Privacy policy

1. Introduction

This is a courtesy translation of the Spanish original. If there is any discrepancy between the two versions, the Spanish version prevails.

This privacy policy explains how BEPART-INNOVA, S.L. processes the personal data of people who visit the website truesight-product.bepart-innova.com (the “Website”), in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

2. Data controller

• Controller: BEPART-INNOVA, S.L. (trading name: BePart Innova)
• Tax ID (CIF): B72780893
• Registered office: Calle Albasanz, 76, 1.º Izquierda, 28037 Madrid, Spain
• Commercial Registry details: Madrid Commercial Registry, Volume 44,472, Folio 16, Section 8, Sheet M-783599, Entry 1
• Email (also for data protection matters): info@bepart-innova.com

You can send any query or request about data protection to that email address or to the postal address given.

3. Scope of this policy

This policy applies to the personal data processed through the Website: the contact form, the video demonstration, cookies and similar technologies (including website usage measurement), the map and the hosting technical logs.

It does not govern the processing of the images and data that TrueSight AI customers process with the service they contract. That processing is governed by the contract (and, where applicable, the data processing agreement provided for in article 28 GDPR) that BePart Innova signs with each customer.

The Website may link to third-party sites, whose data processing is governed by their own policies.

4. Contact requests

When you write to us through the contact form (for example, to ask for information, a free trial or a demonstration), by email or by telephone, we process your data to handle your request.

• Purpose: to reply to your enquiry or request and assess your interest in TrueSight AI.
• Data: name, email address, the content of your message and confirmation that you have read this policy (form checkbox), plus the technical data that accompanies any submission over the internet (such as your IP address or browser). If you contact us by email or telephone, the data you give us (such as your email address or telephone number). Do not include in the message data that is not necessary, in particular sensitive data.
• Legal basis: taking pre-contractual steps at your request (article 6(1)(b) GDPR) when you ask for information, prices, a free trial or a demonstration with a view to a possible contract; in all other cases, our legitimate interest in answering the enquiries we receive (article 6(1)(f) GDPR).
• Retention: for as long as necessary to handle your request and, afterwards, blocked for the limitation periods of any possible liabilities. If a contractual relationship is entered into, for its duration and the applicable legal periods. The form provider (Formspree) also keeps a copy of submissions for the period that corresponds to the service contracted by BePart Innova.
• Whether providing the data is mandatory: your name, email address and message are necessary in order to reply. Without them we cannot handle your request.

The data you provide must be truthful. If you include other people’s data in your message, you guarantee that you are entitled to do so.

5. Campaign data sent with the form

If you reach the Website from an advert or a campaign link, the page address may include parameters that identify that campaign.

When you submit the contact form, the campaign parameters in the page address, the landing page and the language are attached to your message regardless of your cookie choice, because reading the page address does not involve storing information on your device. The ChatGPT ad click identifier (oppref) is attached only if you have accepted advertising measurement.

If you have accepted advertising measurement, this campaign data is also kept in your browser for 30 days so that it can be attached even if you submit the form later (see the Cookie policy).

• Purpose: to know which campaigns and ads give rise to contact requests, in order to measure and improve the effectiveness of our advertising.
• Data: the campaign parameters in the page address (utm_source, utm_medium, utm_campaign, utm_term and utm_content), the landing page (landing_page) and the language of the version of the Website you use (language); and, only if you have accepted advertising measurement, the ChatGPT ad click identifier (oppref).
• Legal basis: for the campaign parameters, the landing page and the language, our legitimate interest in knowing which campaigns work (article 6(1)(f) GDPR); we consider that the impact on you is low, because this is campaign data, it does not include your browsing history, it is only sent if you decide to write to us, and you may object. For the ad click identifier (oppref), your consent (article 6(1)(a) GDPR), the consent you give when you accept advertising measurement.
• Retention: together with your request, for the same periods as in the previous section.
• Objection and withdrawal of consent: you may object to the processing based on legitimate interest, on grounds relating to your particular situation, by writing to info@bepart-innova.com; and you may withdraw your consent at any time through “Cookie settings”.

6. Commercial communications

The form checkbox only confirms that you have read this policy. Replying to your request is not an unsolicited commercial communication: it rests on what is explained in the section “Contact requests”.

