Privacy Policy

1. Who is responsible for your personal data?

The data controller is:

Canaries Inspired Consulting SLU
NIF: B56849599
Registered address: Calle La Lajilla 3, 35120 Arguineguín, Las Palmas, Spain
Email for privacy matters: katrina@inspiredconsultinggc.com

We have not appointed a Data Protection Officer because we are not currently required to do so.

2. What personal data do we collect?

The information we collect depends on how you interact with us and which services you use.

It may include:

• your name;
• email address;
• telephone or WhatsApp number;
• preferred method of contact;
• information you provide in an enquiry;
• the service you are interested in;
• answers to service-specific questions;
• correspondence and communications with us;
• appointment and consultation information;
• information necessary to provide services you ask us to provide;
• client and case administration information;
• payment and transaction information;
• records of marketing consent and withdrawal;
• information relating to holiday-let bookings where relevant to services we provide to property owners; and
• technical, security or audit information generated by the systems we use to provide our services.

Please do not send us health information, bank-account credentials, passwords, passport or NIE details, identity-document copies or other sensitive or confidential information through general website enquiry fields unless we have specifically asked you to provide that information through an appropriate method.

3. Website enquiries and prospective clients

When you submit an enquiry through our website, we process the information you provide so that we can:

• receive and understand your enquiry;
• contact you about it;
• determine how we may be able to assist;
• maintain an appropriate record of the enquiry;
• manage follow-up communications; and
• take steps at your request before entering into a contract with you.

The legal basis will normally be Article 6(1)(b) GDPR, where processing is necessary to take steps at your request before entering into a contract.

Where appropriate, we may also rely on our legitimate interests under Article 6(1)(f) GDPR in administering genuine business enquiries, maintaining appropriate business records, preventing misuse and ensuring the security and reliability of our systems.

Submitting an enquiry does not automatically give us permission to send you marketing emails.

4. Clients and provision of services

If you become a client, we process personal data where necessary to:

• provide the services you have requested;
• administer our relationship with you;
• communicate with you;
• maintain client and service records;
• arrange appointments;
• manage payments and invoicing;
• fulfil contractual commitments;
• comply with applicable legal, tax and accounting obligations; and
• establish, exercise or defend legal claims where necessary.

Depending on the processing concerned, our legal bases are:

• performance of a contract or steps before entering into a contract, Article 6(1)(b) GDPR;
• compliance with a legal obligation, Article 6(1)(c) GDPR; and
• where applicable, our legitimate interests, Article 6(1)(f) GDPR, including the proper administration, security and protection of our business and the establishment or defence of legal claims.

Where a particular service requires additional information or involves a different purpose or legal basis, we will provide additional information where required.

5. Marketing communications

We may offer you the option to receive occasional emails about relevant Inspired Consulting services, news and updates.

Where we ask you to opt in, marketing is based on your consent under Article 6(1)(a) GDPR.

The marketing option on our website is voluntary and is not pre-selected. You can submit an enquiry and use our services without agreeing to marketing.

Where you consent, we keep evidence of that consent, including the wording presented to you, when consent was given and the source of the consent.

You can withdraw your consent at any time by using the unsubscribe link in a marketing email or by contacting us at katrina@inspiredconsultinggc.com.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal and does not prevent us from sending communications that are necessary to provide a service you have requested or administer an existing relationship with you.

We use ActiveCampaign to manage relevant contact information, email communications and marketing preferences. ActiveCampaign may process personal data outside the European Economic Area. Where an international transfer requires safeguards under the GDPR, contractual transfer safeguards such as the European Commission's Standard Contractual Clauses are used as applicable.

6. Appointments and consultations

We use TidyCal to provide online appointment booking.

If you book an appointment, information such as your name, email address, booking details and information you choose to enter into the booking form may be processed through TidyCal.

The legal basis is normally Article 6(1)(b) GDPR, because the processing is necessary to arrange or provide the consultation or to take steps at your request before entering into a contract.

