Privacy Policy

In accordance with Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), and in compliance with the principles of lawfulness, fairness, and transparency governing the processing of personal data, we hereby inform you that:

The controller of the personal data collected through the Otus platform is Datintel, S.L., with Tax Identification Number (NIF) B56582307 and registered office at Alicante Science Park, West Campus of the University of Alicante, 03005 Alicante, Spain.

You may contact the controller at: otus.goldenowl.ai

Hereinafter referred to as "Otus by Golden Owl®".

1. Information Regarding Data Processing Activities

Personal data provided to Otus by Golden Owl® through the platform otus.goldenowl.ai, or through any of the communication channels made available to users, may be processed for the purposes corresponding to the reason for which such information was provided.

Depending on the nature of the service provided, Otus by Golden Owl® may act either as Data Controller or Data Processor in accordance with Regulation (EU) 2016/679 (GDPR), applicable data protection legislation, the contractual arrangements established between the parties, and any documented instructions that may apply in each case.

Otus by Golden Owl® applies appropriate technical and organisational measures designed to ensure the confidentiality, integrity, availability, authenticity, resilience, and security of the information processed. Such measures are aligned with the principles established by the GDPR, the Spanish National Security Framework (ENS), ISO/IEC 27001, and other recognised information security standards and best practices, in a manner proportionate to the risks associated with the relevant processing activities.

Access to personal data is restricted exclusively to authorised personnel and, where necessary for the performance of a requested service, to authorised experts who are subject to contractual confidentiality, information security, data protection, and professional conduct obligations. Access is granted solely on a strict need-to-know basis and only to the extent necessary for the performance of their authorised functions.

Otus by Golden Owl® does not use information provided by clients, experts, users, investigations, assignments, reports, documents, communications, or any other content processed through the platform to train public artificial intelligence models or for purposes unrelated to the provision of the requested services.

2. Client Data Processing Activities

User Registration and Account Creation (Client)

Description: To manage the user's registration request, create and maintain a client account, verify eligibility to access the platform, and enable access to the services, functionalities, and resources available through Otus by Golden Owl®.

Legal Basis: Consent of the data subject (Article 6(1)(a) GDPR) and/or performance of a contract or implementation of pre-contractual measures at the request of the data subject (Article 6(1)(b) GDPR).

Retention Period: Personal data will be retained for as long as the user maintains an active account and thereafter for the periods necessary to comply with applicable legal, regulatory, contractual, security, audit, fraud-prevention, and evidentiary obligations.

Recipients: Personal data will not be disclosed to third parties except where required by law or where necessary for the provision of essential platform services through duly authorized service providers acting under appropriate contractual, confidentiality, and data protection obligations.

Management of Research, Intelligence, and Investigation Assignments

Description: To manage requests for intelligence, research, analytical, investigative, verification, due diligence, OSINT, market intelligence, business intelligence, or related services submitted through the platform, including assignment management, workflow administration, coordination with authorized experts, quality assurance processes, and delivery of the resulting work product.

Legal Basis: Performance of a contract (Article 6(1)(b) GDPR).

Retention Period: Data will be retained for the duration necessary to provide the requested services and thereafter for the periods required by applicable legal, regulatory, contractual, accounting, tax, civil liability, information security, and evidentiary obligations.

Recipients: Information strictly necessary for the execution of a specific assignment may be accessible to the authorized expert assigned to that engagement where such access is required for service delivery. All experts are subject to contractual confidentiality, information security, professional conduct, and data protection obligations. Personal data will not otherwise be disclosed to third parties except where required by law.

Communications Through the Platform

Description: To manage communications, notifications, support interactions, messages, file exchanges, operational updates, and other communications exchanged through Otus by Golden Owl® between users, experts, and platform administrators.

Legal Basis: Performance of a contract (Article 6(1)(b) GDPR).

Retention Period: Communications will be retained for the period necessary to manage the relevant service, account, assignment, security requirements, dispute resolution, audit obligations, and applicable legal retention periods.

Recipients: Personal data will not be disclosed to third parties except where required by law or where access is necessary for authorized personnel involved in the operation, security, support, or administration of the platform.

