Privacy Policy

1. Data Controller

In compliance with Regulation (EU) 2016/679 (GDPR) and applicable national data protection legislation, we inform you that the data controller is:

• Legal name: VRTC CONSULTORÍA SL
• Company ID (CIF): B24946683
• Registered address: Calle Juan Manuel de la Morena 2, 03205 Elche, Alicante, Spain
• Netherlands contact: Adam Moreno — adam@getagentik.co
• General contact: hola@getagentik.co

2. Data We Collect

Through our website and simulator we may collect:

• First name and surname
• Clinic or company name
• Professional email address and phone number
• Professional activity information (speciality, patient volume, monthly treatment quotes)
• Navigation data via technical cookies

We do not collect special category data (health data, financial data) about your patients. Agentik is a commercial communication tool, not a medical records system.

3. Purpose of Processing

• Service provision: managing the commercial relationship and providing the contracted service.
• Commercial communications: sending information about our services, with your prior consent.
• Service improvement: analysing simulator and website usage.
• Legal compliance: responding to requests from competent authorities.

4. Legal Basis for Processing

• Contract performance: where processing is necessary to provide the service (Art. 6(1)(b) GDPR).
• Legitimate interest: for commercial follow-up of leads who have shown active interest (Art. 6(1)(f) GDPR).
• Consent: for sending commercial communications (Art. 6(1)(a) GDPR).
• Legal obligation: where required by applicable law (Art. 6(1)(c) GDPR).

5. Retention Period

Your data will be retained for as long as necessary to fulfil the purpose for which it was collected and to address any potential liabilities. For commercial communications, until you withdraw your consent. For active service contracts, for the duration of the contract plus 5 years as required by Spanish commercial law.

6. Recipients and Data Transfers

Your data will not be sold or transferred to third parties except as required by law. We may share it with technology service providers acting as data processors under contract, all with appropriate safeguards under the GDPR:

• Brevo (Sendinblue) — email communications — servers in the EU
• Netlify — website hosting — servers in the EU/US under SCCs
• Notion — CRM database — servers in the US under SCCs
• Anthropic — AI response generation — US, under SCCs
• ElevenLabs — voice synthesis — US, under SCCs
• Meta Platforms — advertising analytics via Meta Pixel — US, under SCCs

Where data is transferred outside the EU/EEA, we ensure adequate protection through Standard Contractual Clauses (SCCs) as approved by the European Commission.

7. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Access: obtain confirmation of whether we process your data and a copy of it.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data under certain circumstances.
• Restriction: request that we limit the processing of your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: at any time, where processing is based on consent.

To exercise any of these rights, contact us at hola@getagentik.co or adam@getagentik.co. We will respond within 30 days.

If you are based in the Netherlands, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (AP) at autoriteitpersoonsgegevens.nl. You may also lodge a complaint with the Spanish data protection authority at aepd.es.

8. Data Processing Agreement (Verwerkersovereenkomst)

Where Agentik processes personal data on your behalf as part of the contracted service (e.g. managing your clinic's leads and email contacts), we act as a data processor under Art. 28 GDPR. We are happy to sign a Data Processing Agreement (DPA / Verwerkersovereenkomst) on request. Please contact adam@getagentik.co to request a DPA.

9. Security

We have implemented appropriate technical and organisational measures to ensure the security of your personal data and to prevent its alteration, loss or unauthorised access. These include encrypted data transmission (HTTPS/TLS), access control to databases, and regular security reviews.

10. Cookies and Advertising Tracking

Our website uses the Meta Pixel to measure the effectiveness of our advertising campaigns and optimise ad delivery. This technology collects anonymised browsing data (page visits, simulator interactions) and shares it with Meta Platforms Inc. under Standard Contractual Clauses. No personal clinical data is collected. You can opt out of Meta's advertising data use at facebook.com/settings.

11. Automated Decision-Making

Our AI agents may classify your clinic leads as HOT, WARM or COLD based on automated analysis of publicly available information. This classification is used solely for prioritising commercial follow-up and does not produce any legal effects on individuals. You may request human review of any automated classification at any time.

12. Modifications

We reserve the right to update this policy to reflect changes in legislation or our services. We will notify you of any significant changes by email or by posting a notice on our website at least 14 days in advance.