GDPR Information

This page provides supplementary information for data subjects located in the European Economic Area ("EEA") and, where applicable, the United Kingdom, in connection with the processing of personal data by BuhoPilot ("we", "us", or "our") under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

This information complements our Privacy Policy. In the event of any inconsistency, the Privacy Policy shall prevail unless mandatory law provides otherwise.

BuhoPilot acts as the data controller in respect of personal data processed through our platform and related services. For data protection enquiries or to exercise your rights, contact privacy@buhopilot.com.

We process personal data only where a lawful basis under Article 6 GDPR applies, including:

• Performance of a contract — to provide the Service you request.
• Legitimate interests — to secure, maintain, and improve the Service, subject to your rights.
• Consent — where required for non-essential cookies, marketing, or other optional processing.
• Legal obligation — to comply with applicable laws and regulatory requirements.

Subject to conditions and exceptions under applicable law, you have the following rights:

• Right of access (Article 15) — to obtain confirmation and a copy of your personal data.
• Right to rectification (Article 16) — to correct inaccurate or incomplete data.
• Right to erasure (Article 17) — to request deletion in certain circumstances.
• Right to restriction of processing (Article 18) — to limit how we use your data in certain circumstances.
• Right to data portability (Article 20) — to receive data you provided in a structured, commonly used format.
• Right to object (Article 21) — to object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making (Article 22) — where applicable, not to be subject to solely automated decisions with legal or similarly significant effects.
• Right to withdraw consent — at any time, where processing is based on consent.

To submit a request, email privacy@buhopilot.com. We may ask you to verify your identity. We will respond within one month, extendable by two further months where necessary, as permitted by Article 12 GDPR.

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

In Spain, the competent authority is the Agencia Española de Protección de Datos (AEPD). You may also contact the supervisory authority in your country of residence within the EEA.

Where personal data is transferred outside the EEA, we ensure appropriate safeguards under Chapter V GDPR, including Standard Contractual Clauses and supplementary measures where required. You may request further information regarding specific transfer mechanisms by contacting us.

We engage carefully selected service providers to process personal data on our behalf under written agreements that impose data protection obligations consistent with Article 28 GDPR. Categories of processors include hosting, payment, analytics, communications, and professional services providers.

We implement appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, including access controls, encryption in transit, and staff training. Where processing is likely to result in a high risk to individuals, we assess such processing in accordance with applicable requirements.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where required, communicate the breach to affected individuals in accordance with Articles 33 and 34 GDPR.

For GDPR-related enquiries: privacy@buhopilot.com. For general legal matters: legal@buhopilot.com.