Privacy policy
1. Controller and contact
Data controller: Carlos Lafuente Chryssopulos, a natural person working under the IASONIC brand. Address: Narva mnt 9, Tallinn, Estonia. For any privacy matter, write to info@iasonic.com.
This policy explains how we handle the data of people who visit the website, write to us or hire us. When, within a project, we process data about the customers or contacts of a company that hires us (for example, the conversations handled by an AI agent), we do so on behalf of that company, which is the controller of that data; see section 4.
2. What data we process, why and on what basis
| Situation | Data and purpose | Legal basis and retention |
|---|---|---|
| Contact form or message | Name, phone, email (optional), company (optional), the service you are interested in and your message, to reply to you and, if you ask, prepare a proposal. | Pre-contractual steps at your request (Art. 6(1)(b) GDPR). If we do not enter into a contract, we delete them 12 months after your last contact. |
| Operational AI assessment | Name, job title, work email, phone or WhatsApp, company, industry, country, team size and your answers about your channels, tools, tasks and priorities. If you used the calculator beforehand, also its values and estimate. We use them to analyse your operation, prepare recommendations, offer you the assessment session and, if you ask, a proposal. | Pre-contractual steps at your request (Art. 6(1)(b) GDPR). If we do not enter into a contract, we delete them 12 months after your last contact. |
| Assessment session | Your contact details, the date of the session and the notes we take about your operation, to prepare the session and follow up. We only record a video call if we agree on it with you beforehand. | Pre-contractual steps (Art. 6(1)(b) GDPR). Same 12-month period. |
| Automatic website check | Name, email, phone, industry and your website address, to review your website and send you the result. | Your request (Art. 6(1)(b) GDPR). Same 12-month period. |
| Contracted project | The details of your company's contact persons and the information needed to do the work, communicate, deliver and provide support. | Performance of the contract (Art. 6(1)(b) GDPR) during the project and the contracted support, and afterwards for the limitation periods of any possible claims. |
| Payments and legal obligations | Name or company name, amount, date and reference of each payment, and the receipts. | Compliance with legal obligations, including tax obligations (Art. 6(1)(c) GDPR), for the period required by applicable law. |
| Commercial information | Only if you tick the optional box, which is unticked by default and not required for any request: email and phone, to send you information about our services and news. | Your consent (Art. 6(1)(a) GDPR), until you withdraw it by replying “UNSUBSCRIBE” or writing to info@iasonic.com. Withdrawing it does not affect your request. |
| Abuse protection | An encrypted identifier (hash) of your connection and your email, without storing the IP address or the email in plain text, to limit bulk submissions. A fragment of that identifier is stored with each request. | Legitimate interest in protecting the service (Art. 6(1)(f) GDPR). Control identifiers are deleted automatically after 24 hours without use; the fragment stored with the request follows the request's retention period. |
| Calculator, assessment progress and cookie preference | The calculator values and the assessment answers not yet sent are stored only in your browser, so they are not lost if you reload the page. Your choice in the cookie panel is also stored only in your browser. | Necessary for the service you request. The calculator and the assessment, until you close the tab; the cookie choice, 180 days. Details in the cookie policy. |
In the free-text fields of the forms, we ask you not to include your customers' data or sensitive data (health, financial data, etc.): for the assessment, describing your processes is enough.
The assessment recommendations are reviewed by a person. The automatic website review only analyses public content on that page. None of these processes makes decisions about you with legal or similarly significant effects. This website does not use analytics, advertising tools or tracking pixels.
3. Who else processes the data
We do not sell your data. The following providers are involved in delivering the service:
- Hosting and email: our hosting provider, which hosts this website, the forms and the info@iasonic.com mailbox on our behalf and may log technical data such as the IP address.
- WhatsApp (Meta): if you write to us or we write to you on WhatsApp, that service processes the data under its own terms and may transfer it outside the European Economic Area.
- Artificial intelligence providers: we may use them to analyse the information in your assessment and prepare recommendations, proposals and deliverables. We only send them the necessary information, avoid personal data that is not needed and configure them so they do not use that data to train their models.
- Scheduling and video calls: if you book the session through a scheduling link or we hold it by video call, the provider of that tool processes the data you give it under its own terms; we will tell you in the link or the invitation.
- Website speed measurement service: in the website check, it may receive your website address to measure its speed; it does not receive your contact details.
- Payments: the bank where we receive transfers processes payment data in accordance with the law. If the proposal offers card payment through an external link from a payment provider, that provider processes the data you give it on its own page, in accordance with its privacy policy. We do not collect card numbers or security codes.
- Authorities: when required by law, for example in tax matters.
Some of these providers are located, or may access data, outside the European Economic Area (for example, in the United States). In that case the transfer relies on the mechanisms provided for in the GDPR, such as an adequacy decision or the European Commission's standard contractual clauses offered by each provider. If you ask us, we will tell you which providers we have used in your case.
4. Data we process on behalf of our clients
When we implement AI agents, automations or integrations, we may process data about the customers, leads or contacts of the company that hires us (for example, messages, calls, appointments or CRM data). In those cases we act as a data processor (Art. 28 GDPR): we only follow the instructions of that company, which is the controller and must inform its contacts. Before accessing that data we sign a data processing agreement with it, listing the providers involved (for example, the agent platform, the AI model providers, messaging and, where used, telephony providers). If you are a contact of one of our clients and want to exercise your rights, please contact that company; if you write to us, we will pass your request on to it.
5. Your rights
You can request access, rectification, erasure, restriction, objection and portability of your data, and withdraw your consent at any time, by writing to info@iasonic.com. If you believe we have not handled your request properly, you can lodge a complaint with the Estonian data protection authority, Andmekaitse Inspektsioon, or with the data protection authority of your country of residence.
6. Security
Data travels encrypted (HTTPS). Form submissions are stored in a protected file on the server that cannot be opened from the browser, and in the controller's mailbox. In projects we work with minimum-permission access and recommend that you change any passwords you shared with us once the work is finished. The retention periods stated are applied by periodically reviewing and deleting those submissions.
7. Changes
If the processing or the providers change, we will update this policy and its date. Official text of the Regulation (EU) 2016/679 (GDPR) on EUR-Lex.