Language

English Español

Theme

Contact

info@navat.ai

Privacy Policy

Last updated: September 3, 2026

1. Introduction

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter, GDPR) and applicable data protection legislation, users of the website www.navat.ai are hereby informed about the personal data protection policy.

GRUPO NAVATEA, S.L. is committed to guaranteeing the privacy and protection of personal data of all users who visit and use the website, adopting the necessary technical and organizational measures to prevent loss, misuse, alteration, unauthorized access, and theft of provided data.

2. Data controller

  • Controller: GRUPO NAVATEA, S.L.
  • Tax ID (CIF): B85372928
  • Registered office: C/ Los Naranjos, 21, 28922 Alcorcón, Madrid (Spain)
  • Commercial Registry: Registered in the Commercial Registry of Madrid, volume 30,736, folio 185, section 8, sheet M-553118
  • Share capital: €3,012.00
  • Website domain: www.navat.ai
  • Email: privacy@navat.ai
  • Activity: Professional services in IT consulting, software development, and cloud architecture

3. Principles applicable to personal data processing

The processing of users' personal data will be carried out in accordance with the following principles established in the GDPR:

  • Lawfulness, fairness, and transparency: User consent will be required at all times with completely transparent information about the purposes for which personal data is collected.
  • Purpose limitation: Data will be collected for specific, explicit, and legitimate purposes.
  • Data minimization: Only data strictly necessary in relation to the purposes for which it is processed will be collected.
  • Accuracy: Data must be accurate and always up to date.
  • Storage limitation: Data will only be kept in a form that permits identification of data subjects for as long as necessary for the purposes of processing.
  • Integrity and confidentiality: Data will be processed in a manner that ensures its security and confidentiality.
  • Proactivity: The data controller will be responsible for ensuring compliance with all the above principles.

4. Personal data collected and purpose of processing

4.1. Contact forms

When a user uses the contact forms available on the website, the following data is collected:

  • Data collected: Name, surname, email, message, and any additional information the user voluntarily chooses to provide.
  • Purpose: To respond to inquiries and information requests made by users.
  • Legal basis: Consent of the data subject (Art. 6.1.a GDPR).
  • Retention period: Data will be retained as long as necessary to respond to the inquiry and thereafter for the period established by applicable legislation.

4.2. Blog comments

Blog articles accept comments. Submitting one collects the following data:

  • Data collected: A name or pseudonym, an e-mail address and the text of the comment.
  • What is published: Only the name, the text and the date. The e-mail address is never published and is not used to send marketing of any kind.
  • Purpose: Publishing the comment on the article and being able to reply to it.
  • Legal basis: Consent of the data subject (Art. 6.1.a GDPR), given by submitting the form.
  • Moderation: Comments are not published automatically. They are held for review and appear only if approved.
  • Retention: For as long as the article remains published, or until the comment's author asks for it to be deleted.
  • Provenance: Comments older than 4 September 2026 were originally published on daniloaz.com, a site of the same controller, and were kept when the content moved to this domain. There has been no disclosure to a third party.

4.3. Website navigation

During website navigation, data may be collected automatically:

  • Data collected: IP address, browser type, browser language, pages visited, date and time of access.
  • Purpose: Statistical analysis of website usage, improvement of user experience, and website security.
  • Legal basis: Legitimate interest of the controller (Art. 6.1.f GDPR).
  • Retention period: Server logs are kept for fourteen days and are then deleted automatically. They are not cross-matched with any other information and are not used to build profiles.

4.4. Local storage (localStorage)

The website uses browser localStorage to store user preferences (language, visual theme) only when the user grants express consent through the cookie consent banner.

  • Data collected: Language preferences, visual theme (light/dark mode), informational banner status.
  • Purpose: To improve user experience by remembering preferences on future visits.
  • Legal basis: Express consent of the user (Art. 6.1.a GDPR).
  • Retention period: Data remains in the user's browser until manually deleted or consent is withdrawn.

