Privacy Policy

1. Data controller

The data controller is IATASKIA S.L., tax ID (NIF) B05703038 (Spain). RepuOrbit is the product and service of IATASKIA S.L. through which the service is provided. You can contact the controller at legal@iataskia.com.

2. RepuOrbit as controller and as processor

It is important to distinguish two different situations:

Data controller

When the entity operating RepuOrbit processes data to manage the relationship with whoever contracts the service —accounts, contractual relationship, billing, support, security, fraud prevention, contact and service communications—, it acts as data controller. This policy covers that processing.

Data processor

When RepuOrbit processes personal data on behalf of a client business in order to provide the contracted features (for example, reviews and data of its end customers), the client business is the controller and the entity operating RepuOrbit acts as data processor. That relationship is governed by the Data Processing Agreement in accordance with Article 28 of the GDPR.

3. What categories of data we process

Depending on how you use RepuOrbit, we may process:

• Registration and account data: name, email, authentication credentials —the password is stored using a secure hash—, language, role and permissions.
• Contact data: those you provide when writing to us or filling in forms.
• Business data: name, sector, locations and service configuration.
• Billing and payment data: when the user contracts a paid plan, the data needed to manage the subscription, billing and payments.
• Support messages and communications you exchange with us.
• Service settings and preferences.
• Technical and security logs: IP addresses, timestamps, events and records necessary to operate and protect the service.
• Information associated with the use of the service, for its proper operation.
• Content that the client connects to the service where applicable (for example, imported reviews), processed on the terms indicated for the processor role.

4. Why we process the data

• Create and manage user and organisation accounts.
• Provide RepuOrbit’s features.
• Handle support and respond to your requests.
• Ensure security and prevent fraud and abuse.
• Manage the subscription, billing and payments where applicable.
• Send necessary service communications (notices, changes, incidents).
• Send commercial communications only where a valid legal basis exists.
• Improve the product technically where legitimate and in compliance with regulations.

5. Legal bases

Each purpose relies on a distinct legal basis; we do not use consent as a generic basis for everything:

• Performance of a contract (Art. 6.1.b GDPR): creating and managing your account, providing the service, support, and managing the subscription, billing and payments.
• Compliance with legal obligations (Art. 6.1.c): applicable accounting, tax and retention obligations.
• Legitimate interest (Art. 6.1.f), only where genuinely appropriate and after a balancing test: security, fraud prevention and technical improvement of the service.
• Consent (Art. 6.1.a), where necessary: commercial communications that depend on your consent and non-essential technologies (cookies) as per the Cookies Policy. You may withdraw it at any time, without this affecting the lawfulness of processing carried out beforehand.

6. Retention periods

We keep the data while the relationship with the service exists and, thereafter, blocked for the legally required periods to address any liabilities (for example, tax and commercial obligations). Once those periods have elapsed, the data is deleted or anonymised.

Where no specific legal period exists, the data will be kept only for the time necessary to fulfil the purpose for which it was processed and to address any liabilities that may arise from the processing.

7. Recipients and providers

We do not sell your personal data. To provide RepuOrbit we may disclose or allow access to certain data to technology providers and other third parties necessary for the operation of the service. Depending on the nature of the service and the applicable legal relationship, these third parties may act as processors or sub-processors or, where applicable, as independent controllers.

We may also disclose data to public authorities, authorities, courts or other third parties where a legal obligation exists.

The list of providers and sub-processors involved in the processing will be kept up to date in the Data Protection documentation and in the Data Processing Agreement where applicable.

8. International transfers

Some providers may involve processing or transfers of data outside the European Economic Area. We do not claim that all data always remains in Spain or in the European Union.

Where an international transfer takes place, the safeguards provided for in the GDPR will apply (for example, adequacy decisions, standard contractual clauses or other legally valid mechanisms), and you may obtain information about those safeguards by writing to legal@iataskia.com.

9. Artificial intelligence and data

• RepuOrbit uses AI to assist in generating, classifying and analysing reviews and responses.
• Depending on the configuration, the generated responses may require human approval. In manual approval mode, nothing is published until the user approves it.
• AI can analyse patterns present in the reviews to detect problems, strengths and trends.
• Recommendations are decision support, not a guarantee of results; the client remains responsible for the business decisions it makes.
• To perform these functions, the necessary data may be sent to the AI provider configured by the client. The client may use the credentials/API Key of its own provider; even so, RepuOrbit may need to process and transmit certain data to execute the requested feature.
• We do not claim that AI is infallible or that there is legal decision-making exclusively automated; no automated decisions with legal or similar effects are made without human intervention.

10. Your rights

You may exercise the following rights:

• Access to your data.
• Rectification of inaccurate data.
• Erasure (right to be forgotten).
• Objection to processing.
• Restriction of processing.
• Data portability.
• Withdrawal of consent where processing is based on it, without retroactive effect.
• Not to be subject to decisions based solely on automated processing that produce legal or similar effects, where legally applicable.

To exercise them, write to legal@iataskia.com, indicating the right you wish to exercise. We may ask you to prove your identity.

If you consider that we have not properly addressed your rights, you may lodge a complaint with the Agencia Española de Protección de Datos (AEPD).

11. Security and confidentiality

We apply technical and organisational measures appropriate to the risk to protect data against unauthorised access, loss, alteration or disclosure. The measures implemented include protection of sensitive credentials, secure storage of passwords using hashing, access controls, logical isolation between organisations, audit logs, request rate limiting, and communications protected via HTTPS/TLS. Staff and providers who access the data are subject to a duty of confidentiality.

You can consult additional information about the applicable measures in our Data Processing Agreement.

12. Minors

RepuOrbit is a B2B service aimed at businesses and professionals. It is not directed at minors nor does it knowingly collect their data as users of the service. If improper processing of minors’ data were detected, the corresponding measures would be adopted in accordance with the applicable regulations.

13. Changes and update date

We may update this policy to adapt it to regulatory or service changes. We will publish the current version on this page. Last updated: 2026-10-02.