Legal section

1 - INTRODUCTION.

GROWTHROADAI, S.L. (hereinafter, "Growth Road" or "we"), with NIF/CIF B10589711 and registered office at C/ Dalia 275, 28109 - (Alcobendas) – Madrid, is the owner of the domains "www.growthroad.org"; "www.growthroad.es"; "www.mihijonosabequeestudiar.com" and "www.hazmatchcontucarreraideal.com" where the websites and the Platform (in the case of growthroad.es) are hosted, which is made available to its Users for the purpose of allowing them access to the Services.

This Privacy Policy is an integral part of the Terms and Conditions of Use and the Services and will apply to the processing of personal data of the Users of our Platform and Services, including both the data provided by the Users directly and those that may be collected automatically or provided by third parties during the provision of any Service and/or in the development of a contractual relationship with us.

We care about the privacy of our Users and are committed to protecting all their information, which is why our Privacy Policy describes how Growth Road collects such data, in compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), the Organic Law 3/2018, of December 5, on the Protection of Personal Data and the guarantee of digital rights as well as any other regulation that may apply.

The access and use of our Platform and its Services implies the processing of personal information of its Users in accordance with the purposes contained and properly informed in this policy.

Navigating or using our Platform, as well as its Services and functionalities, implies the full and unconditional acceptance by the User of the content of this Privacy Policy and the Terms and Conditions (both of Use and of the Services).

Users should read our policy carefully to ensure that they fully understand it. Additionally, we recommend regularly checking the Policy for any updates or changes it may contain.

If any User disagrees with our policies, we ask them to leave the Platform and not to use this or any of our services.

1.1 WHAT ROLE DO WE HOLD IN THE PROCESSING OF YOUR DATA?

Growth Road will act as the data controller of the personal data of Users that is provided by them or collected in other ways through the Platform, which will be processed in accordance with the parameters set out in this policy.

Likewise, Growth Road may also act as the data processor of Users' personal data when these have been provided by their respective educational centers.

Therefore, Growth Road will be responsible for processing when it determines the purposes and means of processing. This position is adopted in the following processing activities:

(i) Provision of services directly to individual clients.

(ii) Addressing requests and communications from users received through the website.

(iii) Compliance with the legal and regulatory obligations applicable to the activity of Growth Road.

For its part, Growth Road will hold the role of data processor when processing personal data of students as a consequence of the contracting of its Services by educational centers.

1.2 WHAT PERSONAL DATA DO WE PROCESS?

We collect and process personal information from individual users and contacts from centers to continuously provide and improve our Services.

Specifically, Growth Road processes the following types of Personal Data:

Information provided to us by Users: we receive and store all the information that users provide to us in order to be able to use the Platform, enjoy our Services, and contact us. This information includes:

Account information: full name and email address.

Course information: all responses, data, general information that the user may provide when completing courses and questionnaires.

Information provided to us by representatives of educational centers: we receive and store all the information provided by the contact persons of educational centers who wish to enjoy our Services or contact us. This information includes:

Contact information: full name, email address, phone number, and the center they work for.

Student information: full name and email address, for the creation of user accounts.

Advisor information: full name and email address.

Information we receive automatically: we automatically collect and store certain types of information and metadata about how all users use the Services, including interaction with the content itself and functionalities available through the Services. For example: IP address; traffic and browsing data; device and service parameters; activity data on the Platform; information regarding interaction with content, Growth Road's orientation course, and account configuration preferences.

We may also receive information from cookies. For more information about cookies, you can consult our Cookie Policy. It should be noted that some of our Services may not be used if consent is not provided, or if it is later revoked.

Information we receive from other sources: we may receive personal information from other sources, such as, for example, when users interact with us through their social media accounts (Whatsapp, LinkedIn, Instagram, Tiktok, and Facebook) we may know their username on that social network or platform, as well as the rest of the public profile information, and/or what is included in the message or comment they send us.