Please do not enter unnecessary sensitive personal information into free-text booking fields.

TidyCal is operated by Sumo Group Inc. and may involve processing outside the EEA. Its service provides GDPR-related mechanisms including a Data Processing Agreement and data-subject request facilities.

7. Payments

Where you make a payment online, payment processing may be provided by Stripe.

Stripe processes payment and transaction information necessary to complete and protect the transaction. We do not need to receive your complete payment-card credentials in order to process a Stripe payment.

Our legal basis for processing information necessary to take and administer your payment is Article 6(1)(b) GDPR and, where records must be retained for accounting, tax or other statutory purposes, Article 6(1)(c) GDPR.

Stripe operates internationally and may process personal data outside the EEA. Stripe maintains data-transfer arrangements that include the European Commission's Standard Contractual Clauses where applicable.

8. Email, telephone and WhatsApp communications

If you communicate with us by email, telephone or WhatsApp, we process the contact details and content necessary to receive, respond to and maintain appropriate records of those communications.

The legal basis depends on the context and will normally be:

• Article 6(1)(b) GDPR, where the communication concerns an enquiry, requested service or contract;
• Article 6(1)(c) GDPR, where processing is required by law; or
• Article 6(1)(f) GDPR, where processing is necessary for legitimate business administration, record keeping, security or the handling of genuine communications.

Where you choose to communicate using a third-party communications service such as WhatsApp, that provider may process information in accordance with its own terms and privacy arrangements.

9. Video consultations

Where appropriate, consultations may be held using Zoom.

Zoom may process information necessary to establish and operate the meeting, such as participant names, email or account information where applicable, meeting metadata and technical information.

Meetings are not routinely recorded by Inspired Consulting.

Where Zoom's AI-generated meeting-summary functionality is used, additional processing of meeting content may occur in order to generate the summary. We will use such functionality only where appropriate and subject to the applicable settings and transparency requirements.

The legal basis for providing the consultation is normally Article 6(1)(b) GDPR.

10. Holiday-let owner services

We provide administrative services to certain holiday-let property owners, including services connected with legally required guest registration and reporting.

Booking information provided by the property owner

The property owner enters booking information through an Inspired Consulting form.

Depending on the booking, this may include:

• property information;
• arrival and departure dates;
• number of guests;
• lead guest name;
• lead guest email address; and
• other limited booking or contact information required to create and administer the guest-registration process.

This information is submitted securely from the Inspired Consulting system to Kinapi, which provides the guest-registration service.

The Inspired Consulting website is not intended to collect guest passport images or guest identity-document information through this owner booking form.

Guest registration through Kinapi

Kinapi contacts the lead guest and provides access to its secure guest check-in process.

The guest supplies the information required for legally mandated traveller registration directly to Kinapi, rather than entering that identity information into an Inspired Consulting guest-registration form.

Depending on the applicable registration requirements, Kinapi may process information including:

• name and surname;
• sex;
• date of birth;
• nationality;
• identity-document type and number;
• identity-document issue date;
• relationship information concerning minors where required;
• address;
• telephone number and email address;
• accommodation/stay information;
• handwritten digital signature; and
• technical evidence associated with the signature, such as IP address and user-agent information.

Kinapi does not require the Inspired Consulting website to collect or store passport or identity-document images as part of this process.

SES.HOSPEDAJES

Kinapi communicates the legally required traveller-registration information to SES.HOSPEDAJES, the system operated by the competent Spanish authorities for accommodation and traveller reporting.

Kinapi receives and maintains relevant submission status information, including confirmation or error information associated with the reporting process.

Processing required for statutory guest registration and reporting is carried out in connection with the applicable legal obligations governing accommodation providers.

Our role when acting for property owners

Where Inspired Consulting processes guest information solely on the instructions of a property-owner client in providing this service, the property owner may act as the data controller and Inspired Consulting acts as a processor on that owner's behalf. Kinapi may in turn act as a sub-processor for that processing.

