Privacy Policy

1. Data Controller

Rubén Bordonada Arroyo (Tax ID 72990028B), owner of IAGovernance.com, located at Avda. de Madrid 208-212, 50017 Zaragoza, Spain. Contact: rubenbordonadaarroyo@gmail.com

2. Data We Collect and Purposes

We collect personal data in the following contexts:

2.1 Free Assessment (email gate)

When you complete the AI Governance or Data Governance assessment and choose to receive the report, we collect: email, name, company, industry, company size, and professional role.

• Primary purpose: sending you the results report and personalized roadmap.
• Legal basis: performance of the requested service — Art. 6.1.b GDPR.
• Secondary purpose (only if you check the box): sending you updates on the AI Act, Data Governance, and regulatory compliance, at a maximum frequency of 2 emails per month.
• Legal basis for communications: explicit consent — Art. 6.1.a GDPR. You can withdraw consent at any time by replying to the email or contacting us.

We also automatically collect: your browser's time zone and language and the date and time of your consent. This data is used to segment assessment analysis and is not shared with third parties for commercial purposes. We do not geolocate your IP address.

2.2 Interactive tools

The interactive tools (risk classifier, self-assessments, calculators, roadmap) run in your browser. We do not passively record what you do in them or assign you identifiers. We only receive data when you voluntarily submit your email in a form (for example, to receive a result), for the same purpose and legal basis as in section 2.1. To remember your progress (for example, tasks ticked in the roadmap) we use your browser's local storage, which is not sent to our servers.

2.3 Data We Do Not Collect

We do not collect special category data (health, ideology, ethnic origin, etc.), data from minors, or payment information (payments are handled entirely by Lemon Squeezy as Merchant of Record).

3. Data Processors and International Transfers

We use the following services as data processors:

• Google LLC (Google Sheets / Google Workspace): storage of assessment leads. The transfer of data to the USA is covered by the EU-U.S. Data Privacy Framework (European Commission Adequacy Decision, July 2023). Google LLC is DPF-certified. More info: Google's privacy policy.
• Lemon Squeezy (Merchant of Record): payment and invoicing management for digital products. Lemon Squeezy acts as the direct seller and data controller for payment data. Its privacy policy is available on its website.
• Netlify Inc.: website hosting. Netlify is a US company: it may process technical data (for example, the IP address in access logs) outside the European Economic Area, under the EU-U.S. Data Privacy Framework and/or standard contractual clauses. More info in Netlify's privacy policy.
• Plausible Analytics: cookie-free, privacy-oriented web analytics: it does not build individual visitor profiles or track visitors across sites. Data is stored in the EU.

4. Data Retention

Assessment data is retained for 24 months from the date of capture, or until the user requests its deletion. Data with newsletter consent is retained while that consent remains active. After this period, data is irreversibly deleted or anonymized.

5. User Rights

Under GDPR (Arts. 15-22), you have the right to:

• Access: know what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data ("right to be forgotten").
• Objection: object to processing based on legitimate interest.
• Portability: receive your data in a structured format.
• Withdrawal of consent: at any time for newsletter communications, without affecting the lawfulness of prior processing.
• Complaint to the AEPD: if you believe processing violates your rights, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

To exercise any right, email us at privacidad@iagovernance.com stating your name, email, and the right you wish to exercise. We will respond within a maximum of 30 days.

6. Cookies and Tracking Technologies

IAGovernance.com uses Plausible Analytics, a web analytics tool that does not use cookies or track users across sites. It does not collect identifiable personal data. For more information, see our Cookie Policy.

We also use the browser's localStorage to remember whether the user has already completed the assessment's email gate, avoiding showing it repeatedly. This data stays exclusively in the user's browser and is never sent to our servers. Fonts are served from our own server: no third-party fonts are loaded.

7. Security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or alteration, including HTTPS across all communications and access controls on the spreadsheets where leads are stored.

8. Changes

We may update this policy to reflect changes to our services or applicable law. In the event of substantial changes, we will communicate this through the website. The last update date always appears at the top of this document.