LEGAL
Legal documents.
Who is behind company2ai, how your data is handled and what applies when you use this site or work with me. Five documents, one page.
01 / LEGAL NOTICE · AVISO LEGAL
Legal notice
1. Who owns this website
In compliance with Article 10 of Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE), the owner of this website and provider of the company2ai service is:
- Owner
- Oleg Mazunin, self-employed professional (autónomo) registered in Spain
- Tax ID (NIF)
- Z1462502Y · EU VAT number ESZ1462502Y
- Address
- Carrer del Doctor Trueta 193, Sant Martí, 08005 Barcelona, Spain
- [your email]
- Trade name
- company2ai
“company2ai” is the commercial name of the consulting and implementation practice of Oleg Mazunin. Any reference to “I”, “me” or “company2ai” in these documents means Oleg Mazunin acting in the course of his professional activity.
2. What this website is for
This website describes the company2ai service for service businesses in Spain and lets you book a free discovery call. It does not sell anything online. Any engagement is agreed separately in a written proposal and service agreement, as described in the Terms of use.
3. Intellectual property
The texts, structure, layout, graphics and code of this website belong to Oleg Mazunin or are used under licence. You may read, link to and quote short extracts of the site with attribution. You may not copy, reproduce or reuse substantial parts of it for commercial purposes without written consent. company2ai is used as a trade name of this practice.
4. Third-party services and links
The booking button opens Google Calendar appointment scheduling, a service operated by Google. Google’s own terms and privacy policy apply inside that booking window. I am not responsible for the content or practices of external websites this site links to.
5. Liability
I keep the information on this site accurate and current, but it is general information and not advice for your specific situation. I do not guarantee that the site is always available or free of errors, and I am not liable for damage caused by circumstances outside my reasonable control, such as network failures or third-party services. Nothing in this notice limits liability that cannot be limited under Spanish law.
6. Applicable law
This website and these documents are governed by Spanish law. Disputes are subject to the courts of Barcelona, Spain, without prejudice to any mandatory forum that applies to consumers.
02 / PRIVACY POLICY · POLÍTICA DE PRIVACIDAD
Privacy policy
This policy explains what personal data I process when you use this website, book a call, write to me or become a client, why I process it and what rights you have. It follows Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD) and Law 34/2002 (LSSI-CE).
1. Who is responsible for your data
The data controller is Oleg Mazunin, NIF Z1462502Y, Carrer del Doctor Trueta 193, 08005 Barcelona, Spain. You can reach me about anything in this policy at [your email]. No data protection officer has been appointed because the law does not require one for a practice of this size and activity. Data protection questions are handled by me personally.
2. What data I collect and where it comes from
| Situation | Data | Source |
|---|---|---|
| You book a discovery call | Name, email address, the time you chose and anything you write in the booking form | You, through the Google Calendar booking page |
| You email or call me | Your contact details and the content of the conversation | You |
| The discovery call itself | Notes about your company, how the work runs today and the process we discuss. Calls are not recorded without asking first. | You, during the call |
| You become a client | Company details, the contact person’s name, role, email and phone, billing and payment details, the contents of proposals and contracts | You and public registers |
| You visit the website | Technical data such as IP address, browser type and the pages requested, kept in hosting logs for security. There are no analytics or advertising trackers on this site. | Your browser |
I only ask for data I need. If you give me data about other people, for example colleagues who will join a call, please make sure they know about this policy.
3. Why I use it and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Scheduling and holding the discovery call, answering your messages | Steps at your request before a contract (Art. 6.1.b) and my legitimate interest in responding to business enquiries (Art. 6.1.f) |
| Preparing proposals, delivering the Founder Workshop, the company2ai project and the monthly retainer | Performance of a contract (Art. 6.1.b) |
| Invoicing, accounting and tax records | Legal obligation (Art. 6.1.c) |
| Following up after a call or proposal, keeping in touch with business contacts | Legitimate interest in maintaining a business relationship (Art. 6.1.f). You can object at any time. |
| Security of the website and of my systems | Legitimate interest (Art. 6.1.f) |
| Anything else I would ask you for specifically, such as publishing a case study with your name | Your consent (Art. 6.1.a), which you can withdraw at any time |
I do not send newsletters or marketing emails unless you have asked for them. I do not use automated decision-making that produces legal effects on you.
4. How long I keep it
- Booking and enquiry data: up to 12 months after our last contact, unless we start working together.
