Privacy Policy

1. Data Controller

Controller: Antonio Castro Freire

Trade name: Morvena

Tax ID (NIF): 34304508P

Address: Lugar Pedralonga, nº 95, 1.º A, 15009 A Coruña, Spain

Email: contacto@morvena.es

Country of establishment: Spain

Morvena provides services internationally and may interact with prospective and existing business customers located outside Spain, including in the United States.

2. Personal Data We May Process

Depending on how an individual interacts with Morvena, we may process:

• First and last name.
• Business email address.
• Business telephone number, where applicable.
• Company or organization.
• Professional position or role.
• Company website.
• Company domains and related business information.
• Approximate company size.
• Information submitted through assessment or scope request forms.
• Information voluntarily provided through email or other communications.
• Information necessary to manage a contractual or pre-contractual relationship.
• Billing and transaction-related information.
• Professional contact information obtained from business information providers or other lawful sources.
• Technical information generated through use of the website, where applicable.

Morvena does not intentionally request special categories of personal data through its general website or assessment request forms.

3. Purposes of Processing

Morvena may process personal data for the following purposes:

Enquiries and Assessment Requests

To respond to enquiries, provide information about Morvena's services, review assessment requests, determine the potential scope of an engagement, determine applicable pricing and provide pre-contractual information.

Provision of Services

To establish, manage and perform contracted services, communicate with customers, perform assessments, deliver reports, provide monitoring services and manage the customer relationship.

Billing and Payments

To administer payments, invoices, accounting records, refunds where applicable, and related financial or contractual obligations.

Payment information may be processed by the payment service provider used by Morvena. Morvena does not need to receive or store full payment card details where those details are processed directly by the payment provider.

Business-to-Business Communications

Where legally permitted, Morvena may process professional contact information for the purpose of identifying and communicating with representatives, executives, founders, business owners and other professionals regarding services potentially relevant to the organizations for which they carry out their professional activities.

Customer Support and Relationship Management

To respond to questions, manage service-related communications and maintain appropriate records relating to prospective and existing customers.

Legal, Fraud Prevention and Security Purposes

To comply with applicable legal obligations, establish or defend legal claims, prevent fraud or misuse and protect Morvena's systems, services and legitimate interests.

4. Professional Contact Data and B2B Prospecting

Morvena may process limited professional contact information relating to individuals acting in a professional or business capacity.

Depending on the circumstances, such information may be obtained from:

• Corporate websites.
• Professional platforms.
• Publicly accessible sources.
• Professional directories.
• Business databases.
• Specialized business information providers.

Information processed for these purposes may include:

• Name and surname.
• Professional position.
• Company or organization.
• Business email address.
• Business telephone number, where applicable.
• Information necessary to identify the individual's professional role and establish business contact.

Morvena seeks to limit such processing to information relevant to the individual's professional activity and the organization they represent.

The legal requirements applicable to a particular communication may vary depending on the recipient's location, applicable law and communication channel.

5. Legal Bases for Processing

Depending on the circumstances, Morvena may rely on one or more of the following legal bases:

Pre-contractual Measures

Where processing is necessary to respond to a request made before entering into a contract, including reviewing an assessment request, determining its scope and providing a price.

Performance of a Contract

Where processing is necessary to provide services contracted by a customer.

Legitimate Interests

Where processing is necessary for Morvena's legitimate interests or those of a third party and those interests are not overridden by the interests, rights or freedoms of the data subject.

Where legally applicable, this may include limited processing of professional contact information for establishing or maintaining relationships with organizations.

Spanish law specifically provides for a presumption of legitimate interest in certain processing of professional contact information where processing is limited to information necessary for professional location and is intended to maintain relations with the legal entity for which the person works.

Consent

Where an individual has freely provided valid consent for a particular processing activity.

Compliance With Legal Obligations

Where processing is necessary to comply with tax, accounting, regulatory or other legal obligations.

The existence of a lawful basis for processing personal data does not, by itself, determine whether a particular commercial communication may lawfully be sent. Commercial communications may additionally be subject to rules applicable to the relevant communication channel, recipient and jurisdiction.

6. Data Not Obtained Directly From the Data Subject

Where Morvena processes personal data that was not obtained directly from the individual, such information may originate from:

• Publicly accessible online sources.
• Corporate websites.
• Professional platforms and directories.
• Specialized business information providers.
• Other lawful professional or commercial sources.

Where required by applicable data protection law, Morvena will provide the information required in relation to such processing within the applicable period and subject to any applicable exceptions.

