Privacy Policy

1. Who this applies to, and Eskadia's two roles

This policy explains how Eskadia processes the data for which it is the controller: data about its customers' accounts and about the people who use the Platform on the web or through the mobile application, about visitors to its websites and about those who write to it.

Eskadia also processes the data each customer organisation uploads to the Platform —its contacts, its employees, its clients. For that data the controller is the customer organisation and Eskadia acts as processor, on its behalf and following its instructions (see §8). To exercise rights over that data you must address the organisation; if you write to us, we will pass your request on.

2. Controller

3. What data we process, why, and on what basis

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR).

If you do not give us the account data, we cannot give you access. Everything else is optional or depends on the features you enable.

4. Connected Google and Microsoft accounts

No data from a Google or Microsoft account is processed unless you expressly connect that account from the Platform. You can disconnect it at any time from the Platform or from your Google or Microsoft account security settings.

Storage. Your calendar events are not stored in the Platform: they are read from your calendar each time they are shown. Meetings you schedule from the Platform are created in your calendar and are also kept as a task in the CRM, with the details you enter. Credentials are stored encrypted. On disconnection, access is revoked and the connection is deleted.

Limited Use. Eskadia's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Eskadia: (a) uses that data only to provide the features you enable and see; (b) does not transfer it to third parties except to provide them, by legal obligation, to investigate a security incident or with your consent; (c) does not use it for advertising or commercial profiling; (d) does not use it to develop, train or improve artificial intelligence models, its own or third parties'; (e) does not allow any human to read it except with your consent, for a security need or under a legal obligation. The same applies to Microsoft data.

5. WhatsApp, Facebook and Instagram

No Meta data is processed unless the organisation connects its own accounts, with credentials from its own Business Manager. It can disconnect them at any time.

The content of conversations belongs to the customer organisation (the controller); Eskadia processes it as processor. Connection data (credentials, identifiers, technical logs) is processed by Eskadia as controller in order to operate the service. Use of information from Meta APIs adheres to the Meta Platform Terms: Eskadia does not sell it, does not use it for advertising, targeting or decisions about eligibility, credit, insurance or employment, does not use it to train artificial intelligence (incoming messages are stored directly, without passing through any AI), does not send bulk communications through this channel and does not allow anyone to read it other than the organisation's staff or, where strictly necessary for support or security, Eskadia's staff with minimal and logged access.

6. Artificial intelligence

The Platform offers AI features: an assistant (copilot) inside the CRM, a web chat that organisations place on their sites, document reading (invoices, expenses), agents that make financial and commercial suggestions, drafts of emails and quotes, and indicative opportunity scoring. The detail is in Use of artificial intelligence. In essence:

• You will always know it is an AI. The web chat introduces itself as an AI assistant and lets you ask for a person; anything generated with AI is labelled as such.
• What data is sent. Only what the feature needs: your instruction and the related CRM data. It is sent over an encrypted connection to the model provider.
• To whom. If your organisation configures its own provider, to that provider, which is a sub-processor of your organisation. If not, to the provider Eskadia contracts: OpenAI Ireland Limited, as a sub-processor of Eskadia (see §8).
• Text recognition. In organisations that subscribe to text recognition (OCR), photos of transport manifests —which may include the driver's name and identity document and the vehicle's registration— are sent to Google Cloud EMEA Limited (Google Cloud Vision) to extract their text, with processing in the European Union. It starts on 7 October 2026 and Google acts as a sub-processor of Eskadia (see §8).
• No training. Neither Eskadia nor its providers use your data to train models: they are contracted under API terms with that exclusion.
• Human oversight. Output is indicative; no AI feature takes decisions about people or sends anything without a person confirming it.
• Your rights (§11) apply equally to data processed with AI.

7. If you use Eskadia because your company signed up for it

If you access the employee portal or the application because your employer signed up for Eskadia, the controller of your employment data is your employer: clock-ins and, where required, the location at the moment of clocking in or of a trip event; payroll; holidays and absences, including the certificates you attach; trips, expenses and their receipts; shifts; objectives and appraisals. Eskadia processes them on their behalf. Location is only taken when you clock in or record an event, never continuously or in the background, and the first time you are informed and your consent or awareness is recorded, according to the law of your country.

To exercise your rights over that data, address your employer (usually Human Resources). Eskadia will help them respond to you.

8. Who we share data with

We do not sell personal data and we do not share it for advertising purposes. Only the recipients listed below have access to it, and only as necessary.

a) Providers that process data on Eskadia's behalf (processors and sub-processors), under contract with the safeguards of art. 28 GDPR:

b) Services you connect yourself (Google, Microsoft, Meta, your own AI provider): they act according to your relationship with them; see §4, §5 and §6.

c) Your organisation: your organisation's administrators see the data the Platform shows them according to their role.

d) Authorities and courts, where a law requires it, and advisers bound by professional secrecy where necessary to defend our rights.

e) In a corporate transaction (merger, acquisition), the acquirer, with the same safeguards and after notifying you.

Any addition to or removal from list a) is notified to customers thirty (30) days in advance (Data Processing Agreement §7) and reflected here.

