Website Legal Information and Terms of Use

First – Law on Information Society Services

In compliance with Article 10 of Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), we inform users of the following details:

Second – Purpose of the Website

The provider, responsible for the website, makes this document available to users in order to comply with the obligations provided in Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), and to inform all users of the website about its terms of use.

Invofox is a B2B SaaS solution for automated document digitization. The purpose of the website is to provide advertising and informational content about the services offered, allowing users to request or expand information, schedule a demo, and resolve any questions they may have.

Any personal data you provide for these purposes will be processed exclusively to fulfill the information request or, if you proceed with service contracting, for proper administrative management and service follow-up, including billing and payment management.

If the service is contracted, the user/client will receive access credentials to a restricted area, and will be responsible for safeguarding these credentials, as outlined in the Privacy Policy.

Therefore, every person accessing this website assumes the role of user and agrees to strictly comply with the provisions set forth herein, as well as with any other applicable legal regulations.

The provider reserves the right to modify any information that may appear on the website, without prior notice or obligation to inform users, with publication on the provider's website being considered sufficient.

Third – Liability

The provider is not responsible for any information published on its website if it has been altered or entered by an unrelated third party.

The website may redirect to third-party websites. Since the provider cannot always control the content introduced by third parties, it does not assume any responsibility for such content. However, the provider declares that it will immediately remove any content that may violate national or international laws, morality, or public order, and will notify the competent authorities of such content.

The provider is not responsible for information and content stored, by way of example but not limited to, in forums, chats, blogs, comments, social networks, or any other medium that allows third parties to post content independently on the provider's website. Nonetheless, in compliance with Articles 11 and 16 of the LSSI-CE, the provider makes itself available to all users, authorities, and security forces, and actively collaborates in the removal or, if necessary, blocking of any content that could affect or violate national or international legislation, third-party rights, or morality and public order. If a user believes any content on the website falls into this category, they are encouraged to notify the site administrator immediately.

This website has been reviewed and tested to function correctly. In principle, its correct operation can be guaranteed 24 hours a day, 365 days a year. However, the provider does not rule out the possibility of programming errors or events of force majeure, natural disasters, strikes, or similar circumstances that make access to the website impossible.

Fourth – Intellectual and Industrial Property

This website, including but not limited to its programming, editing, compilation, and other elements necessary for its operation, designs, logos, text, and/or graphics, is the property of the provider or is used under express license or authorization by the authors. All contents are protected by intellectual and industrial property regulations and are duly registered in the corresponding public records.

Regardless of the purpose, total or partial reproduction, use, exploitation, distribution, and marketing require prior written authorization by the provider. Any unauthorized use will be considered a serious infringement of the author's intellectual or industrial property rights.

Designs, logos, text, and/or graphics not owned by the provider that may appear on the website belong to their respective owners, who are responsible for any dispute that may arise regarding them. In any case, the provider has obtained express and prior authorization from them.

The provider does not authorize third parties to directly redirect to specific content on the website. Any links must point to the provider's main website.

The provider acknowledges the corresponding industrial and intellectual property rights of the owners. The mere mention or appearance of such content does not imply any responsibility, sponsorship, or endorsement by the provider.

For any inquiries regarding possible infringements of intellectual or industrial property rights or website content, please contact: contacto@invofox.com

Fifth – Accuracy of Information and Minors

All information provided by the User must be truthful. The User guarantees the authenticity of the data submitted through service subscription forms. It is the User's responsibility to keep all information provided to KINEQUO S.L. up to date to reflect their actual situation. The User is solely responsible for any false or inaccurate statements made and any harm caused to the provider or third parties.

With regard to the use of the website's services, minors must always obtain prior consent from parents, guardians, or legal representatives, who are ultimately responsible for the actions of the minors in their care. Responsibility for determining the specific content accessed by minors rests with them. Mechanisms such as software, filters, and blocks should be installed on their devices to limit the content minors can access. Though not infallible, these tools are useful for restricting access to inappropriate material.

Sixth – Obligation to Use the Website Properly

The User agrees to use the website in accordance with the law, this Legal Notice, morality, and good customs. Accordingly, the User must refrain from using the website for illegal or prohibited purposes, or in any way that may harm the rights and interests of third parties or damage, disable, overload, or hinder the normal use of computer systems or content stored by the provider.

Seventh – Applicable Law and Jurisdiction

To resolve all disputes or issues related to this website or the activities carried out on it, Spanish law shall apply, and the parties expressly submit to it. All conflicts arising from or related to the use of this website shall be resolved by the Courts and Tribunals of Madrid.

