Privacy notice.

1. Data controller

ABBIAMO TECNOLOGÍA, S.A., a company incorporated in the Republic of Panama, trading as Abbitec and owner of the Abbiamo.ai brand, is the controller responsible for decisions on the processing of the data it collects directly through its corporate website, forms and official channels, except where a different role is expressly stated.

RUC 155761998-2-2025, D.V. 96; Aviso de Operaciones (operating notice) 155761998-2-2025-2025-574393548. Registered address: PH Financial Park, Piso 34, Oficina 3404, Avenida La Rotonda, Urbanización Costa del Este, Corregimiento de Juan Díaz, Distrito y Provincia de Panamá, República de Panamá. Contact for privacy matters, requests and complaints: legal@abbiamo.ai. General email: info@abbiamo.ai.

This policy applies to abbiamo.ai and to the forms and assistants on the website when they are enabled. It does not replace the data processing agreements applicable to solutions contracted by clients through partners.

2. Personal data we may collect

For general enquiries: name, professional contact details, company, country, content of the enquiry and the technical data strictly necessary to handle it.

For partner applications: first name and surname, company, work email, country or region of operation, channel type and reason for contact; where there is a specific opportunity, the client's industry and time horizon; in addition to the optional message (maximum 500 characters).

When using the AI assistant, if enabled: messages sent by the visitor, responses, time of interaction and any context or identification data the visitor voluntarily provides.

The website may process technical data such as IP address, security events, cookie preferences and consent records, depending on the tools actually enabled. Visitors are asked not to include sensitive data or banking, medical or third-party information in general forms or open conversations.

3. Purposes and legal basis of processing

We use the necessary data to respond to enquiries, arrange meetings, assess partner affiliation applications, manage expressly communicated opportunities, protect the platform and comply with legal obligations. The applicable legal basis is determined by jurisdiction and purpose: the data subject's own request and pre-contractual measures, legitimate interest where permitted by law, compliance with legal obligations, or consent where required.

Submitting a request does not imply authorization for advertising campaigns. Newsletters, periodic promotional communications, marketing profiles and other secondary purposes require a separate, specific and unticked option where applicable. Declining these communications does not prevent the contact request or partner application from being processed.

Identifiable conversations with the assistant will not be used to train or improve third-party models without an applicable legal basis and specific authorization. Any exception must be disclosed in advance in an understandable manner.

4. Disclosure of data and commercial chain

The commercial model of Abbiamo.ai operates through partners. Where the enquiry relates to a commercial project and it is necessary to refer it, the minimum data needed to handle that opportunity may be disclosed to the relevant partner. The user will be informed of the purpose and of the recipient or category of recipients, and consent will be obtained where required by applicable regulations.

Information submitted in the partner form is managed through HubSpot and routed to canales@abbiamo.ai where there is a specific opportunity, or to partner@abbiamo.ai in all other cases.

We do not sell personal databases obtained through this website. We may disclose them to technology providers acting on our instructions, to authorities where there is a legitimate obligation, and to other recipients who have been disclosed where applicable.

5. Providers and international transfers

HubSpot is the provider identified for the website's forms and customer relationship management. Its data processing agreement and the current list of sub-processors are available at https://legal.hubspot.com/dpa and https://legal.hubspot.com/sub-processors-page.

HubSpot publishes infrastructure and support entities located in different jurisdictions, including the United States and countries in Europe and other regions. The primary storage country, the services actually contracted, their activated sub-processors and any support access depend on the configuration of the service. A visitor's location does not necessarily determine the hosting region.

If a website assistant or an additional feature uses external AI providers, the relevant categories of recipients and any relevant transfer will be disclosed before the processing that requires it is enabled. International transfers will be subject to the contractual safeguards and legal bases required by the applicable jurisdiction.

6. Retention periods

For website processing, data from general enquiries will be retained for up to 12 months from the last interaction, unless there is a need for legitimate follow-up, a dispute or a legal obligation; partner applications that are not formalized, for up to 24 months from the last interaction; and identifiable assistant conversations, when their logging is enabled, for up to 30 days.

Consent records and records of handling rights requests will be retained for as long as reasonably necessary to demonstrate their management and to defend rights, in accordance with the relevant legal periods. Contractual relationships and accounting data are subject to their specific periods. Backups will be deleted or overwritten according to documented cycles, with restricted access.

In all cases, a shorter period will apply if required by the purpose or the law, and a longer one only where there is a documented legitimate basis.

7. Security and privacy by design

We design processing to limit access, collect only the necessary information, reduce the exposure of sensitive data and define encryption, segregation, traceability, retention and deletion measures proportionate to the risk.

Communications containing sensitive information must use specifically authorized channels with appropriate safeguards. Public or general messaging channels are not automatically authorized for sensitive data merely because they are available for commercial communication.

8. Data subjects' rights and procedure

The data subject may request access, rectification, cancellation, objection and portability, as well as withdraw consent and exercise other rights recognized by applicable law. To do so, they may write to legal@abbiamo.ai with the subject line “Personal data rights”, describing the request and providing the information reasonably necessary to locate the record and verify their identity; they should not send complete identity documents if a less invasive check is sufficient.

Abbiamo will record the request, verify its scope and route it to the responsible person and, where necessary, to its provider or partner. As a Panamanian reference, ANTAI (National Authority for Transparency and Access to Information) indicates a maximum of 10 business days for access, cancellation and portability, 5 business days for rectification and immediate effect for objection where applicable, subject to legal exceptions. Any more protective period that is mandatory in the specific case will apply.

Where data belongs to processing controlled by an end client, Abbiamo will refer or coordinate the request in accordance with the contracts and the law, without improperly replacing the authority of the controller. The data subject may contact the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) in Panama or the relevant competent authority.

9. Minors, links and updates

The website is intended for organizations and professionals. We do not knowingly request data from minors in business forms; if we detect improper collection, we will apply the relevant deletion and handling measures.

Links to third-party websites and services are subject to their own policies. This policy may be updated when processing activities, providers or legal requirements change; the update date and, where applicable, an additional notice will make it possible to identify relevant changes.