Payment Processing and Invoicing

Description: To manage payments, billing, invoicing, accounting obligations, refunds where applicable, fraud prevention measures, and compliance with financial, tax, and regulatory requirements.

Legal Basis: Performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations (Article 6(1)(c) GDPR).

Retention Period: Data will be retained for the periods required by applicable accounting, tax, anti-fraud, regulatory, and legal obligations.

Recipients: Payment transactions may be processed by authorized payment service providers. At the date of publication of this Privacy Policy, Otus by Golden Owl® uses Stripe Payments Europe, Ltd. as its payment processing provider. Personal data will not be disclosed to other third parties except where required by law.

Customer Support and Assistance

Description: To manage enquiries, requests, technical support incidents, complaints, service-related communications, onboarding assistance, and other support interactions submitted through the platform or other authorized communication channels.

Legal Basis: Consent of the data subject (Article 6(1)(a) GDPR) and/or performance of a contract (Article 6(1)(b) GDPR), depending on the nature of the request.

Retention Period: Pre-contractual enquiries may be retained for up to twelve (12) months following the last interaction. Support records relating to active clients may be retained for the duration of the contractual relationship and for any applicable legal, security, audit, or evidentiary retention periods.

Recipients: Personal data will not be disclosed to third parties except where required by law or where access is necessary for authorized personnel involved in providing support, security, or operational assistance.

3. Data Processing Activities Relating to Experts

Expert Registration and Account Creation

Description: To manage applications for inclusion within the Otus by Golden Owl® expert network, including identity verification, qualification assessment, onboarding procedures, account creation, and the allocation of an expert profile within the platform.

Legal Basis: Consent of the data subject (Article 6(1)(a) GDPR) and/or performance of a contract or implementation of pre-contractual measures at the request of the data subject (Article 6(1)(b) GDPR).

Retention Period: Personal data will be retained for as long as the expert maintains an active relationship with Otus by Golden Owl® and thereafter for the periods required to comply with applicable legal, contractual, tax, accounting, security, audit, and evidentiary obligations.

Recipients: Personal data will not be disclosed to third parties except where required by law or where necessary for the operation of the platform through duly authorized service providers subject to appropriate confidentiality and data protection obligations.

Assignment Management and Service Delivery

Description: To identify suitable experts, assign projects, investigations, intelligence assignments, analytical work, consulting activities, or other services according to expertise, qualifications, availability, geographic coverage, language capabilities, and operational requirements, as well as to manage the delivery of resulting work products.

Legal Basis: Performance of a contract or implementation of pre-contractual measures (Article 6(1)(b) GDPR).

Retention Period: Data will be retained for the duration of the relationship and thereafter for the periods required under applicable legal, accounting, tax, contractual, security, audit, and evidentiary obligations.

Recipients: Personal data will not be disclosed to third parties except where required by law or where access is necessary for authorized personnel responsible for operational management, quality assurance, compliance, security, or platform administration.

Communications Through the Platform

Description: To manage communications, notifications, messages, operational instructions, assignment-related interactions, support requests, and other exchanges conducted between experts and Otus by Golden Owl® through the platform or authorized communication channels.

Legal Basis: Performance of a contract or implementation of pre-contractual measures (Article 6(1)(b) GDPR).

Retention Period: Communications will be retained for the period necessary to manage the relationship, perform contractual obligations, ensure platform security, and comply with applicable legal retention requirements.

Recipients: Personal data will not be disclosed to third parties except where required by law.

Expert Payments and Financial Administration

Description: To manage payments, invoices, accounting obligations, tax compliance, fraud prevention measures, and financial administration relating to services performed by experts through the platform.

Legal Basis: Performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations (Article 6(1)(c) GDPR).

Retention Period: Data will be retained for the periods required under applicable accounting, tax, anti-fraud, financial, and regulatory obligations.

Recipients: Payment transactions may be processed through authorized financial institutions and payment service providers. Personal data will not otherwise be disclosed except where required by law.

Expert Verification and Accreditation

Description: To verify and assess the identity, professional qualifications, credentials, experience, reputation, suitability, compliance status, and other information necessary to maintain the quality, integrity, reliability, and trustworthiness of the Otus by Golden Owl® expert network.

