Privacy Notice

Last updated: 24/06/2026

Nairo is committed to protecting and respecting your privacy.

This Privacy Notice explains how People Future S.L., operating under the commercial name Nairo (“Nairo”, “we”, “us”, or “our”), processes personal data in connection with our website, private MVP, platform access, communications, and related services.

Nairo processes personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (“GDPR”) where applicable.

Nairo may also process customer-provided content, documents, prompts, outputs, metadata, and other information through the platform. This Privacy Notice applies to that information to the extent that it includes or constitutes personal data.

This Privacy Notice applies to:

• visitors to our website;
• users of the Nairo platform or private MVP;
• representatives of our customers, prospective customers, partners, and suppliers; and
• individuals who communicate with us in connection with our services.

Our role when processing personal data

Depending on the context, Nairo may act either as a data controller or as a data processor when processing personal data.

Nairo acts as a data controller when People Future S.L., operating under the commercial name Nairo, determines the purposes and means of processing personal data for our own business operations, including:

• managing our website, private MVP, platform access, and related services;
• administering customer, prospective customer, partner, and supplier relationships;
• handling commercial administration, support, and communications;
• improving our services, user experience, security, and reliability;
• complying with legal, regulatory, tax, accounting, or contractual obligations; and
• carrying out marketing and business development activities where permitted by law.

Nairo acts as a data processor when we process personal data on behalf of a customer through that customer’s use of the Nairo platform, private MVP, or related services. In those cases, the customer organization is the data controller and remains responsible for determining the purposes, legal basis, and lawful instructions for processing personal data uploaded, submitted, or managed within its workspace.

When acting as a processor, Nairo processes personal data only in accordance with the applicable customer agreement, documented customer instructions, and, where required or agreed, a Data Processing Agreement (“DPA”).

If you use Nairo through an organization, such as your employer or another customer organization, that organization may be responsible for responding to certain requests regarding personal data processed within its workspace.

If you have questions about how your personal data is processed, you may contact us using the details provided at the end of this Privacy Notice.

Personal data and other information we process

We may collect and process the following categories of information depending on how you interact with Nairo and our services. Some of this information may constitute personal data under applicable data protection laws, while other information may relate to business documents, operational content, technical metadata, or non-personal information.

Website and request access information

• name;
• work email address;
• company name;
• role or job title;
• message or enquiry details;
• meeting booking information, where applicable.

Account and profile information

• name;
• work email address;
• company name;
• job title;
• authentication information and account identifiers;
• workspace role and permissions.

Usage and activity information

• platform activity and interaction data;
• search queries and prompts, where they relate to an identified or identifiable individual;
• project and workspace activity;
• support requests and feedback;
• AI interactions and outputs, where they relate to an identified or identifiable individual.

Technical and device information

• IP address;
• browser type and version;
• operating system;
• device information;
• session and log data;
• approximate location based on IP address.

Communications

We may process information shared when contacting us by email, forms, support channels, meetings, or other communications.

Customer-provided content

Customers and users may upload or provide documents, files, datasets, prompts, outputs, or other content through the services. This content may include business information, confidential information, technical information, operational information, and, in some cases, personal data.

Where customer-provided content includes personal data, Nairo processes such personal data in accordance with this Privacy Notice, the applicable customer agreement, documented customer instructions, and, where applicable, a Data Processing Agreement.

Special categories of personal data

Nairo does not intentionally collect special categories of personal data, such as health data, biometric data, political opinions, religious beliefs, trade union membership, or other sensitive categories under applicable data protection laws, unless such data is provided by customers or users in connection with their use of the services.

Customers and users are responsible for ensuring that they have an appropriate legal basis and authority to provide any special category personal data through the services.

Users should not provide special category personal data unless it is necessary for the relevant workflow and they are authorized to do so.

How we use personal data and service information

We use personal data and service-related information for the following purposes, to the extent applicable depending on how you interact with Nairo and the services.

To provide and operate the website, private MVP, platform access, and related services

Including:

• creating and managing user accounts;
• enabling workspace collaboration and document management;
• operating AI-powered platform features;
• maintaining platform security and performance; and
• providing customer support.

To improve and develop our services

Including:

• analyzing platform usage and performance;
• identifying bugs, errors, and security issues;
• improving user experience and platform functionality; and
• developing new features and capabilities.

Where we use service-related information to improve Nairo, we do so in a manner consistent with applicable customer agreements, documented instructions, and confidentiality obligations.

Where customer-provided content includes personal data, Nairo uses such personal data only in accordance with the applicable customer agreement, documented customer instructions, and, where applicable, a Data Processing Agreement.

To communicate with users and customers

Including:

• responding to support requests and inquiries;
• sending service-related notifications;
• providing onboarding and account assistance; and
• communicating important updates regarding the platform or our services.

To maintain security and prevent misuse

Including:

• detecting fraud, abuse, unauthorized access, or misuse of the platform;
• monitoring system integrity and availability; and
• enforcing our policies and contractual terms.