• Scope: any other commercial communication by email requires that you have requested or expressly authorised it, or that the law allows it (article 21 LSSI-CE). We do not send commercial communications to people who only write to us through the form, except in those cases.
• Objection and unsubscribing: you may object to receiving commercial communications at any time, at no cost and by simple notification to info@bepart-innova.com, and withdraw any consent you have given, without affecting the lawfulness of processing carried out before.

7. Video demonstration

The demonstration (“Try the demo”) lets you upload a video to see how TrueSight AI analyses it. You do not need to register or provide an email address.

• Purpose: to analyse the video you upload and show you the result (whether or not the system detects an intrusion, and with what probability), and to keep the demonstration secure and working properly, for example by limiting the number of uploads per minute from the same IP address, which is checked temporarily in the system’s memory.
• Data: the video, which may contain images of people and of other identifiable elements (such as number plates or places); the original file name, which is kept as part of the video’s internal identifier and may appear in the system’s logs; the date and time of the upload; the analysis result and the IP address. Do not include personal data in the file name.
• Legal basis: for you, as the person requesting the demonstration, taking pre-contractual steps at your request (article 6(1)(b) GDPR). For people who may appear in the video, and for the security of the system, our legitimate interest in providing the demonstration requested and protecting the service (article 6(1)(f) GDPR).
• Safeguards: we use the video for the purposes stated in this section and we ask that videos showing identifiable people are not uploaded without their permission.
• Source: the data comes from you. If you appear in a video uploaded by someone else, this policy is the information we provide to you about that processing: the controller is BePart Innova and you may exercise your rights as explained below, stating the file name and the approximate date and time of the upload so that we can locate it.
• Recipients: the video is sent from your browser to a technical function hosted on Vercel, which forwards it to BePart Innova’s TrueSight AI platform for analysis (see “Recipients and processors”).
• Retention: for the time necessary to analyse the video and show you the result and, afterwards, only for as long as is needed for technical or security reasons or to handle claims.

You are responsible for being entitled to upload the video. Do not upload videos showing identifiable people without their permission.

8. Cookies, local storage and advertising measurement

The Website does not store anything on your device or activate any measurement until you decide. You can accept or reject advertising measurement, website usage measurement and recording of the visit separately; the last two are described in the next two sections. If you accept advertising measurement, the one described below is activated; if you reject it, it is not. The Cookie policy details each item, its duration and how to change your choice, which you can do at any time through Cookie settings.

• Purpose: to remember your cookie choice and, only if you accept advertising measurement, to measure which ChatGPT ads (OpenAI Ads) generate enquiries and to remember for 30 days the campaign you came from.
• Data (if you accept advertising measurement): the ad click identifier (oppref), a random browser reference, a technical event each time a page of the Website is loaded, the “contact submitted” event when the form is sent, the address of the page and of the page you come from (without parameters) and the technical connection data (IP address, browser and language) and, when you submit the form, a hash code of your email address. The events do not include the text of your message.
• Legal basis: your consent (article 6(1)(a) GDPR and article 22(2) LSSI-CE), which you may withdraw at any time through “Cookie settings”.
• Retention: your choice is stored in your browser for 12 months; the campaign data stored on your device, for 30 days; OpenAI’s cookies, for 30 and 365 days as indicated in the Cookie policy; at OpenAI, in accordance with its own policy.

When you accept advertising measurement, OpenAI’s measurement pixel sends that data to OpenAI. In general, under the data processing addendum for OpenAI’s advertising tools, each party acts as an independent controller of the data processed through the pixel. In practice, BePart Innova is responsible for asking for your consent and for sending that data to OpenAI; from that point OpenAI processes it under its own responsibility and in accordance with its own privacy policy. See OpenAI’s policies and its cookie policy.

BePart Innova’s advertising account has the pixel’s “automatic advanced matching” feature switched on. If you have accepted advertising measurement and submit the form, the pixel detects your email address, turns it into a code (SHA-256 hash) and sends it to OpenAI together with the “contact submitted” event so that OpenAI can match that contact to the ads. A hash is not anonymous data: OpenAI can compare it with email addresses it already holds. If you do not accept advertising measurement, this does not happen.

9. Website usage measurement (our own tool)

With your consent, the Website measures how it is used so that we can improve it, with a tool of BePart Innova’s own: we do not use Google Analytics or other third-party analytics services. The tool is not activated until you allow it, does not run in the area of the Website’s video analytics management tool and does not use cookies: it stores some technical keys in your browser’s storage (see the Cookie policy).