Where Inspired Consulting independently determines the purposes and means of any separate processing, it will be responsible for that processing in accordance with applicable data-protection law.

If we receive a data-protection request relating to information for which a property owner is the controller, we may need to refer or assist with that request in accordance with our obligations to that controller.

Where Kinapi processes the information

Kinapi documents its primary hosting for this service as Microsoft Azure Spain Central.

Kinapi also uses identified service providers for supporting functions. Where a supporting service involves a transfer outside the EEA, appropriate safeguards are applied as required.

Traveller-registration information subject to the applicable statutory retention requirement is retained for three years. Kinapi also retains relevant signature evidence for three years.

11. SES.HOSPEDAJES confirmation emails and Postmark

As part of the holiday-let service, we may use Postmark to send operational emails to property owners confirming the status of SES.HOSPEDAJES reporting.

We deliberately minimise the information included in these emails. Postmark will receive the property owner's email address and only the property, booking/reference and status information reasonably necessary to deliver the operational notification.

We do not intend to include guest passport details, identity-document details or copies of identity documents in these Postmark confirmation emails.

This processing is necessary to provide and administer the holiday-let service and will normally rely on Article 6(1)(b) GDPR.

Postmark is operated by a US-based provider and personal data processed through the service may be transferred to and stored in the United States. Its Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses for relevant transfers.

Postmark's standard message-content and activity retention is currently 45 days unless a different retention configuration is applied.

12. Our client-management system

We use Asesoría Flow to manage enquiries, clients and associated service information.

Information submitted through the Inspired Consulting website may be transferred securely to Asesoría Flow so that we can administer your enquiry or client relationship.

Website enquiry information is temporarily retained by the website system to support reliable delivery to Asesoría Flow. Once delivery has succeeded, the website copy is scheduled for deletion after 30 days. Enquiries that have not successfully reached Asesoría Flow may be retained while delivery is retried or the failure is investigated.

Asesoría Flow also maintains appropriate operational and audit information necessary to provide the service securely.

13. Service providers and recipients

We use carefully selected third-party providers where necessary to operate our business and provide our services.

Depending on how you interact with us, these may include:

• Asesoría Flow, for enquiry and client administration;
• ActiveCampaign, for contact management, operational email workflows and consent-based marketing;
• TidyCal, for appointment scheduling;
• Stripe, for payment processing;
• Zoom, for online consultations;
• Kinapi, for holiday-let guest registration and SES.HOSPEDAJES reporting;
• Postmark, for operational email delivery associated with the holiday-let reporting workflow;
• website hosting, database, email and technical infrastructure providers;
• professional advisers and service providers where reasonably necessary; and
• public authorities, regulators, courts or other bodies where disclosure is required or permitted by law.

Service providers acting as processors are required to process personal data for the relevant services and subject to applicable contractual and data-protection requirements.

We do not sell your personal data.

14. International transfers

Some of the technology providers we use are established outside the EEA or use infrastructure or subprocessors located outside the EEA.

Where personal data is transferred to a country outside the EEA and the transfer is not covered by a European Commission adequacy decision, we require an appropriate transfer mechanism where applicable, such as the European Commission's Standard Contractual Clauses, together with any additional safeguards required by applicable law.

This is relevant in particular to certain services provided by ActiveCampaign, TidyCal, Stripe and Postmark.

Kinapi's documented primary hosting for the guest-registration service is in Spain, although supporting providers may be involved as described in its data-processing documentation.

You may contact us if you would like further information about the safeguards relevant to your personal data.

15. How long do we keep personal data?

We do not keep personal data indefinitely simply because we have collected it.

Retention depends on the purpose for which the information is processed and any applicable legal obligations.