Legal Basis: Performance of a contract or implementation of pre-contractual measures (Article 6(1)(b) GDPR), and the legitimate interest of Otus by Golden Owl® in maintaining the quality, security, integrity, and reliability of its expert ecosystem (Article 6(1)(f) GDPR).

Retention Period: Data will be retained for the duration of the relationship and thereafter for any applicable legal, regulatory, contractual, security, audit, or evidentiary retention periods.

Recipients: Personal data will not be disclosed to third parties except where required by law or where verification activities are conducted through authorized service providers acting under appropriate confidentiality, security, and data protection obligations.

4. Data Processing Activities Relating to Website Visitors and Communications

Contact Requests and General Enquiries

Description: To manage requests for information, commercial enquiries, partnership requests, demonstrations, support requests, media enquiries, or any other communication submitted through contact forms, email, telephone, or other communication channels.

Legal Basis: Consent of the data subject (Article 6(1)(a) GDPR), implementation of pre-contractual measures (Article 6(1)(b) GDPR), and/or the legitimate interest of Otus by Golden Owl® in managing communications and responding to requests (Article 6(1)(f) GDPR), as applicable.

Retention Period: Personal data will be retained for up to twelve (12) months following the last interaction unless a contractual relationship is subsequently established or a longer retention period is required by law.

Recipients: Personal data will not be disclosed to third parties except where required by law.

Security, Fraud Prevention, Compliance and Platform Protection

Description: To protect the security, integrity, availability, confidentiality, and lawful operation of the platform, systems, infrastructure, users, experts, and services, including the detection and prevention of fraud, abuse, unauthorized access, cybersecurity incidents, policy violations, and other security-related events.

Legal Basis: Legitimate interest of Otus by Golden Owl® in ensuring the security and lawful operation of its systems and services (Article 6(1)(f) GDPR), and compliance with legal obligations where applicable (Article 6(1)(c) GDPR).

Retention Period: Security-related information, logs, audit records, and incident records may be retained for the periods reasonably necessary to investigate incidents, comply with legal obligations, maintain information security, and protect the rights and interests of Otus by Golden Owl®, its users, and third parties.

Recipients: Authorized personnel, authorized service providers supporting security operations, and competent authorities where required by law.

5. Data Processing — Forms, Communications, and Documents

Personal data collected through forms, communication channels, documents, applications, contractual documentation, or any other means referring to this Privacy Policy may be processed for the purposes corresponding to the reason for which such data was provided, including the following:

Billing and Financial Administration

• Purpose: To manage the contractual or pre-contractual relationship between you and Otus by Golden Owl®, including administrative, accounting, financial, tax, compliance, and payment management activities.
• Legal Basis: Performance of a contract or implementation of pre-contractual measures (Article 6(1)(b) GDPR); compliance with legal obligations (Article 6(1)(c) GDPR).
• Retention: For the periods required under applicable civil, commercial, accounting, financial, tax, anti-fraud, and regulatory legislation.
• Recipients: Data may be disclosed to competent public authorities, financial institutions, payment service providers, auditors, or professional advisors where legally required or necessary for the management of the contractual relationship.

Project, Investigation, and Assignment Management

• Purpose: To manage, coordinate, execute, deliver, monitor, verify, and administer projects, investigations, intelligence assignments, reports, analyses, research services, due diligence activities, and any related services requested by the client.
• Legal Basis: Performance of a contract (Article 6(1)(b) GDPR).
• Retention: For the periods required under applicable civil, commercial, financial, tax, contractual, security, audit, and evidentiary obligations. Retention periods shall generally be calculated from the completion of the relevant service.
• Recipients: Information strictly necessary for the execution of a specific assignment may be accessible to authorised personnel and, where necessary, authorised experts participating in the assignment, all of whom are subject to contractual confidentiality, information security, professional conduct, and data protection obligations. Data will not otherwise be disclosed to third parties except where required by law.

