Legal
Privacy Policy
Last updated: 17 August 2026.
This Privacy Policy explains how Arrel Growth, S.L. (“Arrel”, “we”, “us” or “our”) collects, uses and protects personal data when you visit our website (arrel.ai), contact us, book a call with us, or otherwise interact with our services. We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), Spanish Organic Law 3/2018 on Data Protection (“LOPDGDD”) and Law 34/2002 on Information Society Services (“LSSI”).
1. Who we are (Data Controller)
The data controller responsible for your personal data is:
Arrel Growth, S.L.
Email: team@arrel.ai
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. For any privacy question or request, contact us at the email above.
2. What data we collect
Data you give us directly:
- Contact and booking forms: your name, work email address, and any information you choose to include when you request a GTM Engine Review or otherwise contact us.
- Communications: the content of emails, calls or meetings you have with us, including notes and (where you are informed and applicable law is complied with) call recordings or transcripts.
- Business relationship data: if you become a client, the contact, billing and contractual details needed to deliver our services.
Data we collect automatically:
- Usage and device data: IP address, browser type, device information, pages visited and interactions with the site, collected via cookies and similar technologies (see Section 8).
Data from third-party sources (B2B prospecting):
As part of our business-to-business activity, we may process limited professional contact data about people at companies that fit our target market — such as name, job title, company, and work contact details — obtained from publicly available professional sources (e.g. LinkedIn, company websites) and specialised B2B data providers. We process only business-related data, never special categories of data. This section serves as the information notice required by Article 14 GDPR for data not obtained directly from you; your rights, including the right to object at any time, are described in Sections 6 and 7.
3. Why we process your data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Responding to your enquiry and scheduling the call you request | Form and booking data | Art. 6(1)(b) — steps prior to entering into a contract, at your request |
| Providing our services and managing the client relationship | Business relationship data | Art. 6(1)(b) — performance of a contract |
| B2B direct marketing and prospecting to professional contacts | Third-party-sourced professional contact data | Art. 6(1)(f) — our legitimate interest in promoting our services to relevant businesses (Recital 47 GDPR). We apply a documented balancing test and you can object at any time |
| Sending you relevant commercial communications after you contact us or become a client | Contact data | Art. 6(1)(f) — legitimate interest, and Art. 21.2 LSSI for similar services to existing clients; every message includes an opt-out |
| Website analytics and non-essential cookies | Usage and device data | Art. 6(1)(a) — your consent, given via the cookie settings on our site |
| Compliance with legal obligations (tax, accounting, responding to authorities) | Billing and contractual data | Art. 6(1)(c) — legal obligation |
| Establishing, exercising or defending legal claims | Any of the above, as needed | Art. 6(1)(f) — legitimate interest |
We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.
4. Who we share your data with
We do not sell personal data. We share it only with:
- Service providers (processors) who help us run our business under data processing agreements (Art. 28 GDPR), including providers of website hosting, forms and scheduling, CRM and email platforms, analytics, meeting recording and transcription, and B2B data services.
- Professional advisors (lawyers, accountants, tax advisors) where necessary.
- Public authorities where required by law.
- Clients: where we carry out prospecting work on behalf of a client, relevant professional contact data may be shared with that client under appropriate data protection terms.
5. International transfers
Some of our service providers are located outside the European Economic Area, mainly in the United States. Where that is the case, we rely on an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework, where the provider is certified) or on the Commission’s Standard Contractual Clauses, together with additional safeguards where appropriate. You can request more information about the safeguards applied by contacting us.
6. How long we keep your data
- Enquiry and booking data: for as long as needed to handle your request and, if no business relationship results, up to 12 months afterwards.
- Prospecting data: for as long as reasonably necessary for the campaign and follow-up; if you object or ask us to delete your data, we suppress it immediately (keeping only what is needed to honour your opt-out).
- Client and billing data: for the duration of the contract and thereafter for the periods required by Spanish commercial and tax law (generally 6 years under the Commercial Code).
- Cookie data: according to the lifespans stated in the cookie settings.
When data is no longer needed, we delete or anonymise it.
7. Your rights
Under the GDPR and LOPDGDD you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data (“right to be forgotten”)
- Restrict processing in certain circumstances
- Data portability (receive your data in a structured, machine-readable format)
- Object to processing based on legitimate interest — including, at any time and without giving reasons, to direct marketing
- Withdraw consent at any time, without affecting prior processing
To exercise any of these rights, email us at admin@arrel.ai from the address linked to your data, or write to our registered office. We will respond within one month. We may ask you to verify your identity.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD) — www.aepd.es, C/ Jorge Juan 6, 28001 Madrid — although we would appreciate the chance to resolve your concern first.
8. Cookies
Our website uses cookies and similar technologies. Strictly necessary cookies run without consent; analytics and any other non-essential cookies are set only if you accept them, in line with Article 22.2 LSSI and AEPD guidance. You can withdraw or change your choices at any time from the cookie settings on the site.
9. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss or disclosure — including access controls, encryption in transit, and vendor due diligence. No system is 100% secure, but we review our measures regularly.
10. Minors
Our website and services are directed at businesses and professionals. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us personal data, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. The current version will always be available on this page with its “last updated” date. If we make material changes, we will take reasonable steps to bring them to your attention.
12. Contact
Questions about this policy or your personal data: team@arrel.ai · Arrel Growth, S.L.