Freshlab as a data processor
When we deliver our services, namely the kAIra Tools platform, AI literacy training (Art. 4 of the AI Act) or the installation of local AI on-premise, we may process personal data on behalf of your company. In those cases, your company is the data controller and Freshlab Iberia S.L.U. acts as the data processor, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).
This page describes that processing relationship. The processing of data from visitors to this website, where Freshlab acts as the controller, is explained in our Privacy Policy.
Data processing agreement
Before we process any data, we sign a Data Processing Agreement (Art. 28 GDPR) with each client, governing the purpose, instructions, confidentiality, security measures and deletion of the data. You can review our model, with the Freshlab details filled in and the client fields left open:
Download model agreement (PDF)
The model is drafted in Spanish (Spanish law as governing law). A signed version in your language is available on request.
Security measures
- Private infrastructure located within the European Union, with no public cloud (AWS, Azure, Google) and no external AI providers.
- No external sub-processors and no international data transfers.
- Encrypted access (HTTPS/TLS), a signed evidence dossier and a SHA-256 hash chain that makes any later alteration detectable.
- Deletion of personal data 90 days after the service ends. The signed dossier, portable and verifiable offline, remains with the client.
- Automatic and regular backups.
- Notification of security incidents within a maximum of 48 hours, to assist the responsible company in meeting its obligations (Art. 33 and 34 GDPR).
Requests
To request the signed processing agreement or the detailed security measures sheet, write to us at info@freshlab.es.
Last updated: July 2026 · Privacy · Legal Notice · Home