- Client and contract data: for the duration of the contract and afterwards for as long as legal liability can arise, in general 5 years.
- Invoices and accounting records: 6 years under Article 30 of the Spanish Commercial Code and 4 years under the General Tax Law, counted from the end of the relevant year.
- Hosting logs: a short rolling period defined by the hosting provider, normally no more than a few weeks.
5. Who I share it with
I do not sell personal data and I do not share it with anyone for their own marketing. I use a small number of service providers who process data on my behalf under contracts that meet Article 28 GDPR:
- Google (Google Workspace, Calendar, Meet and Gmail) for scheduling, video calls, email and documents.
- The hosting provider of this website.
- My accounting and tax advisers for invoicing and legal filings.
- AI model providers and cloud services, only inside a contracted project and under the Data processing terms agreed with you.
Some of these providers are based in or store data in the United States. Where that happens I rely on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. I may also disclose data when a law, court or public authority requires it.
6. Your team’s data during a project
When I build a company2ai system I work inside your company’s data, which may include personal data of your employees and customers. For that data you are the controller and I act as your processor, following your written instructions. The Data processing terms describe how this works and are signed before I receive any access.
7. Your rights
You can ask me at any time to access the data I hold about you, to correct it, to delete it, to restrict how I use it, to receive it in a portable format and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it without affecting what was done before. Write to [your email] with the subject “Data protection”. I answer within one month and may ask you to confirm your identity.
If you think your data has not been handled correctly, you have the right to complain to the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. I would appreciate the chance to resolve it with you first.
8. Security
Named accounts with two-factor authentication, least-privilege access, encrypted devices and reputable providers. Access to client data is limited to the people working on your project. If a breach ever affects your data I will tell you and, where required, the AEPD.
9. Changes to this policy
This policy is updated when practices or the law change. The date at the top tells you when it was last revised. Material changes that affect existing clients are communicated by email.
03 / COOKIES POLICY · POLÍTICA DE COOKIES
Cookies policy
1. The short version
This website does not set cookies of its own, and it does not use analytics, advertising or social-media trackers. That is why there is no cookie banner. The only third party involved is Google, whose appointment scheduling service powers the booking button.
2. What cookies are
Cookies are small text files that a website stores in your browser. Similar technologies such as local storage and pixels are covered by the same rules: Article 22.2 of Spanish Law 34/2002 (LSSI-CE) and the guidance of the Spanish Data Protection Authority (AEPD). Cookies that are strictly necessary for a service you asked for do not need your consent. All other cookies do.
3. Cookies used on this site
| Provider | Purpose | Type | Consent |
|---|---|---|---|
| company2ai (this site) | None. The site stores nothing in your browser. | – | Not applicable |
| Google Calendar appointment scheduling | Opens the booking window where you pick a time when you click the booking button. Google may set its own technical and session cookies to make the booking work and to protect it against abuse. | Third-party, technical | Not required for strictly necessary cookies. Any other cookies are governed by Google’s policy, shown inside the booking window. |
Google’s cookie information is available at policies.google.com/technologies/cookies. If you prefer not to use Google, write to [your email] and we will schedule the call by email.
4. How to control cookies
You can block or delete cookies in your browser settings. Instructions for the most common browsers: Chrome, Safari, Firefox, Edge. Blocking cookies may stop the Google booking window from working. In that case book by email.
5. If this ever changes
If analytics or any other non-essential cookies are added in the future, a consent banner will be shown first, where rejecting is as easy as accepting, following the AEPD cookies guide, and this page will be updated.
04 / TERMS OF USE · CONDICIONES DE USO
Terms of use
1. What these terms cover
These terms govern your use of this website. They are not the contract for the company2ai service. The Founder Workshop, the company2ai project and the monthly retainer are each governed by a written proposal and service agreement signed by both parties. If anything here conflicts with a signed agreement, the agreement prevails.
2. Information on the site is not a binding offer
Descriptions, timelines, deliverables and prices on this website are indicative. They help you decide whether to book a call. A binding offer exists only when you receive a written proposal and accept it. Prices are shown in euros and exclude VAT unless stated otherwise. VAT terms, infrastructure and subscription costs, extra data sources and work beyond the agreed hours are set out in the proposal.
3. The discovery call
The discovery call is free and creates no obligation for either side. On the call we may discuss confidential details of your business. Everything you tell me is treated as confidential and used only to assess whether and how I can help. If company2ai is not the right fit, I will say so.