9. Mobile application

The application processes the same data as the web and, in addition, only with your permission and at the moment of use:

The application does not use location in the background, does not access your contacts, microphone, health data or advertising identifier, contains no advertising or third-party analytics tools and does not track you across applications. It stores the session in the system's encrypted store and, if you clock in without coverage, keeps the clock-in on the device until it can be sent. Permissions are revoked from the device settings.

10. International transfers

Some providers process data outside the European Economic Area (mainly in the United States). Transfers rely on the EU-US adequacy decision (Data Privacy Framework) where the provider is certified, and in any event on the European Commission's standard contractual clauses (Decision 2021/914) incorporated in their processing agreements, with supplementary measures (encryption in transit and at rest, access control). You may request a copy of the safeguards at privacy@eskadia.com.

For people in other countries, the transfer also relies on the rules of their law: in Colombia, on the transmission contract with the processor and, where applicable, on the data subject's authorisation (Act 1581 of 2012, art. 26; Decree 1074 of 2015); in Mexico, on the LFPDPPP regime for remittances to processors, which does not require consent; in Brazil, on the ANPD's contractual clauses; in the United Kingdom, on the UK addendum to the standard clauses.

11. Your rights

At any time and at no cost, you may:

• access your data and obtain a copy;
• rectify it if it is inaccurate;
• erase it (see §13);
• object to its processing or request its restriction;
• port it in a structured format;
• withdraw your consent where that is the basis, without affecting processing already carried out;
• not be subject to automated decisions with legal or similarly significant effects.

How: by writing to privacy@eskadia.com from your account's email address, or by post to the address in §2, stating what you are requesting. We may ask you to verify your identity. We reply within one month (extendable by two more if complex, with notice); in Colombia, within the periods in the Colombia annex; in Mexico, within those in the Mexico annex; in the United States, within 45 days.

Complaints: if you believe we have not handled your rights properly, you may complain to the data protection authority of your country. In Spain, the Spanish Data Protection Agency (aepd.es). Other authorities are listed in §12.

If your data is processed by Eskadia on behalf of an organisation (§1 and §7), exercise your rights with that organisation; if requests reach us, we pass them on.

12. Depending on the country you are in

• European Union / EEA: GDPR and, in Spain, LOPDGDD. Authority: the one in your country (in Spain, the AEPD).
• United Kingdom: UK GDPR and the Data Protection Act 2018. Authority: Information Commissioner's Office (ico.org.uk).
• Colombia: Act 1581 of 2012 and Decree 1074 of 2015. See the Colombia annex (information processing policy). Authority: Superintendence of Industry and Commerce (sic.gov.co).
• Mexico: Federal Act on the Protection of Personal Data Held by Private Parties (2025). See the Mexico annex (comprehensive privacy notice).
• United States: see the United States annex (notice for residents, including California's CCPA/CPRA).
• Brazil: Lei Geral de Proteção de Dados (Act 13.709/2018). You have the rights in art. 18 (confirmation, access, correction, anonymisation, portability, deletion, information about whom we share with, withdrawal of consent). Authority: Autoridade Nacional de Proteção de Dados (gov.br/anpd).
• Argentina: Act 25.326. Authority: Agency for Access to Public Information (AAIP), the supervisory body under the act, which handles complaints and claims.
• Chile: Act 19.628 and, once in force, Act 21.719. Authority: Personal Data Protection Agency, once constituted.
• Peru: Act 29733 and its regulation. Authority: National Authority for the Protection of Personal Data (Ministry of Justice and Human Rights).
• Ecuador: Organic Act on the Protection of Personal Data. Authority: Superintendence for the Protection of Personal Data.
• Other countries: we grant you at least the rights in §11 and those your local law gives you.

13. How long we keep data, and how to ask us to delete it

Deleting your account. You request it at app.eskadia.com/account-deletion (also from the application: My account → Delete my account), without needing to sign in. The process is explained there. If your account is managed by an organisation, closure is coordinated with them, because part of the data (clock-ins, payroll) must be kept by your employer by law.

14. Security

Isolation between organisations at database level, role-based access control, two-factor authentication, encryption in transit and at rest, audit logging, consent evidence written only by the server, automatic blocking of terminated employees and daily automated checks. If a security breach occurs that presents a high risk to you, we will notify you without undue delay.

15. Minors

The Platform is not directed at people under 18 and we do not knowingly collect their data as controller. If you believe we hold a minor's data, write to us and we will delete it.

16. Changes

If we change this policy substantially, we will notify you at least fifteen (15) days in advance and, where appropriate, ask you to accept it again on entering through the web or the application. Each version is recorded with its date. It is published in Spanish and English; in the event of discrepancy, the Spanish version prevails.

Mexico annex — Comprehensive privacy notice

In accordance with the Federal Act on the Protection of Personal Data Held by Private Parties (Official Gazette, 20 March 2025).

