01
Data controller
| Controller | iPersonality Global Institute, S.L. |
|---|---|
| Tax ID (NIF) | B27580042 |
| Registered office | Calle de los Reyes 5, 1.º A, Madrid (Spain) |
| Data protection contact | info@legathum.ai, with “Data protection” in the subject line |
Last updated: 2 October 2026
Privacy policy
This policy explains how iPersonality Global Institute, S.L. processes your personal data when you visit scitechbiz.com, write to us, study at the SciTechBiz Institute Academy, belong to the SciTechBiz Community or use the app.scitechbiz.com platform. It is governed by Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on personal data protection and digital rights (LOPDGDD).
02
What we process, why and on what basis
| Processing | Purpose | Legal basis | Retention |
|---|---|---|---|
| User account | Sign-up, authentication and provision of the service | Performance of a contract (Art. 6(1)(b) GDPR) | Life of the account plus limitation periods |
| Purchases and invoicing | Order management, payment and tax obligations | Performance of a contract and legal obligation (Art. 6(1)(b) and (c)) | 6 years (Art. 30 of the Spanish Commercial Code) and tax periods |
| Community commissions | Calculation, settlement and evidence | Performance of a contract | Life of the contract plus 6 years |
| Information requests | Answering your enquiry, including the contact form | Pre-contractual steps (Art. 6(1)(b)) | 12 months without interaction |
| Marketing communications | Telling you about products and services | Consent (Art. 6(1)(a)) or, for clients, legitimate interest (Art. 21.2 LSSI) | Until you unsubscribe |
| Business prospecting on the platform | Managing business-to-business contacts | Legitimate interest (Art. 6(1)(f)), with a documented balancing test | 24 months without interaction |
| People assessments | Providing the service the organisation has contracted | Performance of the contract with the responsible organisation | As instructed by the controller |
| Security and access logs | Fraud prevention and traceability | Legitimate interest (Art. 6(1)(f)) | 12 months |
| Video sessions and their transcripts | Providing the service and documenting delivery | Performance of a contract; consent for recording | 12 months unless instructed otherwise |
We do not take automated decisions with legal effects on people without meaningful human involvement. We do not use personal data to train artificial intelligence models without explicit, specific and revocable consent.
People-assessment results in iPersonality are not shared with the Community administration and are not used to attribute sales, assign member categories, decide incentives or select members.
03
Contacts registered by Community members
When a member, on their own initiative, registers on the platform a business contact to whom they want to offer our products, that member and the Company are joint controllers (Art. 26 GDPR). The essence of their arrangement is this:
- The member is responsible for the lawful origin of the contact and the legal basis for processing, and for informing the person at the first contact.
- The Company is responsible for the security of the platform, for notifying breaches to the authority and for impact assessments where required.
- You can exercise your rights with either of them, but the Company is the single point of contact: the member forwards your request to it within seventy-two hours.
- The member undertakes not to register special categories of data or contacts taken from third-party lists. Contacts with no interaction for twenty-four months are deleted or anonymised.
04
Recipients
- Providers that work on the Company's behalf, such as hosting or payment processing, under a processing agreement as required by Article 28 GDPR. The list of processors, with their identity, purpose, country and safeguard, is available from info@legathum.ai.
- Public authorities and financial institutions, where the law requires it.
- We do not sell or pass on data to third parties for advertising.
05
International transfers
If a processor handles data outside the European Economic Area, a European Commission adequacy decision or its standard contractual clauses apply, with a transfer impact assessment where required. The specific safeguards are listed in the list of processors.
06
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and the right not to be subject to automated decisions, by writing to info@legathum.ai and proving your identity. We reply within one month, which may be extended by two further months.
You can withdraw your consent at any time, without affecting the lawfulness of earlier processing, and lodge a complaint with the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (www.aepd.es).
07
Security
We apply technical and organisational measures appropriate to the risk. If a personal data breach puts your rights at risk, we notify the authority within 72 hours and inform you where required.
08
Minors
Our services are not aimed at people under 18 and we do not knowingly collect their data.
09
Cookies
This site uses a single technical cookie, for the language. The details are in the Cookie policy.
10
Changes
If we change this policy substantially, we tell registered users thirty days in advance. The version in force is the one published on this page, with its date.