Data Controller Information

You may also contact our Data Protection Officer (DPO) directly at the following email address: DPO.

Applicable Regulations

Our Privacy Policy has been designed in accordance with the EU General Data Protection Regulation (GDPR) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), and Organic Law 3/2018 of December 5, on the Protection of Personal Data and Guarantee of Digital Rights.

By providing us with your data and accepting our Privacy Policy, you declare that you have read and understood it, and you give your clear and explicit consent for the processing of your personal data in accordance with the purposes and terms stated herein.

The Company may modify this Privacy Policy in order to adapt it to legislative, jurisprudential, or interpretative changes from the Spanish Data Protection Agency.

These privacy conditions may be supplemented by the Legal Notice, Cookie Policy, and the General Terms and Conditions that, where appropriate, apply to specific products or services, in the event that such access involves any particularity regarding the protection of personal data.

Data Protection Officer (DPO)

The following entity has been appointed as the Data Protection Officer:

Principles According to the European General Data Protection Regulation (GDPR)

We are committed to processing the personal data (hereinafter referred to as "data") provided to us in accordance with the following principles established by the General Data Protection Regulation (GDPR):

Purpose of Personal Data Processing

The processing of your personal data is carried out for the following purposes:

In any case, you will always be guaranteed the option to express your wish to unsubscribe from this type of communication at any time, and the company will process your request immediately.

Use of Cookies

When you visit or log in to our website, we and our partners may use cookies or similar tools to link your activity to other information they already have about you, such as your email address or home address. This information may then be used to send you marketing messages or other communications to those addresses. You can opt out of receiving this advertising by visiting: https://app.retention.com/optout

You also have the option to object to the collection of your personal data in accordance with the General Data Protection Regulation (GDPR). To exercise this right, please visit: https://www.rb2b.com/rb2b-gdpr-opt-out.

You can find more information about how email-based retargeting and Retention.com work by visiting: https://support.retention.com/en/articles/8826312-how-retention-com-attribution-works

-California Residents:

If you live in California, you have the right to request that companies do not sell your personal information. To do this, simply send an email to support@retention.com. In your message, please indicate that you want to stop the sale of your personal information. You may also designate someone else to send this request on your behalf. Be sure to include the email address of the person wishing to opt out. Any personal information you share in your email will be used solely to process your request.

You can find the CCPA Opt-Out Form here: https://app.retention.com/ccpa_details/

-European Residents:

Retention.com carefully follows GDPR privacy rules. To support this, we use a tool in our scripts called geofencing. This tool works through your browser and helps in two important ways:

Data Retention Period

We will retain your personal data from the moment you grant us your consent until you revoke it or request a restriction on processing. In such cases, your data will be blocked during the limitation periods for any obligations that may arise from the processing and/or for the legally applicable periods. During this time, the data will be kept available to the competent authorities for the purpose of addressing any potential liabilities resulting from the processing.

In accordance with Article 17.3 of the GDPR, data blocking is understood as the right of "retention" as an exception to the obligation of erasure. This means that the data will not be used or accessible to anyone and will only be used in case of a legal requirement or liability claim related to them. Once the applicable legal limitation period has expired, the data will be permanently deleted.

Legal Basis and Data Collected

The legal basis for the processing of your data is the express consent you grant through a positive and affirmative action (such as filling out the corresponding form and checking the box to accept this policy) at the time you provide us with your personal data.

Consent to Process Your Data

By filling out the forms, checking the box "I accept the Privacy Policy," and clicking to submit the data, or by sending emails to the Company via the designated email accounts, the User declares that they have read and expressly accepted this Privacy Policy, and grants their unequivocal and express consent to the processing of their personal data in accordance with the stated purposes.

The data collected is necessary to respond to your request for information or, in the case of service contracting, is adequate, relevant, and not excessive in relation to the specific scope and purposes.

Nevertheless, this consent may be revoked at any time by the data subject by unsubscribing through any of the means provided to the user. In the case of service contracting, the user must use the channels made available to them to cancel the service, and data processing will cease from the moment of cancellation.

Categories of Data

The data collected through the contact form pertains to the category of identifying data, which may include: the contact person's first and last name, email address, and phone number, all of which are required in order to establish contact.

Additionally, the user may indicate the "Subject" of their inquiry and include any relevant information in the comments section to help resolve their request. If the user includes personal data in this section, such information will be handled in accordance with the same criteria set forth in this Privacy Policy.