In general:

• website copies of successfully delivered enquiries are scheduled for deletion 30 days after successful delivery to Asesoría Flow;
• prospective-client information is retained only for an appropriate period for enquiry management and legitimate follow-up, subject to our applicable retention rules;
• client, contractual, invoicing and transaction records may be retained for the periods required by Spanish tax, accounting, contractual and other applicable laws;
• marketing consent evidence may be retained for as long as necessary to demonstrate when and how consent was obtained or withdrawn and to establish compliance;
• where marketing consent is withdrawn, we may retain the minimum information necessary to respect that withdrawal and prevent unwanted marketing;
• Kinapi traveller-registration information and relevant signature evidence subject to the applicable requirement are retained for three years;
• Postmark message content/activity is normally retained according to the configured Postmark retention period, which is 45 days by default; and
• information may be retained for longer where necessary for the establishment, exercise or defence of legal claims or where another legal obligation requires it.

When information is no longer required, it will be deleted, anonymised or otherwise handled in accordance with applicable data-protection requirements.

16. Where we receive your information from someone else

Most personal data is obtained directly from you.

However, in some circumstances we receive personal data from another person. In particular, a holiday-let property owner may provide limited information about the lead guest, such as the guest's name and email address, together with booking and accommodation information, so that the legally required guest-registration process can be initiated.

In that situation, the source of the information is the relevant property owner or accommodation operator.

Additional identity and traveller-registration information is then requested directly from the guest through Kinapi.

We may also receive information from a client, representative, professional adviser, service provider or public authority where this is necessary and lawful in connection with a service we provide.

17. Is providing your information mandatory?

You are not generally required to provide personal data simply to browse our website.

However, certain information is necessary if you want us to respond to an enquiry, arrange a consultation, process a payment or provide a requested service.

Fields marked as required must be completed for the relevant request to be processed.

Where information is required by law, failure to provide it may mean that the relevant service, registration or legal process cannot be completed.

Marketing consent is always optional where we ask for it separately.

18. Security

We take appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures include access controls and the use of appropriately secured systems and service providers, together with measures appropriate to the nature of the processing.

No internet-based system can be guaranteed to be completely secure, but we review the systems and providers used to process personal data and take reasonable steps to reduce foreseeable risks.

19. Automated decision-making and profiling

Inspired Consulting does not currently use personal data to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

If this changes, we will provide the information required by applicable data-protection law.

20. Your data-protection rights

Subject to the conditions and exceptions provided by law, you may have the right to:

• access personal data we hold about you;
• rectify inaccurate or incomplete personal data;
• request erasure of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing;
• receive certain personal data in a structured, commonly used and machine-readable format and request its transmission to another controller where the right to data portability applies;
• withdraw consent at any time where processing is based on consent, without affecting processing carried out lawfully before withdrawal; and
• not be subject, where the applicable legal conditions are met, to certain decisions based solely on automated processing.

You can exercise your rights by contacting:

katrina@inspiredconsultinggc.com

Please state clearly what you are requesting. We may ask for information reasonably necessary to confirm your identity where appropriate.

Exercising your data-protection rights is normally free of charge. We will respond within the periods required by applicable data-protection law.

21. Complaints

If you have concerns about how we process your personal data, we would appreciate the opportunity to address them. You can contact us at:

katrina@inspiredconsultinggc.com

You also have the right to lodge a complaint with the Spanish supervisory authority:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid
Spain

Website: www.aepd.es

Your right to complain to the supervisory authority is not dependent on first resolving the matter with us, although for certain rights-related complaints the authority may expect you first to have exercised the relevant right with the controller.

22. Changes to this Privacy Policy

We may update this Privacy Policy when our services, systems, providers, processing activities or legal obligations change.

The current version will be published on our website with its latest revision date.

Where a change materially affects how we process personal data, we will take any additional transparency or consent steps required by applicable law.

23. Contact us

For questions about this Privacy Policy, our use of personal data or to exercise your data-protection rights, contact:

Canaries Inspired Consulting SLU
NIF: B56849599
Calle La Lajilla 3
35120 Arguineguín
Las Palmas, Spain

Email: katrina@inspiredconsultinggc.com