Individuals may contact Morvena to request further information concerning the source of personal data relating to them.

7. Commercial Communications and Opt-Out

Morvena may send business communications where permitted under the laws applicable to the relevant communication.

Recipients may request that Morvena stop sending marketing or prospecting communications at any time.

Requests may be made using the unsubscribe or opt-out mechanism contained in the communication, where available, or by contacting:

contacto@morvena.es

Where an individual opts out or objects to further prospecting, Morvena may retain the minimum information necessary to maintain a suppression record and ensure that the individual is not contacted again for that purpose.

8. Assessment Request and Scope Information

Prospective customers may provide information about their organization for the purpose of requesting an assessment and allowing Morvena to determine whether the organization falls within the available service scope and what price applies.

This information may include company identity, domain information, approximate number of employees, professional contact information and other information relevant to determining the scope of the requested service.

Submission of this information does not itself create a contractual relationship.

9. Customer and Assessment Data

Information supplied by customers for the purpose of performing an assessment will be used as necessary to:

• Confirm the agreed scope.
• Perform the contracted service.
• Prepare and deliver the assessment.
• Communicate with the customer.
• Provide any subsequently contracted monitoring services.

Because Morvena's services may involve information relating to an organization's digital exposure, Morvena will apply access controls and confidentiality measures appropriate to the nature of the information processed.

10. Service Providers and Recipients

Morvena does not sell personal data.

Personal data may be accessible to providers or independent professionals where reasonably necessary for the operation of Morvena or provision of its services.

These may include providers of:

• Website hosting and infrastructure.
• Business email.
• Assessment and scope forms.
• Customer and lead management.
• Payment processing.
• Scheduling and videoconferencing.
• Document storage and collaboration.
• Business communications.
• Business information and prospecting tools.
• Professional, technical and administrative services.

Morvena may also engage independent professionals or contractors to assist with the performance of contracted services.

Access to personal data will be limited to what is reasonably necessary for the relevant function and subject to appropriate legal, confidentiality and contractual safeguards where required.

Information may also be disclosed where required by law, court order or a competent public authority.

11. International Data Transfers

Some service providers used by Morvena may process personal data outside the European Economic Area, including in the United States.

Where GDPR requirements concerning international transfers apply, Morvena will use an appropriate mechanism or safeguard recognized by applicable law, which may include an adequacy decision, Standard Contractual Clauses or another legally recognized transfer mechanism.

12. Data Retention

Personal data will be retained only for as long as reasonably necessary for the purposes for which it was processed and for compliance with applicable legal obligations.

In particular:

• Assessment requests and pre-contractual information may be retained while the request is being considered and for an appropriate period thereafter.
• Customer and contractual information may be retained throughout the relationship and applicable statutory limitation periods.
• Billing and accounting information will be retained for periods required by applicable law.
• Prospecting information will be periodically reviewed and will not be retained longer than necessary for the relevant purpose.
• Suppression information may be retained where necessary to ensure that an opt-out or objection continues to be respected.

When information is no longer required, it will be deleted, anonymized or blocked where required by applicable law.

13. Data Subject Rights

Where applicable data protection law grants such rights, individuals may request:

• Access to their personal data.
• Rectification of inaccurate personal data.
• Erasure of their personal data.
• Restriction of processing.
• Objection to processing.
• Data portability, where applicable.
• Withdrawal of consent where processing is based on consent.

Requests may be sent to:

contacto@morvena.es

Morvena may request information reasonably necessary to verify the identity of the individual making the request.

14. Right to Object to Direct Marketing

Where personal data are processed for direct marketing purposes, the data subject may object to such processing at any time.

Following a valid objection, Morvena will cease processing the relevant personal data for direct marketing purposes, subject to retaining limited suppression information where necessary to respect the request.

15. Complaints

As Morvena is established in Spain, individuals may lodge a complaint with the Agencia Española de Protección de Datos (AEPD).

Spanish Data Protection Agency (AEPD)

www.aepd.es

Where applicable, individuals may also have the right to contact another competent data protection or privacy authority.

16. Security

Morvena applies reasonable technical and organizational measures designed to protect personal data against unauthorized or unlawful access, disclosure, alteration, loss or destruction.

Such measures are reviewed taking into account the nature of the information processed, the risks involved and available technology.

17. Changes to This Privacy Policy

Morvena may update this Privacy Policy to reflect changes in legislation, regulatory guidance, its services, providers or processing activities.

The current version will be made available through this website.