6. Data recipients

Personal data collected will not be transferred to third parties, except by legal obligation.

Everything the page is made of is served from this same domain, typefaces and icons included. The only outside server your browser connects to is that of the audience measurement service described below.

The only provider involved is the one hosting the server:

  • Amazon Web Services EMEA SARL: web server hosting, in European Union data centres (Ireland). Acts as a data processor under the corresponding processing agreement.

To know how many visits the site receives and which pages are read, it uses Overtracking, a cookieless analytics service: it writes nothing to your device and reads nothing from it. That is why this site needs no consent banner.

Four fields are sent per visit: the page address, the address you came from if there is one, the browser window size and the server response code. On receiving them the service also learns your IP address, as does any server a browser connects to. No identifier is created, so nobody can be recognised from one visit to the next, or followed to other websites.

The legal basis is the company's legitimate interest in knowing how its own website is used (art. 6.1.f GDPR). You may object to this processing by writing to the contact address given in section 1. Overtracking acts as a data processor.

7. International data transfers

No international data transfers take place. The server delivering this site is in Ireland, inside the European Economic Area, and no other provider is involved in browsing it. Should one outside the EEA ever be added, it would rely on the safeguards in Chapter V of the GDPR and would be stated here before that happened.

8. User rights

Any user whose data is subject to processing may exercise the following rights:

8.1. Right of access

The user has the right to obtain confirmation about whether personal data concerning them is being processed and, if so, the right of access to personal data and information about the processing.

8.2. Right to rectification

The user has the right to obtain rectification of inaccurate personal data concerning them and to have incomplete personal data completed.

8.3. Right to erasure ("right to be forgotten")

The user has the right to obtain erasure of personal data concerning them when certain circumstances established in the GDPR occur.

8.4. Right to restriction of processing

The user has the right to obtain restriction of processing of their personal data when certain conditions established in the GDPR are met.

8.5. Right to data portability

The user has the right to receive personal data concerning them in a structured, commonly used, and machine-readable format, and to transmit it to another controller.

8.6. Right to object

The user has the right to object at any time, on grounds relating to their particular situation, to processing of personal data concerning them based on the legitimate interest of the controller.

8.7. Right not to be subject to automated decisions

The user has the right not to be subject to a decision based solely on automated processing, including profiling.

8.8. Right to withdraw consent

The user has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

How to exercise your rights

To exercise any of these rights, users can contact the data controller by:

The user must clearly indicate which right they wish to exercise and provide a copy of a document proving their identity (ID/Passport).

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, users have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work, or place of the alleged infringement, if they consider that the processing of personal data concerning them infringes the GDPR.

In Spain, the supervisory authority is the Spanish Data Protection Agency (AEPD):

  • Spanish Data Protection Agency (AEPD)
  • Address: C/ Jorge Juan, 6, 28001 Madrid, Spain
  • Phone: +34 901 100 099 / +34 912 663 517
  • Website: www.aepd.es
  • Electronic office: sedeagpd.gob.es

10. Security measures

The data controller has adopted the necessary technical and organizational measures to guarantee the security of personal data and prevent its alteration, loss, processing, or unauthorized access, taking into account the state of technology, the nature of the stored data, and the risks to which they are exposed.

Security measures implemented include:

  • Encryption of communications through HTTPS/SSL protocol.
  • Restricted access to personal data only to authorized personnel.
  • Regular data backups.
  • Protection systems against unauthorized access and malicious software.
  • Secure password policies and access controls.

11. Privacy policy updates

The data controller reserves the right to modify this privacy policy to adapt it to legislative, jurisprudential, or industry practice developments.

When significant changes occur in this privacy policy, users will be notified through the website or, when possible, by email provided by the user.

12. Contact

For any questions, clarifications, or comments about this privacy policy, you can contact:

  • Controller: GRUPO NAVATEA, S.L.
  • Address: C/ Los Naranjos, 21, 28922 Alcorcón, Madrid (Spain)
  • Email: privacy@navat.ai
  • Website: www.navat.ai