1.3 FOR WHAT PURPOSES DO WE PROCESS PERSONAL DATA?

We process personal data to operate, provide, and improve the Services we offer to our clients. Specifically, we use the information for the purposes indicated below and under the following bases of legitimization:

To fulfill our contract with Users or educational centers:

Provision of Services: we use our Users' Personal Data in order to provide them with our Services.

Problem resolution and improvement of Services: we also process the personal data we collect to improve our Services, as well as to resolve issues and errors that are detected or reported by Users, with the aim of providing them with a better experience on our Platform.

Communication with users: we process personal data to contact our users regarding their account, the Services, or their activity on the Platform.

For our legitimate interests:

To protect our Services: we use the information to prevent misuse of our Services.

To improve the functionality of the Platform: we use the information to analyze how users interact with our Services and Platform, to understand the usage of the same in order to improve them.

To develop new products: we use the information to analyze the interaction with the Services and Platform, to understand how they are used, and thus be able to develop new products.

To comply with our legal obligations:

Compliance with legal obligations: in some cases, we collect and process personal data to comply with the law.

Retention of certain data: in many cases, the applicable legislation, such as billing legislation, requires us to retain data on transactions.

With the consent of the data subjects:

Provision of Services: aside from the legitimization for processing the personal information of Users based on compliance with the contract with them, by registering on the Platform, Users express their consent to the processing of their data for this purpose, which includes profiling (the primary objective of the Services).

Commercial communications: we may process Users' data in order to send them marketing communications about our Services, provided they give us their explicit consent.

Other specific purposes for which we collect consent: we may also inform and seek Users' consent to process their personal data for any specific purpose that may arise in the future.

Users may revoke their consent at any time (mainly directly through our Services), although it should be noted that in that case, it may not be possible to use a service or feature that requires the collection or use of that personal information.

1.4 HOW LONG DO WE RETAIN PERSONAL DATA?

We retain the data for as long as necessary to comply with the purposes for which they were collected.

On the other hand, we retain other personal data that we collect when you use our Services, as well as that which we receive from other sources, for a maximum of 18 months.

We may also retain certain data longer than specified in our policy to comply with legal requirements and for security reasons.

The previous periods will apply as long as the User's consent is not revoked, presenting a request for deletion, limitation of processing, portability, or opposition to the processing of their personal data, through our contact email.

1.5 PERSONAL DATA OF MINORS

We do not knowingly process data from minors under 14 years of age without express authorization from their parents or legal guardians. Thus, we understand that if the User is a minor according to applicable law, the appropriate consent has been given by their parents or legal guardians, so the use of our services is being carried out with the recognition, understanding, and acceptance of the terms set forth here, as well as of the services themselves.

If we become aware that personal data of a minor has been provided or collected in or through our Services without such prior authorization, we will take appropriate measures to delete them as soon as possible, reserving the right to suspend or terminate the Services and the use of the Platform.

We are not responsible for actions taken by individuals lacking the legal capacity necessary or for the alteration or concealment of their conditions that incapacitate them from carrying out such actions. Parents or legal guardians of minors under 14 years old who are Users of any of our services or applications can contact us at atencionalcliente@growthroad.es to unsubscribe and delete their data.

1.5 DATA SHARING

We may share limited information with providers or professionals we hire to perform specific jobs. This includes, for example, cloud service providers like Amazon Web Services, which host our data.

Additionally, we may share information in compliance with and enforcement of the law, to respond to a request for information by public agencies and authorities.

Beyond these cases, Growth Road will not share Users' personal data without their explicit consent.

Notwithstanding the above, at Growth Road, we may share information about the User that has been previously anonymized so that it cannot be reasonably used to identify them. For example, we can share aggregated statistics of Users to describe our business to partners or the public.

Likewise, we may share aggregated and anonymized information with universities that contract our services, about the results of courses taken by Users brought by the universities themselves.

INTERNATIONAL DATA TRANSFERS.

Growth Road operates and supports its products, services, and applications from Spain without prejudice to the use of platforms and providers located in other countries in the framework of its provision, subject to the provisions of the data protection regulations in force at any given time.

