Privacy Policy

1. Data controller

• Legal name: VRTC CONSULTORÍA SL (brands Agentik, AuditReady and HUECO)
• Company ID (CIF): B24946683
• Registered address: Calle Juan Manuel de la Morena 2, 03205 Elche, Alicante, Spain
• General contact and rights requests: hola@getagentik.co
• Netherlands contact: Adam Moreno — adam@getagentik.co

2. Who this policy applies to

• Website visitors across getagentik.co and all its pages.
• Prospects who submit a form, use the calculator or the diagnosis tool, download the audit checklist or talk to the voice demo.
• Clients of the sector automation services and of the AuditReady and HUECO subscriptions.
• Third parties whose data our clients process inside our systems — for example a clinic's commercial contacts, or the operators who log controls in AuditReady. For these, we act as a data processor, not as controller (see section 9).

3. What we collect and where from

3.1 Website, forms and diagnostic tools

• First name and surname, company (clinic, hotel, plant, agency or certification body) and role.
• Business email address and phone number.
• Context you provide voluntarily: industry, team size, volume of quotes, enquiries or audits, number of rooms, location, main season, hours spent on manual tasks and cost per hour.
• The results calculated by the calculator and the diagnosis tool (estimated cost, recoverable hours, automatable tasks), linked to your email when you provide it.
• Campaign parameters from the URL (utm_source, utm_medium, utm_campaign, utm_content, utm_term, fbclid) when you arrive from an ad.
• Navigation data via technical cookies and, only with your consent, measurement cookies.

3.2 Voice demo

The voice demo opens a real-time conversation with a conversational agent. During the call your voice audio and its transcription are processed so the agent can reply. Voice synthesis and recognition are provided by ElevenLabs and the language model by Anthropic. We do not link that conversation to your identity unless you provide contact details during it. You can end the call at any time by pressing "Hang up".

3.3 AuditReady and AuditReady Sanidad

• Account data: name, email, company, role and access credentials.
• Food safety and quality documentation uploaded by the client: HACCP plans, cleaning plans, pest control contracts, laboratory analyses, technical sheets, supplier certificates, plant records, batches and traceability.
• Operational records entered by the client's staff, including those submitted through Telegram (temperatures, pH, chlorine, cleaning, incidents with photographs).
• Identifying data of the client's employees appearing in that documentation, such as signatures or attendance lists for food handler training. That data belongs to the client; we process it on their behalf.

3.4 HUECO

• Account and subscription data.
• Warehouse data: locations, references, pallets and movements. This is business data and, save for exceptions, contains no personal data.

3.5 What we do not collect

We do not collect special category data under Article 9 GDPR about our clients' patients or end customers. Agentik is a commercial communication, documentary and operational layer: it is not a medical records system and stores no diagnoses, treatments or patient health data.

4. Purposes and legal bases

• Handling your request and providing the contracted service — contract performance or pre-contractual steps (Art. 6(1)(b) GDPR).
• Sending you the checklist, the calculator breakdown or the diagnosis report you asked for — consent (Art. 6(1)(a)).
• Commercial follow-up of prospects who have shown active interest — legitimate interest (Art. 6(1)(f)), with a right to object at any time.
• Marketing communications about our services — consent (Art. 6(1)(a)), revocable with one click in every email.
• Advertising measurement through Meta Pixel and Google Ads — consent via the cookie notice (Art. 6(1)(a)).
• Service improvement and security, aggregate usage analysis and fraud prevention — legitimate interest (Art. 6(1)(f)).
• Legal compliance with accounting and tax obligations and responses to competent authorities (Art. 6(1)(c)).

5. Retention periods

• Prospects without a contract: up to 24 months from the last contact, or until you object or withdraw consent.
• Clients under contract: for the term of the contract plus 5 years, as required by Spanish commercial law.
• Invoicing: the statutory tax retention periods.
• AuditReady and HUECO data: while the subscription is active. After cancellation it is kept for 90 days to allow recovery and export, then deleted.
• Voice demo audio: not retained by us once the call ends.

6. Recipients and processors

Your data is never sold or transferred to third parties for their own purposes. We share it only with providers acting as processors under an Art. 28 GDPR contract:

Where data is transferred outside the EU/EEA we ensure adequate protection through Standard Contractual Clauses approved by the European Commission. You can request a copy of the applicable safeguards at hola@getagentik.co.

7. Cookies and measurement

The website uses technical cookies necessary for it to work and, only if you accept in the cookie notice, advertising measurement technologies from Meta and Google. If you decline, those technologies are not loaded. HUECO uses Plausible Analytics, which sets no cookies and collects no identifiable personal data. You can withdraw consent at any time by clearing site data in your browser.

8. Automated decisions and use of AI

Our agents classify commercial contacts (for example as HOT, WARM or COLD) and AuditReady classifies documentation against regulatory requirements and proposes scores or non-conformities. These outputs are used to prioritise and assist, never to decide automatically about a person, and produce no legal effects nor similarly significant effects on you. Every relevant proposal goes through human validation. You may request human review of any classification at any time.

AuditReady is not legal advice and does not guarantee regulatory compliance: the certification decision always rests with the accredited body and food safety responsibility with the food business operator.

9. When we act as a processor

For the data our clients enter or manage through our systems — commercial contacts, employees signing records, quality documentation — the client is the controller and we are the processor under Art. 28 GDPR. We process that data only on their instructions, with staff bound by confidentiality and the security measures in section 11. We sign a Data Processing Agreement (Verwerkersovereenkomst) on request: contact hola@getagentik.co or adam@getagentik.co.

10. Your rights

• Access: confirm whether we process your data and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion where applicable.
• Restriction: ask us to limit processing.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest, including direct marketing.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

Write to hola@getagentik.co or adam@getagentik.co. We respond within 30 days. If the data was provided by one of our clients and we act only as processor, we will redirect you to the relevant controller.

You may lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) if you are based in the Netherlands, or with the Spanish AEPD (aepd.es).

11. Security

We apply appropriate technical and organisational measures: encryption in transit (HTTPS/TLS), role-based access control, logical isolation of each client company's data, credential management with rotatable secrets, backups and periodic reviews. In the event of a personal data breach posing a risk to your rights, we will notify you and the supervisory authority within the periods set out in Arts. 33 and 34 GDPR.

12. Minors

Our services are aimed exclusively at businesses and professionals. They are not directed at anyone under 18 and we do not knowingly collect data from minors.

13. Changes

We may update this policy to reflect changes in legislation or in our services. Significant changes will be notified by email or by a notice on the website at least 14 days in advance.