Recruitment and Curriculum Vitae Management

• Purpose: To manage employment applications, recruitment processes, expert applications, talent identification activities, and future professional opportunities within Otus by Golden Owl®.
• Legal Basis: Consent of the data subject (Article 6(1)(a) GDPR) and/or implementation of pre-contractual measures (Article 6(1)(b) GDPR).
• Retention: Personal data will generally be retained for a maximum period of two (2) years unless the candidate requests its deletion earlier or applicable law requires otherwise.
• Recipients: Data will not be disclosed to third parties except where required by law.

Contact Management, Communications, and Business Relationships

• Purpose: To respond to information requests, enquiries, demonstrations, support requests, commercial communications, partnership discussions, operational communications, contractual management activities, and contact relationship management.
• Legal Basis: Consent of the data subject (Article 6(1)(a) GDPR), implementation of pre-contractual measures or performance of a contract (Article 6(1)(b) GDPR), and legitimate interest in maintaining professional and business relationships (Article 6(1)(f) GDPR), including the processing of contact person data as provided under applicable legislation.
• Retention: Data will be retained for as long as necessary to manage the relevant relationship and thereafter for any applicable legal retention periods.
• Recipients: Data will not be disclosed to third parties except where required by law.

Informational Communications and Updates

• Purpose: To provide information regarding Otus by Golden Owl®, its services, activities, publications, events, product updates, industry insights, and related communications.
• Legal Basis: Consent of the data subject (Article 6(1)(a) GDPR). For existing clients, commercial communications may also be based on the legitimate interest permitted under applicable electronic communications legislation, including Article 21.2 of the Spanish Law on Information Society Services and Electronic Commerce (LSSI).
• Retention: Until the data subject withdraws consent or objects to receiving such communications.
• Recipients: Data will not be disclosed to third parties except where required by law.

Contracts, Representatives, and Signatories

• Purpose: To negotiate, formalise, administer, perform, monitor, and manage contractual relationships, including the processing of personal data relating to signatories, legal representatives, employees, contact persons, and other individuals participating in the execution of contractual relationships.
• Legal Basis: Performance of a contract (Article 6(1)(b) GDPR) and legitimate interest in processing professional contact data and representative information in accordance with applicable legislation (Article 6(1)(f) GDPR).
• Retention: For the periods required under applicable civil, commercial, financial, tax, accounting, contractual, and regulatory legislation.
• Recipients: Data will not be disclosed to third parties except where required by law.

Requests Submitted on Behalf of Companies or Organisations

• Purpose: To manage requests for information, services, onboarding, platform access, demonstrations, commercial proposals, contractual negotiations, and other activities submitted on behalf of companies, institutions, public bodies, or other organisations.
• Legal Basis: Legitimate interest in processing professional contact and representative data in accordance with applicable legislation (Article 6(1)(f) GDPR), and where applicable, implementation of pre-contractual measures or performance of a contract (Article 6(1)(b) GDPR).
• Retention: For the periods required under applicable civil, commercial, administrative, contractual, and regulatory obligations.
• Recipients: Data will not be disclosed to third parties except where required by law. Specific programmes, tenders, initiatives, or calls for participation may be subject to their own applicable privacy conditions where expressly indicated.

6. Third-Party Data

If, during your communications with Otus by Golden Owl®, or through the use of the platform and its services, you provide personal data relating to third parties, please note that:

• You may only provide personal data relating to third parties where you have obtained their prior consent where required by applicable law, or where you have another valid legal basis permitting such disclosure. By submitting personal data relating to third parties, you represent and warrant that you have the necessary authority, consent, or legal basis to do so.
• Any individuals whose personal data you provide must be informed, where legally required, of the contents of this Privacy Policy and of the circumstances under which their information is being disclosed to Otus by Golden Owl®.
• Otus by Golden Owl® shall not be responsible for any inaccurate, unlawful, unauthorized, or fraudulent disclosure of third-party personal data carried out by users, clients, experts, or other individuals using the platform.
• The person providing such information shall remain solely responsible for ensuring compliance with all applicable data protection, confidentiality, privacy, and information security obligations relating to the disclosure of third-party data.

7. Optional Nature of Data Provision and Accuracy of Information

The various forms, onboarding procedures, registration processes, contractual documents, and communication channels made available through Otus by Golden Owl® request the information necessary to manage enquiries, registrations, contractual relationships, platform access, service requests, investigations, assignments, payments, compliance procedures, or other activities associated with the platform.

