Privacy notice

Last updated: 27 September 2026.

Controller

Hendeka Orchestra, S.L. (Sociedad Unipersonal), NIF B93853315, registered office at Calle Domingo J. Navarro 1, 2º, 35002 Las Palmas de Gran Canaria, Spain. The company is registered under sheet GC-00066946 of the Registro Mercantil de Las Palmas, entry 1 of 10 September 2026. For any question about personal data write to info@aralda.com. The company has not appointed a data protection officer because the conditions of Article 37 GDPR are not met; the mailbox above is the privacy contact.

The data we process and the legal basis for each purpose

In this notice "Aralda" means the service operated by Hendeka Orchestra, S.L.; "Aralda assistant" means the artificial intelligence feature built into the service.

Account and business profile (email, encrypted password, country, VAT number or your name if you register as an individual). Needed to provide the service you asked for. Legal basis: performance of the contract, Article 6(1)(b).

Optional tax details. Your VAT number is optional at registration and you can add it later from your profile; if you provide it we use it to build your business profile and to issue the invoice in your name. Your personal tax identification number is optional and can only be entered at registration; if you provide it, it is kept with your account and is currently not used. Legal basis: performance of the contract, Article 6(1)(b), for the profile and the invoice; legal obligation, Article 6(1)(c), for the invoice details after the purchase (Royal Decree 1619/2012, Article 6).

Sign-in with Google. If you choose to sign in with Google we receive from Google Ireland Limited your email address, your name, an account identifier and your profile picture. We use the identifier to recognise you at later sign-ins; the picture is not kept. We do not receive your Google password and we do not send Google any data from your Aralda account. This processing is separate from the advertising measurement described further below. Legal basis: performance of the contract, Article 6(1)(b).

Business profile derived from your VAT number through the European Commission's VIES system and public registers. Legal basis: Article 6(1)(b). The VAT number of a sole trader is personal data and receives the same protection.

The searches and sentinels you save in your account, and the documents you keep there. Legal basis: Article 6(1)(b).

Aralda assistant suggestions. The Aralda assistant is an artificial intelligence system, not a person: it processes your searches and business profile to propose relevant opportunities. We take no automated decisions with legal effects on you (Art. 22 GDPR). Legal basis: performance of the contract, Article 6(1)(b).

“Call me” calls. If you ask us to call you, we process the number you provide, the date and status of the call, the text transcript, the actions you ask us to perform in your Aralda workspace, and the notes needed to continue the work during later calls. We use this data to make the requested call, update your account notes, apply the service allowances, and prepare an accurate summary. The legal basis is performance of the requested service under Article 6(1)(b) GDPR. The call is handled by the Aralda assistant, an artificial intelligence system. We do not retain an audio recording as part of the customer record.

Call feedback. If you choose to leave a rating or note, we link it to the call to fix problems and improve the service. The note is optional, and we do not ask for third-party data. The legal basis is our legitimate interest in checking and improving the service under Article 6(1)(f) GDPR. You may object by writing to info@aralda.com.

Email notifications about opportunities. Legal basis: consent, Article 6(1)(a), which you can withdraw from any message.

Payments and invoicing through Stripe Payments Europe Ltd and Billin. We never receive your full card number. Legal basis: performance of the contract and accounting and tax obligations, Articles 6(1)(b) and 6(1)(c).

Technical data of requests to our server (IP address, date and time, page requested, browser type). Legal basis: our legitimate interest in the security of the service, Article 6(1)(f).

Content of the emails you send us. Legal basis: our legitimate interest in replying, Article 6(1)(f).

Advertising measurement with Google Ads, only if you accept it in the banner. Legal basis: consent, Article 6(1)(a). Details are in the Cookie policy.

How long we keep data

We keep the account while it is active and for 24 months of inactivity. We keep invoices and accounting records for 6 years as required by the Spanish Commercial Code, technical logs for up to 90 days, notification data until withdrawal, and purchased Reports in the account for 24 months. We keep call transcripts and feedback for 12 months from the call. Account notes remain for the life of the account and for up to 24 months after it is closed. If you request earlier erasure, we delete the data except where retention is required by law or needed to establish, exercise, or defend legal claims.

Who receives the data

To provide the service, we use OVH SAS for hosting in France, Stripe Payments Europe Ltd for payments in Ireland, Billin for invoicing in Spain, Register.it S.p.A. for email in Italy, Google Ireland Limited for advertising measurement in Ireland only with your consent, and the artificial intelligence providers Anthropic PBC and OpenAI for the Aralda assistant's suggestions, Reports, and conversations. The European Commission's VIES system receives the VAT number for verification.

We use Telnyx for telephony and transcription. Under its DPA v2.2, Telnyx processes communications content as a processor when providing the service under our instructions. Telnyx also acts as an independent controller when it uses that data to improve and enhance its services and for account and communications data processed in its role as communications service provider. Those independent processing activities are governed by Telnyx's privacy notice and terms. We do not share data with third parties for marketing.

Transfers outside the European Union

Data is hosted in the European Union. The artificial intelligence providers Anthropic PBC and OpenAI process data in the United States on the basis of their certification under the EU–US Data Privacy Framework; for Google, advertising measurement relies on its Data Privacy Framework certification and on the standard contractual clauses, as described in the Cookie policy. Telnyx also processes data in the United States. For transfers governed by the Telnyx DPA to countries without an adequacy decision, the European Commission's Standard Contractual Clauses incorporated into the DPA apply.

Your rights

You can ask us at any time for access to the data concerning you, their rectification or erasure, the restriction of processing and the portability of the data you have provided to us. You can object to processing based on our legitimate interest, and we stop it unless there are overriding legitimate grounds. You can withdraw at any time your consent to notifications and to advertising measurement, without affecting the processing already carried out. To exercise these rights, write to info@aralda.com from the address of your account, or attach an identity document if you write from another address. We reply within one month, extendable by two months in complex cases, and in that case we notify you within the first month. Providing e-mail and password is necessary to open the account, and billing data are necessary to execute an order and for tax obligations. The other data are optional. You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), Calle Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the authority of the Union country where you live or work. The list of authorities is published by the European Data Protection Board at www.edpb.europa.eu.

Data contained in public notices

Aralda indexes notices published by public administrations. Those documents may contain names of officials or contact persons. We do not extract them into our index and we always link to the original source.