To comply with legal obligations

Including:

• complying with applicable laws and regulations;
• responding to lawful requests from authorities; and
• establishing, exercising, or defending legal claims.

AI and model training

Nairo does not use Customer Data, including uploaded documents, prompts, outputs, workspace content, or AI interactions, to train public or shared artificial intelligence models.

Where third-party AI providers are used, Nairo uses providers, configurations, and contractual terms intended to prevent Customer Data from being used to train public or shared models, subject to the applicable provider terms and customer agreement.

Legal basis for processing

Where applicable under data protection laws such as the GDPR, Nairo relies on the following legal bases when processing personal data as a data controller.

Performance of a contract

We process personal data where necessary to provide the Nairo website, private MVP, platform access, and related services, fulfill our contractual obligations, administer customer relationships, and communicate with users and customers regarding the services.

Legitimate interests

We process personal data where necessary for our legitimate business interests, including:

• operating, maintaining, and improving the website, platform, and related services;
• maintaining platform security and reliability;
• preventing fraud, abuse, unauthorized access, and misuse;
• communicating with customers, users, prospective customers, partners, suppliers, and business contacts;
• developing and improving our services; and
• establishing, exercising, or defending legal claims.

When relying on legitimate interests, we consider and balance any potential impact on individuals’ rights and freedoms.

Compliance with legal obligations

We may process personal data where necessary to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

Consent

Where required by law, we rely on consent for specific processing activities, such as certain marketing communications or non-essential cookies. Users may withdraw consent at any time where applicable.

Where Nairo acts as a data processor on behalf of a customer, the customer is responsible for determining the appropriate legal basis for the processing of personal data within its workspace or customer-provided content.

Children’s data

Nairo’s services are not intended for individuals under the age of 18, and we do not knowingly collect personal data from children.

If we become aware that personal data has been collected from a child in violation of applicable law, we will take reasonable steps to delete such information.

Data sharing and subprocessors

Nairo may share personal data, Customer Data, and service-related information with trusted third-party service providers and subprocessors that support the operation, delivery, security, support, and improvement of our website, private MVP, platform access, and related services.

These providers may include:

• cloud infrastructure providers;
• authentication and identity providers;
• monitoring and operational logging providers;
• customer support and communication tools;
• email and notification providers;
• analytics providers, where used; and
• artificial intelligence and language model providers integrated into the platform.

Nairo only shares information with third-party providers where necessary for the provision, operation, security, support, or improvement of the services, and subject to appropriate contractual, confidentiality, data protection, and security obligations.

Where Nairo acts as a data processor on behalf of a customer, Nairo engages subprocessors in accordance with the applicable customer agreement, documented customer instructions, and, where applicable, a Data Processing Agreement.

Nairo seeks to use AI providers that offer contractual commitments restricting the use of Customer Data for training public or shared artificial intelligence models.

A current list of subprocessors used by Nairo is available in our Subprocessors List.

We may also disclose personal data:

• where required by law or valid legal process;
• to protect the rights, security, or integrity of Nairo, our customers, or users; or
• in connection with a merger, acquisition, financing, restructuring, or sale of all or part of our business.

Nairo does not sell personal data to third parties.

International data transfers

Nairo may process, store, or transfer personal data in countries outside the country where the data was originally collected, including outside the European Economic Area (“EEA”).

Where Nairo transfers personal data internationally, we take appropriate measures designed to ensure that such personal data remains protected in accordance with applicable data protection laws.

Depending on the circumstances, these measures may include:

• relying on adequacy decisions issued by the European Commission or other competent authorities;
• entering into Standard Contractual Clauses approved by the European Commission;
• relying on other lawful transfer mechanisms available under applicable data protection laws, where relevant; and
• implementing additional contractual, technical, and organizational safeguards where appropriate.

Where Nairo acts as a data processor on behalf of a customer, international transfers of personal data are also governed by the applicable customer agreement, documented customer instructions, and, where applicable, a Data Processing Agreement.

If you would like more information regarding international data transfers or the safeguards applied by Nairo, you may contact us using the contact details provided at the end of this Privacy Notice.

Data retention

Nairo retains personal data only for as long as necessary to fulfill the purposes described in this Privacy Notice, including to provide the services, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements.

The specific retention period may vary depending on:

• the nature and category of the personal data;
• the purpose for which the personal data was collected or processed;
• whether the data is processed by Nairo as a controller or as a processor on behalf of a customer;
• applicable legal, regulatory, accounting, tax, or contractual requirements;
• legitimate business, security, and operational needs; and
• customer instructions and applicable customer agreements.

For website enquiries and business communications, retention periods will generally depend on the nature of the relationship and our legitimate business needs.

Customer Data processed by Nairo on behalf of customers is retained in accordance with the applicable customer agreement or documented customer instructions.