Security Measures

As part of our commitment to ensuring the security and confidentiality of your personal data, we inform you that the necessary technical and organizational measures have been adopted to safeguard personal data and to prevent its alteration, loss, unauthorized processing or access, taking into account the state of technology, the nature of the stored data, and the risks to which it may be exposed, in accordance with Article 32 of the EU GDPR 679/2016.

Data Disclosure

The Company will not disclose your data without your express authorization, except in the following cases:

Only for the management of user databases, natural or legal persons other than the Data Controller may have access to the information collected. Specifically, data storage through Cloud Computing services will be managed by ATLAS.ti Scientific Software Development GmbH, in compliance with data protection regulations regarding the provider's access to the data as part of the storage service, particularly in accordance with Article 28 of the GDPR. This provider is located in Germany, and therefore, this does not constitute an International Data Transfer.

In any case, outside of the aforementioned scenarios, your personal data may only be processed by a third party if the Data Processor commits to implementing the necessary technical and organizational measures to comply with the required data protection and security obligations, thereby ensuring the confidentiality, integrity, and availability of your data. In addition, a data processing agreement must be signed in accordance with Article 28 of the GDPR.

Aside from these situations, data may also be shared with competent public bodies, the Tax Agency, Law Enforcement Agencies, and Courts and Tribunals, when there is a legal obligation to do so.

Restricted Access Policy for Clients

In the event that the user contracts the company's products or services, they will be granted access to the platform through a restricted client area, where they will have access to the documents they digitize, which can be downloaded at any time. The client will be provided with the account name, usernames, and passwords. For security reasons, the user must change the password immediately, or at the latest, the first time they access the service. The user is solely responsible for safeguarding their login credentials and shall be entirely liable for any damages or losses that may result from misuse, loss, or any other circumstance that may pose a risk of unauthorized access or use by third parties. Users must immediately notify the Company so that it can proceed to block and replace the access credentials.

User Rights

Any data subject has the right to obtain confirmation as to whether or not we are processing personal data concerning them. Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request their erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

In certain circumstances, data subjects may request the restriction of the processing of their data, in which case we will only retain it for the exercise or defense of legal claims. For reasons related to their particular situation, data subjects may object to the processing of their data. The Controller will cease processing the data unless there are compelling legitimate grounds or for the exercise or defense of possible claims.

We also remind you that, if you are a client, you may revoke your consent or object to the sending of commercial communications by any means and at any time by sending an email to the address provided above. If you believe that your request has not been properly addressed or your data is not being processed appropriately, you may file a complaint with the Spanish Data Protection Agency, the competent supervisory authority in Spain.

Below we provide more detailed information about these rights, including direct access to exercise them through links to the Spanish Data Protection Agency:

A) RIGHT OF ACCESS

Article 15 of the General Data Protection Regulation (GDPR) grants the data subject the right to know whether their personal data is being processed, and if so, the purposes of the processing, the categories of data, recipients, the origin of the data, the retention period, and the criteria used to determine that period.

The data controller shall provide a copy of the personal data undergoing processing in electronic format upon request. You may also request the controller to rectify, erase, or restrict the processing of your data.

To exercise this right, please complete the form available at the following link:

Right of access

B) RIGHT TO RECTIFICATION AND ERASURE

Articles 16 and 17 of the GDPR state that the data subject has the right to request the rectification of inaccurate personal data, or to have incomplete data completed or erased when it is no longer necessary for the purposes for which it was collected and processed.

To exercise these rights, please complete the following forms:

Right to rectification

Right to erasure

C) RIGHT TO RESTRICTION OF PROCESSING

The data subject has the right to obtain from the controller the restriction of processing when the accuracy of the personal data is contested. This means the data may only be processed (apart from storage) with the data subject's consent, for the exercise or defense of claims, to protect the rights of another person, or for reasons of important public interest of the EU or a Member State.

The controller must inform the data subject before lifting such a restriction.

Right to restriction

D) RIGHT TO DATA PORTABILITY

Article 20 of the GDPR grants the data subject the right to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller when technically feasible. This applies when the processing is based on consent or a contract.

Right to data portability

Minors

The content of this website is not intended for individuals under the age of 18. Likewise, with regard to the specific data provided by the user, only users who are 14 years of age or older may freely give their consent to the processing of such data.

In any case, the Company will take all reasonable measures to verify users' age, but it cannot be held responsible for any failure to comply with this requirement.

Confidentiality

Any personal data that may be collected will be treated with the utmost confidentiality. The Company undertakes to maintain secrecy regarding such data and guarantees its obligation to safeguard it by adopting all necessary measures to prevent its alteration, loss, or unauthorized processing or access, in accordance with applicable legislation.

