24 months; company aggregates do not identify anyone. You may object to this processing by writing to protecciondatos@autonomia360.es.

Third-party data you enter into the platform

When you enter personal data about your clients, suppliers or employees into the platform, you process it as the data controller and the Company acts as data processor under the Data Processing Agreement (Article 28 GDPR) that is accepted together with the terms and conditions of the service. This policy covers only the processing for which the Company is the controller.

Legal basis

• Beta access application and contact form: your consent and the steps taken prior to entering into a contract (Articles 6(1)(a) and 6(1)(b) GDPR).
• Analytics: your consent, given in the cookie banner; you can withdraw it at any time from the "Cookie settings" link in the page footer.
• Advertising and remarketing: your consent, given in the cookie banner and revocable at any time from "Cookie settings".
• Use of the platform: performance of the contract (Article 6(1)(b) GDPR) and compliance with legal obligations, in particular tax and accounting obligations (Article 6(1)(c) GDPR).
• Service usage data: the Company's legitimate interest in measuring and improving the use of the contracted service (Article 6(1)(f) GDPR), balanced by minimal data collection, aggregation per company and limited retention; you may object at any time.

When you tick a consent box or accept a set of terms, we keep a record of the date, the time and the IP address as proof of your acceptance. Withdrawing your consent does not affect the lawfulness of any processing carried out before you withdrew it.

Retention periods

Advertising identifiers expire after 90 days (Meta, Google Ads) or 13 months (doubleclick.net), or earlier if you withdraw consent.

• Beta access applications and contact enquiries: while we are assessing the application and, at most, for 12 months after a decision is reached or the programme closes.
• Account, billing and service usage data: while the account is active and, once it is closed, blocked for the applicable statutory limitation periods (at least 4 years for tax purposes and up to 6 years under the Spanish Commercial Code).
• Consent and acceptance records: for as long as liability may arise from the relationship.
• Per-person service usage data (minutes of use and last access): 24 months; company aggregates are kept without identifying anyone.

Recipients and data processors

We do not disclose your data to third parties unless we are legally required to do so. To provide the service we use suppliers that act as processors or sub-processors: Google Cloud EMEA Ltd. (infrastructure, database and storage, europe-west1 region, European Union), Google (Vertex AI to read receipts, within the European Union, and Google Analytics for web analytics) and email delivery providers.

International transfers If you accept advertising cookies, Google Ireland Ltd. (Google Ads) and Meta Platforms Ireland Ltd. (Meta Pixel) receive browsing identifiers, with the transfers described in the cookie policy.

The service is provided and the data is hosted in the European Union. For web analytics, Google may process certain data in the United States; that transfer relies on the EU-US Data Privacy Framework and, where applicable, on standard contractual clauses.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to hola@autonomia360.es or, if you are a registered user, from the Legal section of your account. You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Changes to this policy

We will publish any change to this policy on this page, together with its version number and effective date. If you are a registered user and the change is significant, we will notify you.