User data may be stored or processed on our servers in Europe, without prejudice to the possibility that they may be stored or processed in other countries where our providers related to our services and applications have their presence, operate or maintain their facilities. Data processors that may participate in our services and applications located outside the European Union (EU) and the European Economic Area (EEA), such as the United States and the United Kingdom, must have an adequate level of protection, under the conditions and guarantees required by law and contract.

When data is transferred outside the European Economic Area (EEA), we use Standard Contractual Clauses, and we rely on the Adequacy Decisions of the European Commission regarding specific countries, as applicable, or on other legally compliant mechanisms or conditions for such data transfers. This means that they will be carried out in accordance with the minimums established in the GDPR.

The data transfers that may be made will be necessary for the operation and provision of the applications, products, and services described for the purposes indicated. By using our applications, products, and services, you acknowledge and accept that your data will be processed outside your country of residence.

1.6 HOW DO WE PROTECT PERSONAL DATA? SECURITY MEASURES

Growth Road is committed to fulfilling its confidentiality and secrecy obligation regarding personal data it processes and adopts the administrative, technical, and physical security measures required by privacy legislation to reasonably ensure its protection and avoid alteration, loss, unauthorized processing, or access, taking into account at all times the state of technology. However, we cannot fully guarantee the absolute invulnerability of our security systems or those of third parties, as no currently implemented security measure is absolutely unbreakable, which is why Growth Road will not be responsible in any case for incidents that may arise regarding personal data when resulting from an attack or unauthorized access to its systems in such a way that it is impossible to detect them by the implemented security systems, without prejudice to the possible obligation to notify the fact to the competent authorities and to the affected users.

Any third party, agent, or representative of Growth Road who needs to access your information is also obliged to implement reasonable technical and organizational measures for the protection of your information.

Our Platform may contain links to third-party sites or providers. It should be noted that these third parties or providers are governed by their own policies, so it is recommended to review their terms and conditions, privacy policies, and cookie policies before using such platforms or services. Notwithstanding the above, Growth Road performs a prior filtering of providers to try to choose the one that offers the best guarantees of security. But we cannot be responsible for the use and management they make of your information.

1.7 WHAT ARE USERS' RIGHTS AS DATA SUBJECTS?

As a data subject, you have the right to request Growth Road at the following address atencionalcliente@growthorad.es:

access to your data,

the rectification of your data, because we also want to ensure that your information is accurate and up to date,

the deletion of your data,

the limitation of the processing of data concerning you,

the opposition to the processing of your data, when the legitimization for processing your data is our legitimate interest,

the withdrawal of consent for the processing of personal data when the legitimization for processing the data is the consent of the data subject, and

the portability of personal data when the legitimization for processing such data is the consent of the data subject or the execution of a contract.

For exercising the aforementioned rights, those affected must address Growth Road through the postal address or email indicated at the beginning of this Policy.

For security reasons, we may also ask for a photocopy of your ID, electronic signature, or scanned copy of your ID, in accordance with the minimum legally established content.

We will process your request as soon as possible, always within the margins and deadlines stipulated by the GDPR and the current applicable legislation at the time of said request.

Additionally, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD) if you have questions or are not satisfied with the exercise of your rights by writing to the postal address C/Jorge Juan nº 6, C.P: 28001 (Madrid), with telephone number (+34) 912 663 517 or through its electronic headquarters.

ANNEX I – DEFINITIONS

DEFINITIONS

"Personal Data" means any information relating to an identified or identifiable natural person.

"Service/s" refers to the SaaS (Software as a Services) services provided to clients (individuals and/or educational centers). That is to say, the services for access via https://app.growthroad.es, or through any other designated URL, by the clients (individuals and/or educational centers) to the Software, as well as any online or offline auxiliary product or service provided to such clients by Growth Road, under the agreement with them.

"Software" or "Platform" means the computer program developed, operated, and maintained by Growth Road, based on an artificial intelligence system that allows determining the vocational and academic profile of Users, after completing the orientation Course hosted on the Platform itself.

"User/s" refers to both individual clients of Growth Road and students from the educational centers that contract our Services.