4. Who the service is for
company2ai is a service for companies and professionals acting in the course of their business. It is not intended for consumers. Where a consumer nevertheless uses this site, the rights that Spanish and EU consumer law grants them are not affected by these terms.
5. Using the site
You may use the site to learn about the service and to book a call. You may not use it in a way that damages it, interferes with other users, attempts to gain unauthorised access, or scrapes its content for commercial purposes. Booking a call with false details or with no intention of attending is not permitted.
6. Intellectual property
The content of this site belongs to Oleg Mazunin as described in the Legal notice. Systems, documents and workflows built for a client belong to that client from the moment they are paid for, as set out in the service agreement. I keep the right to reuse my general know-how, methods and templates.
7. Third-party services
Booking runs on Google Calendar appointment scheduling. Google’s terms apply inside the booking window. I am not responsible for interruptions of Google’s service. If the booking page does not work, write to [your email].
8. Liability
The website is provided as it is. I do not guarantee uninterrupted availability, and I am not liable for indirect losses arising from the use of the site or from reliance on general information published on it. Liability under a service agreement is governed by that agreement. Nothing here excludes liability for fraud, wilful misconduct or any liability that Spanish law does not allow to be excluded.
9. Changes
These terms and the website may be updated at any time. The version published on the site at the time you use it applies.
10. Governing law and jurisdiction
These terms are governed by Spanish law. Any dispute is submitted to the courts of the city of Barcelona, Spain, except where a mandatory rule assigns jurisdiction elsewhere.
05 / DATA PROCESSING TERMS · ENCARGO DE TRATAMIENTO
Data processing terms
Building a company2ai system means working inside your company’s data: emails, deals, documents, customer records. This page sets out how I handle that data as your processor. The full Data Processing Agreement (DPA) under Article 28 GDPR is signed together with the service agreement, before I receive any access, and prevails over this summary.
1. Roles
For the data in your systems you are the controller: you decide why and how it is used. I am the processor: I act only on your documented instructions, which are the proposal, the service agreement and written instructions during the project. For my own client records, such as your contact and billing details, I am the controller, as described in the Privacy policy.
2. What the processing covers
The DPA defines, per project: the subject matter and duration, the nature and purpose of the processing, the types of personal data and the categories of data subjects, for example employees, customers, suppliers and leads. Nothing outside that scope is connected. As a rule only the data needed for the first agreed process is connected, and the system grows layer by layer from there.
3. What I commit to
- Instructions only. Personal data is processed only for the purposes agreed with you and never for my own purposes. If an instruction appears to break data protection law, I tell you before acting.
- Confidentiality. I and anyone I bring into your project are bound by confidentiality. Access is limited to the people who need it.
- Security. Named accounts, two-factor authentication, least-privilege access, encrypted devices and secure channels. No copies of your data are kept outside the environments agreed in the project, and working copies are deleted when the project ends.
- Sub-processors. Cloud and AI providers used in your project are listed in the DPA annex and approved by you in advance. You are informed before one is added or replaced, and you may object. I remain responsible for them.
- AI providers. AI models are used only under business or API terms under which the provider does not use your data to train its models. Processing in the EU or under adequate safeguards is preferred, and sensitive data is kept out of the models or anonymised where the process allows.
- Helping you meet your obligations. I help you respond to data subject requests, carry out impact assessments where needed, and notify you of any personal data breach without undue delay so that you can meet the 72-hour deadline with the authority.
- End of the project. The system, its documentation and the data stay in your accounts. On request I delete or return any data I still hold and confirm it in writing, unless the law obliges me to keep it.
- Audits. I give you the information you need to check compliance and allow reasonable audits, with notice and at your cost.
4. What I ask of you
- Make sure there is a lawful basis for the processing you ask me to carry out and that the people concerned have been informed.
- Give me only the access I need, through your own accounts, so that you remain the owner of every system, key and log.
- Name a contact person who can give instructions and answer questions during the project.
5. Where the system lives
The company2ai system is set up in your own accounts and infrastructure, and infrastructure costs are paid by you directly. This is a design choice, not a detail: when the project ends you keep the keys, and you can continue with me, with someone else or on your own.
6. Contact
For anything related to data processing, including breach reports, write to [your email] with the subject “Data protection”. You can also raise concerns with the Spanish Data Protection Authority (AEPD).