Certain technical logs, backup copies, and security records may be retained for limited periods where necessary for security, continuity, fraud prevention, troubleshooting, legal compliance, or operational purposes.

When personal data is no longer required, Nairo will delete, anonymize, or securely dispose of the information using reasonable technical and organizational measures.

Security measures

Nairo implements reasonable technical, organizational, and administrative security measures designed to protect personal data and Customer Data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include:

• encryption of data in transit and at rest, where available and appropriate;
• access controls and role-based permissions;
• authentication and identity management controls;
• infrastructure monitoring and logging;
• backup and recovery procedures;
• internal security and confidentiality practices; and
• controlled access to operational systems and customer-related environments.

Nairo’s security measures are designed to support the confidentiality, integrity, and availability of the services and the information processed through them.

While Nairo works to protect personal data, Customer Data, and the security of the platform, no method of transmission, processing, or storage is completely secure, and Nairo cannot guarantee absolute security.

Users are responsible for maintaining the confidentiality of their account credentials and for using the platform in a secure manner.

Your rights

Subject to applicable data protection laws, including the GDPR where applicable, you may have the following rights regarding your personal data.

Right of access

You may request confirmation as to whether Nairo processes personal data about you and request access to the personal data we hold about you.

Right to rectification

You may request that inaccurate or incomplete personal data be corrected or updated.

Right to erasure

You may request the deletion of your personal data where:

• the personal data is no longer necessary for the purposes for which it was collected or processed;
• you withdraw consent where processing is based on consent and there is no other legal basis for processing;
• you object to certain processing activities and no overriding legitimate grounds exist;
• the personal data has been unlawfully processed; or
• deletion is required under applicable law.

Please note that Nairo may retain certain information where required or permitted by law, including where necessary to comply with legal obligations, resolve disputes, maintain security, or establish, exercise, or defend legal claims.

Right to restriction of processing

You may request that Nairo restrict the processing of your personal data in certain circumstances, including where:

• you contest the accuracy of the personal data;
• the processing is unlawful and you request restriction instead of deletion;
• Nairo no longer needs the personal data but you require it for legal claims; or
• you have objected to processing while we assess whether overriding legitimate grounds exist.

Right to object

Where processing is based on legitimate interests, you may object to the processing of your personal data in certain circumstances. Nairo may continue processing where it demonstrates compelling legitimate grounds for the processing or where processing is necessary for the establishment, exercise, or defence of legal claims.

Right to data portability

Where applicable, you may request a copy of your personal data in a structured, commonly used, and machine-readable format and request that it be transferred to another provider where technically feasible.

Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Right not to be subject to solely automated decisions

Where applicable, you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Nairo is designed to support human-reviewed and professionally supervised workflows. Nairo is not designed for AI-generated outputs to be used as the sole basis for decisions producing legal or similarly significant effects concerning individuals without appropriate human review and oversight.

Right to lodge a complaint

You may have the right to lodge a complaint with the competent data protection authority in your jurisdiction if you believe that Nairo’s processing of your personal data violates applicable law.

If you are located in Spain, you may contact the Spanish Data Protection Agency (Agencia Española de Protección de Datos, “AEPD”).

How to exercise your rights

If you wish to exercise any of these rights, please contact us using the contact details provided below.

We may need to verify your identity before responding to your request. We will respond to your request within the timeframe required by applicable law. Under the GDPR, this is generally within one month of receipt of the request, although this period may be extended where permitted by law, for example where the request is complex or where we receive multiple requests.

Cookies and analytics

Nairo may use cookies, similar technologies, and analytics tools to operate, secure, and improve our website and platform experience.

These technologies may be used to:

• maintain user sessions and authentication;
• remember preferences and settings;
• analyze usage and performance;
• understand platform traffic and engagement; and
• improve platform functionality and user experience.

Where required by applicable law, Nairo will request consent before using non-essential cookies or similar tracking technologies.

Users may manage or disable cookies through their browser settings, although doing so may affect certain platform functionality.

Where required, further information will be provided through a Cookie Notice, consent banner, or similar mechanism.

Changes to this Privacy Notice

Nairo may update or modify this Privacy Notice from time to time to reflect changes to our services, legal obligations, security practices, or business operations.

When material changes are made, Nairo will take reasonable steps to provide notice where appropriate, including through the platform, website, or other communication channels.

The “Last updated” date at the top of this Privacy Notice indicates when the latest changes became effective.

The updated Privacy Notice will apply from the effective date indicated in the notice or otherwise communicated to users.

Contact details

If you have any questions regarding this Privacy Notice, Nairo’s processing of personal data, or if you wish to exercise your data protection rights, you may contact us at:

People Future S.L.
Commercial name: Nairo
NIF: B70950670
Calle San Germán 10
28020, Madrid, Spain
Email: privacy@nairobilabs.com
Website: https://nairobilabs.com

If applicable under relevant data protection laws, you may also have the right to contact or lodge a complaint with your local data protection authority.