• Purpose: to know how the Website is used (which pages are read, where visits come from, what is clicked, in which field a form is abandoned, where something does not respond or is hard to follow, whether there are errors or the site is slow) in order to improve it and to measure the effectiveness of our campaigns.
• Data (if you accept): the pages you visit and how long you stay on them, how far you scroll, how you move the cursor and which elements of the page you click (with a short text of the element in which numbers and email addresses are hidden), which parts of the page stay in view, how you interact with forms (which fields you touch, how long it takes and how long what you type is, never its content), how the videos on the page play (start, pause and how far they get), whether you copy, cut, paste or select text, which other websites you go to from a link, which downloads you make and whether you click an email or phone link (without noting the address or the number). It also records which website, ad or campaign you come from (the UTM parameters and the ad click identifier in the page address, such as the ChatGPT Ads one), any search words that address contains, your approximate country and city, the type of device, browser and system, the language, the time zone, the screen size, some technical characteristics of the device and the connection, how fast the pages load and the technical errors that occur, together with random identifiers of your browser and your visit. The ad click identifier is recorded by the usage measurement even if you have not accepted OpenAI’s advertising measurement: it is a different purpose, carried out by our own tool.
• Frustration signals (if you accept): the tool records the signs that something does not work or is hard to follow: clicking several times in a row on the same spot, clicking without the page responding, clicking and a technical error occurring right afterwards, scrolling up and down repeatedly or going back a few seconds after reaching another page. For each signal, its type and, depending on the case, how many times it happens or how long it lasts, a technical reason code, and the point and the page element involved are recorded.
• What is not recorded: your name, your email address, your phone number or anything you type into a form. Your full IP address is not stored in the database: it is used at the moment the visit is received to work out the approximate country and city and to curb abuse and, in the server’s technical log, it is kept only truncated (without its last part) for 7 days.
• Legal basis: your consent (article 6(1)(a) GDPR and article 22(2) LSSI-CE), which you may withdraw at any time through “Cookie settings”.
• Retention: usage data for 395 days at most (180 for clicks and scrolling); afterwards it is deleted or summarised in aggregate figures that cannot identify you. Your choice is stored for 12 months in your browser.
• Recipients: the data is sent to a BePart Innova server (medicion.bepartweb.com) and is not shared with anyone. The connection to that server goes through a network provider (see “Recipients and processors”).
• Browser signals: if your browser sends the “Global Privacy Control” or “Do Not Track” signal, the tool measures and stores nothing, even if you have accepted: it only downloads its own code and its configuration, with no identifiers.
• Your rights: you may exercise them by writing to info@bepart-innova.com, as explained below. Because we do not keep your name or your email address, to locate the data linked to your browser we will need the random identifier shown in the bp_v2 key of your browser’s local storage, which only exists while measurement is switched on.

10. Recording of the visit

If you also allow it (with “Accept”, or by ticking “Recording of the visit” under “Choose”; it needs website usage measurement), a replay of how the page is scrolled and clicked is stored. Not every visit is recorded, only a share of them. Nor is it ever recorded in the area of the Website’s video analytics management tool.

• Purpose: to see how the people who visit the Website use it, in order to detect usability problems and improve its design.
• Data (if you accept): the cursor movements, scrolling and clicks on the page, and the content of the page as it was displayed. Form fields always appear hidden and nothing you type into them is recorded. The recording carries neither your name nor your email address; if you get in touch with us, we may link your visit to your request.
• Legal basis: your consent (article 6(1)(a) GDPR and article 22(2) LSSI-CE), which you may withdraw at any time through “Cookie settings”.
• Retention: 90 days; afterwards it is deleted.
• Recipients: the same as for website usage measurement: a BePart Innova server, without sharing the data with anyone.

11. Google Maps map

The contact section shows a Google Maps map. No connection with Google is made until you press “Load map”, and the location is shown as text. You can also open the “Open in Google Maps” link, which opens in a new browser tab and is governed by Google’s terms.

If you load the map, your browser connects to Google, which receives at least your IP address, the origin of the page from which the map is requested (without the address parameters) and technical data about your browser, and which may store or read cookies and identifiers on your device. Google processes that data as an independent controller, in accordance with its privacy policy. BePart Innova does not receive that data.