To this end, the Data Controller guarantees that it will have the appropriate confidentiality agreements signed with any individuals involved in any stage of the processing of the collected personal data.

International Data Transfers

An International Data Transfer is understood as any communication of your personal data to countries located outside the European Union, and more specifically, outside the European Economic Area (EEA). Exceptions include those countries outside the EEA that are not considered international transfers because the recipients are located in countries that the European Commission deems to provide an adequate level of data protection in line with EU standards.

As stated in section 6, the provider that currently hosts the user databases is located in Germany, so there is no data processing taking place outside the EEA.

In the event that the Company transfers personal information outside the EEA—whether due to data being stored on servers located outside EEA borders, or for any other reason—it will ensure that the required contractual clauses governing such international transfers are in place. The Company will also ensure that any provider hosting or processing personal data complies with the minimum security standards and principles set forth in the GDPR.

Consent for the Sending of Electronic Communications

As outlined in Section Three of this Policy, and in accordance with the provisions of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce, by checking the corresponding box "I accept the sending of electronic communications," you are granting express consent for us to send information about the Company to your email address, telephone, fax, or other electronic means.

In any case, you may communicate your wish to unsubscribe from such communications, and the Data Controller will proceed to process your request immediately.

About this Cookie Policy

In compliance with the provisions of Article 22.2 of Law 34/2002 of July 11, Services Information Society and Electronic Commerce, this website informs you in this section on the policy of collection and processing of cookies. What cookies we use, how we use them and how to control preferences in relation to cookies. At any time you can modify your preferences or refuse your consent in relation to Cookies from the consent form.

Your consent applies in relation to the present domain https://www.invofox.com/ property of Invofox INC. 447 Sutter St Ste 405 PMB1180San Francisco, CA 94108 United States.

What are Cookies?

A cookie is a file that is downloaded to your computer when you access certain web pages. Cookies allow a website, among other things, to store and retrieve information about the browsing habits of a user or their computer and, depending on the information they contain and the way you use your computer, can be used to recognize the user.

How do we use Cookies?

Our website uses both own and third party cookies, own cookies are technical and essential for the operation of the website, third party cookies are used for advertising and analysis functions (disabled by default).

If we have obtained your prior informed consent, we may use cookies to obtain information that allows us to show you advertising based on the analysis of your browsing habits.

What are cookies NOT used for on this website?

No sensitive personal identification information such as your name, address, password, etc. is stored in the cookies we use.

Who uses the information stored in cookies?

The information stored in the cookies on our website is used exclusively by us, with the exception of those identified below as 'third party cookies', which are used and managed by external entities that provide us with services that improve the user experience and with tracking functions for advertising purposes, always, as indicated, with your prior consent. For example, statistics are collected on the number of visits, the most liked content, etc... through different tools described below.

How can I prevent the use of cookies on this website?

Unnecessary cookies are disabled by default, so you will need to SET the ones you allow to be used. If you have accepted them, we will not ask you again unless you delete the cookies on your device as indicated in the next section. If you want to revoke consent you will need to delete the cookies and reset them.

What types of cookies may be used on this website?

ACCORDING TO THE ENTITY THAT MANAGES IT

· Own cookies: those that are sent to the user's terminal equipment from a computer or domain managed by the editor itself and from which the service requested by the user is provided.

· Third-party cookies: are those that are sent to the user's terminal equipment from a computer or domain that is not managed by the editor, but by another entity that processes the data obtained through cookies. In the event that the cookies are served from a computer or domain managed by the editor itself, but the information collected through these is managed by a third party, they cannot be considered as own cookies if the third party uses them for its own purposes (for example, the improvement of the services it provides or the provision of advertising services in favor of other entities). Specifically:

BY PURPOSE

· Necessary technical cookies: are those necessary for navigation and the proper functioning of our website, such as, for example, control traffic and data communication, identify the session, access restricted access parts, remember the elements that make up an order, in case there is in the future this option on the page, as well as perform the purchase process of that order, manage the payment, control fraud linked to the security of the service, make the request for registration or participation in an event, count visits for the purpose of billing licenses of the software that runs the service (website, platform or application), use security features during navigation, store content for broadcasting videos or sound, enable dynamic content (for example, animation of loading a text or image).... These cookies are absolutely necessary for the functioning of the website, they are related to the RGPD consent plugin itself, saving your selection in relation to the Cookies consent. The use of client access also implies the need to install own technical cookies. These cookies are absolutely necessary for the operation of the website, without them the site would not work, so your consent is not required for their use.

· Analysis cookies: they allow us to quantify the number of users and thus perform the measurement and statistical analysis of the use made by users of the service offered. To do this, your browsing on our website is analyzed in order to improve the supply of products or services we offer.