Failure to provide mandatory information may prevent Otus by Golden Owl® from properly processing a request, creating an account, providing a service, fulfilling contractual obligations, complying with applicable legal requirements, or otherwise responding appropriately to the user's request.

Users, clients, experts, representatives, and other individuals providing information through the platform undertake to ensure that all information submitted is accurate, complete, current, lawful, and not misleading.

The data subject shall be responsible for promptly notifying Otus by Golden Owl® of any changes affecting the personal data provided where such changes may be relevant to the relationship between the parties.

8. International Data Transfers

Otus by Golden Owl® seeks, wherever reasonably possible, to process personal data within the European Economic Area (EEA).

Client assignments, investigations, reports, expert deliverables, communications, and operational platform content are generally managed within infrastructure and service environments located within the EEA or otherwise subject to appropriate data protection safeguards.

Certain technical, operational, security, payment, monitoring, support, communication, hosting, cloud infrastructure, or compliance service providers used by Otus by Golden Owl® may nevertheless involve the transfer of limited categories of personal data outside the European Economic Area.

Where such transfers occur, Otus by Golden Owl® implements appropriate safeguards in accordance with Chapter V of the GDPR, including, where applicable:

• Adequacy Decisions adopted by the European Commission
• Standard Contractual Clauses approved by the European Commission
• Binding Corporate Rules
• Certification mechanisms or other legally recognised transfer mechanisms
• Any other safeguards permitted under applicable data protection legislation

Examples of service providers that may process limited categories of personal data include:

• Stripe Payments Europe, Ltd. — payment processing services
• Cloud hosting, infrastructure, monitoring, logging, backup, cybersecurity, communications, authentication, and operational support providers engaged by Otus by Golden Owl®

Otus by Golden Owl® does not sell personal data and does not use client investigations, reports, communications, assignments, expert deliverables, or platform content to train public artificial intelligence models.

9. Corporate Social Media Profiles

Otus by Golden Owl® maintains corporate profiles on various social media and content-sharing platforms.

Any interaction carried out by users through such platforms, including following accounts, commenting, sharing content, reacting to publications, sending messages, or otherwise engaging with such profiles, shall be governed by the privacy policies, terms, and conditions of the respective platform operators, who act as independent data controllers.

Otus by Golden Owl® is not responsible for the processing of personal data carried out by such platforms in connection with user interactions occurring within their services.

Users are encouraged to review the privacy policies and settings of the relevant platforms before interacting with any corporate profile operated by Otus by Golden Owl®.

10. Data Subject Rights

Consent and Withdrawal of Consent

Where the processing of personal data is based on consent, the data subject may withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of any processing carried out prior to the withdrawal.

Rights of Access, Rectification, Erasure, Restriction, Objection, and Data Portability

Data subjects may exercise their rights of access, rectification, erasure, restriction of processing, objection, and, where applicable, data portability, in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD), and any other applicable data protection legislation.

Requests to exercise data protection rights may be submitted to Otus by Golden Owl® by email at otus.goldenowl.ai or by writing to the contact address indicated at the beginning of this Privacy Policy.

Data subjects may use the forms made available by the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) or may request copies of such forms directly from Otus by Golden Owl®.

Otus by Golden Owl® will process and respond to requests relating to data protection rights within the timeframes established by applicable law and, in any event, within a maximum period of one (1) month from receipt of the request, unless a lawful extension is applicable.

Where a data subject considers that their rights have not been adequately addressed, they may lodge a complaint with the competent supervisory authority. In Spain, the competent authority is the Agencia Española de Protección de Datos (AEPD), which can be contacted through www.aepd.es.

Data subjects may exercise their rights at any time, subject to the conditions and limitations established by applicable law.

---

Otus by Golden Owl® is firmly committed to the protection of personal data and to respecting the privacy rights of its users, clients, experts, visitors, business partners, and other individuals whose information may be processed in connection with its activities.

This Privacy Policy forms an integral part of the Terms of Use and should be read together with the Legal Notice, Terms of Use, Cookie Policy, and any other applicable contractual documentation governing the relationship between the user and Otus by Golden Owl®.

Last Updated: June 2026