The legal basis is your consent (article 6(1)(a) GDPR), which you give by pressing “Load map” after reading the notice shown next to the button. If you do not want to connect to Google, do not press the button.

12. Hosting and technical logs

The Website is hosted by Vercel Inc. When you visit it, Vercel’s servers receive your browser’s requests and generate technical logs that include, among other data, your IP address, the date and time and the pages requested.

• Purpose: to serve the Website, guarantee its security and stability and detect errors and abuse.
• Legal basis: our legitimate interest in the operation and security of the Website (article 6(1)(f) GDPR).
• Retention: the periods that Vercel sets for its technical logs under the service contracted.

Pages are served from Vercel’s content delivery network, normally from the point closest to you. The technical function used by the demonstration may run in data centres outside the European Economic Area, including in the United States. The addresses requested may include the campaign parameters of the page address.

13. Recipients and processors

To provide the services described, your data may be disclosed to the following recipients, only to the extent necessary for each purpose:

14. International data transfers

Some recipients are established in the United States or may process data outside the European Economic Area. In those cases, the transfer relies on one of the safeguards provided for in the GDPR:

• Adequacy decision of the European Commission on the EU–US Data Privacy Framework, adopted by Implementing Decision (EU) 2023/1795, applicable to certified organisations. Vercel states that it participates in this framework.
• Standard contractual clauses approved by the European Commission (article 46(2)(c) GDPR). Formspree states that it relies on them as a processor and Vercel’s data processing agreement incorporates them.
• OpenAI and Google, which according to their agreements and policies act as independent controllers, and Cloudflare, which acts as a processor for the measurement server, apply the safeguards set out in their agreements and policies.

You can obtain more information about these safeguards, and about the means of obtaining a copy of them, by writing to info@bepart-innova.com.

15. Retention periods

The specific periods are stated for each processing activity. As a general rule, we keep data only for as long as necessary for the purpose for which it was collected. Afterwards, we delete it or, where the law requires, keep it blocked: that is, only available to judges, courts and competent authorities, and for the limitation periods of any liabilities arising from the processing.

16. Your rights

You may exercise the following rights over your personal data:

• Access: to know whether we process your data and obtain a copy.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to ask us to delete your data, among other cases when it is no longer necessary for the purpose for which it was collected.
• Restriction: to ask us to keep your data only in certain cases, for example while a challenge is being resolved.
• Portability: to receive the data you provided to us in a structured, commonly used format, where the processing is based on consent or a contract and is carried out by automated means.
• Objection: to object, on grounds relating to your particular situation, to processing based on legitimate interest (such as that of campaign data) and, at any time, to direct marketing.
• Withdrawal of consent: at any time, without affecting the lawfulness of earlier processing (cookies, through “Cookie settings”; information by email, by writing to the address given below).

How to exercise them: write to info@bepart-innova.com (or by post to BEPART-INNOVA, S.L., Calle Albasanz, 76, 1.º Izquierda, 28037 Madrid, Spain) stating the right you wish to exercise. To protect your data, we may ask you for a copy of a document proving your identity if this is necessary to verify it; if you act through a representative, you must prove the representation.

Time limit and cost: we will reply within one month of receiving the request, which may be extended by two further months where necessary because of the complexity or number of requests; if so, we will let you know. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

17. Complaint to the supervisory authority

If you consider that the processing of your data does not comply with the rules, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). We would be grateful if, before doing so, you wrote to us so that we can try to resolve it.

18. Automated decisions

BePart Innova does not take decisions based solely on automated processing of your data that produce legal effects concerning you or similarly significantly affect you (article 22 GDPR). The result of the demonstration is informative.

19. Security measures

BePart Innova applies technical and organisational measures appropriate to the risk to protect your data, such as encryption of communications through HTTPS and access control to its systems. Providers also apply their own measures. If a data security breach affecting you were to occur, we would handle it and notify you in the cases where the law requires.

20. Minors

The Website is aimed at businesses and professionals and is not aimed at minors. We do not knowingly collect personal data from minors. If you are aware that a minor has given us their data, write to info@bepart-innova.com so that we can delete it.

21. Changes to this policy

We may update this policy to reflect changes to the Website, to providers or to the law. The date of the latest update is shown at the top of the page. If the changes significantly affect the processing of your data, we will say so prominently on the Website.