· Behavioral advertising: are those that, treated by us or by third parties, allow us to analyze your browsing habits on the Internet so that we can show you advertising related to your browsing profile. These actions are carried out through the tools indicated in the previous section, which will be specified later.

ACCORDING TO THE LENGTH OF TIME THEY REMAIN ACTIVE

- Session Cookies: are those designed to collect and store data while the user accesses a web page. They are usually used to store information that is only of interest to keep for the provision of the service requested by the user on a single occasion (for example, a list of products purchased) and disappear at the end of the session.

- Persistent cookies: are those in which the data remain stored in the terminal and can be accessed and processed for a period defined by the person responsible for the cookie, which can range from a few minutes to several years. In this regard, it should be specifically assessed whether the use of persistent cookies is necessary, since the risks to privacy could be reduced by using session cookies. In any case, when persistent cookies are installed, it is recommended to reduce their temporary duration to the minimum necessary, taking into account the purpose of their use. To this effect, WG29 Opinion 4/2012 indicated that for a cookie to be exempt from the duty of informed consent, its expiration must be related to its purpose. As a result, session cookies are much more likely to be considered exempt than persistent cookies. The list below reflects the cookies used on our website.

Necessary Cookie

cookieyes-consent

Duration 1 year

Description CookieYes sets this cookie to remember users' consent preferences so that their preferences are respected on subsequent visits to this site. It does not collect or store any personal information about site visitors.

Functional

Cookie wp-wpml_current_language

Duration session

Description The WordPress plugin sets this cookie to store the current language setting.

Analytics

-Facebook Pixel: It records the actions of each visitor on our website and crosses this information with that of its own database once the visitor logs back into the social network. frFacebook . comHTTP3 months

-Google Analytics 4: Collects data from websites and applications to better understand the customer journey, measuring traffic and interaction on websites. -Google Tag Manager: Allows you to quickly and easily update tracking codes and related code snippets that are collectively referred to as tags on your website or mobile application.

-PostHog: Product analytics hosted on EU-based servers. It captures page views and click interactions (autocapture) and records session replays of on-screen activity to help us understand how visitors use the site and improve it. PostHog and session replay are only activated after you accept analytics cookies; until then no PostHog data is collected.

-OpenAI ads measurement (OAIQ): conversion-tracking pixel hosted by OpenAI. Measures the performance of ads served on ChatGPT by attributing post-click actions (e.g. demo requests) to ad impressions. Sets localStorage entries (oaiq_consent) and a __oaiq_consent cookie (30-day TTL) to track its own consent state. Active only after you accept marketing cookies; until then no OAIQ data is collected. Data is processed by OpenAI (US) under the EU-US Data Privacy Framework — retention and erasure of measured events are governed by OpenAI's published policies; to exercise your right to erasure for data Invofox has shared with OpenAI, use the contact channel listed in the Privacy section.

- Hubspot: Organizes individual contacts in a unified record with all the information of each one of them. This record includes both the more explicit information (the data they leave in the forms) and the implicit information (behavior and interactions). __ptq.gifHubspot . com

PixelSession

-Heap analytics: We automatically collect user data in order to implement ongoing website improvements that will have the greatest impact on the business. of your site or application and then provide instructions on the improvements that will have the greatest impact on your business.

-Segment: The purpose is to capture data from each interaction with the user, create data in user profiles and centralized audiences.

- Quora pixel: This is a small snippet of code that is added to the header of the website. The data collected helps us track conversions of the provider's ads, Quora, optimize its campaigns and create targeted audiences based on website traffic. In any case, the companies that generate these cookies also have their own cookie policies, which the user can consult.

INTERNATIONAL DATA TRANSFERS

An International Data Transfer is understood as the communication of your personal data to countries located outside the European Union, and more specifically outside the European Economic Area (EEA). There are exceptions of countries outside this European space that are not considered an international transfer as the recipients are countries that the European Data Protection Commission considers adequate to comply with European standards on data protection. These countries are understood to be safe because they are committed to comply with the requirements of European regulations. In any case, if the Data Controller transfers any data outside the EEA, it is done in accordance with the contractual framework agreements to which the different third party providers are bound, such as Google Analytics or some of the tools and RRSS described.

Updates and changes to the Cookie Privacy Policy

INVOFOX may modify this Cookies Policy according to legislative or regulatory requirements, or with the purpose of adapting this policy to the instructions dictated by the Spanish Data Protection Agency, therefore Users are advised to visit it periodically.

Revised and updated as of May 31, 2. 023