1. Identity and address of the controller. ESKADIA SOLUTIONS, S.L., C/ Los Martínez de Escobar, 37, 1º B — 35007 Las Palmas de Gran Canaria (España). Contact: privacy@eskadia.com.
2. Personal data we process. Identification and contact (name, email, profile picture), access and security (IP, logs), device (notification identifier) and billing. We do not process sensitive personal data as controller. Employee location is processed by the Platform on behalf of the employer, who is its controller.
3. Primary purposes (necessary for the service): create and administer your account; give you access according to your role; provide the Platform's features, including AI ones; send you service alerts; security and fraud prevention; billing; handle your requests.
4. Secondary purposes: none. We do not use your data for marketing, advertising or commercial prospecting.
5. Transfers. We do not transfer your data to third parties that use it for their own purposes. We communicate it to the providers in §8 of the Policy as remittances to processors, which do not require your consent. We could transfer it to authorities where the law requires it.
6. ARCO rights and withdrawal. You may access, rectify, cancel or object to the processing of your data, and withdraw your consent, by writing to privacy@eskadia.com with: your name and email so we can reply; a copy of an identity document (or proof of representation); a clear description of the data and of the right you are exercising; and any document that helps locate it. We will reply within a maximum of 20 business days and, where appropriate, give effect to it within the following 15 business days.
7. Limiting use or disclosure. In addition to the above, you may ask at privacy@eskadia.com that we limit the use of your data.
8. Cookies and similar technologies. Only technical ones on the Platform; see Legal notice §6.
9. Changes to this notice. They will be published at app.eskadia.com/privacy#mexico and, where substantial, we will notify you on entry.
10. Authority. If you consider your right has been infringed, you may turn to the competent authority under the LFPDPPP (Ministry of Anti-Corruption and Good Governance).

Colombia annex — Information processing policy

In accordance with Act 1581 of 2012 and Decree 1074 of 2015 (Chapter 25).

1. Controller. ESKADIA SOLUTIONS, S.L., tax ID B26857110, C/ Los Martínez de Escobar, 37, 1º B — 35007 Las Palmas de Gran Canaria (España). Email: privacy@eskadia.com. Eskadia has no establishment in Colombia.
2. Processing and purposes. Those described in §3 to §9 of the Policy. Where Eskadia processes data on behalf of a Colombian company (for example, about its employees), it acts as processor and the controller is that company, which must hold the data subjects' authorisation and have its own policy.
3. Data subject rights (art. 8 Act 1581). To know, update and rectify your data; to request evidence of the authorisation; to be informed of the use made of it; to lodge complaints with the Superintendence of Industry and Commerce; to withdraw the authorisation and request deletion where the principles, rights and safeguards are not respected; and to access your data free of charge.
4. Area responsible for queries and claims. The internal privacy lead, at privacy@eskadia.com.
5. Procedure. Set out below.
6. Minors' data. Not processed as controller.
7. International transfers and transmissions. Data is hosted in the United States and transmitted to the processors in §8 of the Policy, under transmission contracts obliging them to process it only on Eskadia's behalf and with security measures. Where applicable, the transfer relies on your express authorisation.
8. Effective date. From 1 October 2026. Databases are kept for the periods in §13 of the Policy.

• Queries: handled within a maximum of ten (10) business days from receipt, extendable by five (5) more with notice of the reason.
• Claims (correction, update, deletion or infringement): must include your identification, a description of the facts, your address and the documents you wish to provide. If information is missing, we will request it within the following five (5) days; if you do not provide it within two (2) months, the claim is deemed withdrawn. They are handled within a maximum of fifteen (15) business days, extendable by eight (8) more with notice of the reason. While they are being processed, the data is marked “claim in progress”.
• You may only turn to the SIC after exhausting this procedure.

United States annex — Notice for US residents

Includes the Notice at Collection and the policy required by the California Consumer Privacy Act, as amended by the CPRA, and the rights under the laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with equivalent privacy laws.

1. Categories of personal information we collect (last 12 months), source, purpose, recipients and retention:

2. Sale and sharing. Eskadia does not sell or share personal information, has not done so in the last 12 months, and does not do so with the information of minors under 16. It does not engage in cross-context behavioural advertising.

3. Sensitive information. We use precise geolocation only for the purposes permitted by section 7027(m) of the CCPA regulations (providing the requested service), so the right to limit its use does not apply.

4. Your rights. To know what data we hold and how we use it; to access it and obtain a copy; to correct it; to delete it; to opt out of its sale or sharing (we do neither), of targeted advertising and of profiling with significant effects; and not to suffer discrimination for exercising them.

5. How to exercise them (two routes): (1) by writing to privacy@eskadia.com; (2) from app.eskadia.com/account-deletion for deletion. We will verify your identity using your account email. You may act through an authorised agent with your signed permission. We will reply within 45 days (extendable by 45 more with notice). If we deny your request, you may appeal by replying to our response; we will resolve within 60 days and, if the appeal is denied, you may turn to your state's Attorney General.

6. Opt-out signals. As we neither sell nor share, there is nothing to opt out of; even so, we honour Global Privacy Control.

7. If your data is processed by your employer or an Eskadia customer, Eskadia acts as their service provider or processor; direct your request to them.