1. Joint data controllers (GDPR Art. 26)

In accordance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), personal data processed on this website is jointly managed by two data controllers:

• Neuro in Business, SL
• Neuroscience and Innovation at Work, SL

Registered address: Carrer Creu Guixera 49 1-1, 08243 Manresa (Barcelona), Spain.

Data protection contact: privacy@whomby.com.

Pursuant to GDPR Article 26, the joint controllers have established an internal arrangement determining their respective compliance responsibilities. You can use the privacy email address above as a single point of contact to exercise any of your data protection rights.

2. What we process, why, and on what legal basis

We only process personal data in the following situations:

• When you email us: We process your name, your email address and anything you choose to include, to answer you and, if you ask for one, to prepare a proposal. Legal basis: steps taken at your request before a possible contract (Art. 6.1.b GDPR) or our legitimate interest in replying to the messages we receive (Art. 6.1.f GDPR).
• Google Analytics, only if you accept it: If you accept analytics cookies, Google Analytics 4 records which pages you visit, the type of device and browser you use and your approximate location, linked to a pseudonymous identifier stored in a cookie. It is never loaded before you accept. Legal basis: your consent (Art. 6.1.a GDPR), which you can withdraw at any time through “Cookie settings” at the bottom of every page.
• Cookieless visit statistics: Cloudflare Web Analytics counts page views without cookies and without storing any identifier that could single you out. Legal basis: our legitimate interest in understanding, in aggregate, how the website is used (Art. 6.1.f GDPR).
• Delivering and protecting the website: To serve each page, our hosting provider necessarily processes your IP address and the technical details of your request, and uses them to protect the website against abuse and attacks. Legal basis: our legitimate interest in running a secure website (Art. 6.1.f GDPR).

We do not sell personal data, and we do not use it for profiling or automated decision-making.

3. Data processors

We rely on the following providers, which process data on our behalf under data processing agreements (DPAs):

• Cloudflare, Inc.: Hosting, content delivery, security and cookieless visit statistics.
• Google Ireland Limited: Google Workspace, which receives and stores the emails you send us, and Google Analytics 4, only for visitors who accept analytics cookies.

4. International data transfers

Cloudflare and Google are headquartered in the United States, so some data may be processed outside the European Economic Area (EEA). These transfers are safeguarded by the EU-U.S. Data Privacy Framework (DPF), to which both companies adhere, and/or by the European Commission’s Standard Contractual Clauses (SCCs).

5. How long we keep data

• Emails: For as long as needed to handle your enquiry and any business relationship that follows from it, and afterwards only for as long as the law requires.
• Google Analytics: Event-level data is kept for 2 months, after which Google deletes it automatically. Only aggregated reports remain.
• Cloudflare: Visit statistics are kept only in aggregate. Technical request data is kept only for the short time needed to deliver and protect the website.
• Your cookie choice: Stored in your own browser until you change it or clear your browser data. The Cookie Policy has the details.

Cookie Policy →

6. Your rights under the GDPR (Articles 15–22)

Under European data protection law, you have the following rights:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate or incomplete data.
• Right to erasure (Art. 17): Ask us to delete your personal data (“right to be forgotten”).
• Right to restriction of processing (Art. 18): Limit how we process your data under certain conditions.
• Right to data portability (Art. 20): Receive the data you provided to us in a structured, commonly used format.
• Right to object (Art. 21): Object to processing based on our legitimate interests.
• Right to withdraw consent (Art. 7.3): Withdraw your consent to analytics at any time through “Cookie settings”, without affecting the processing carried out before.

To exercise any of these rights, email privacy@whomby.com. Requests are handled free of charge within 30 days.

7. Right to lodge a complaint

If you believe your data protection rights have not been respected, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es, or with the data protection authority of the EU member state where you live.

8. Changes to this policy

If the way we handle personal data changes, we will update this page. The date at the top always shows the current version.