Privacy Policy

Last updated: 25 September 2026

This policy explains how we process personal data on the portalhero.pro website (the website), on the dashboard.portalhero.pro platform (the Platform) and in our contact channels, in accordance with articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD). This translation is provided for information; in case of discrepancy, the Spanish version prevails.

1. Data controller

2. Our role: controller or processor

  • Controller of the data of those who visit the website, write to us or call us, and of the users and contact persons of our customers (section 3).
  • Processor (art. 28 GDPR), on behalf of each customer and following its instructions, of the data of its buyers, leads and contacts. The controller of that data is the seller (section 4).

3. Data we process as controller

3.1 Browsing the website

  • Data: IP address and technical data of each request. If you accept analytics, additionally a random browser identifier, the pages viewed, the source of the visit, the type of device and an approximate location.
  • Purpose: to display the website, protect it against abuse and, only with your permission, measure which pages are used.
  • Legal basis: legitimate interest in serving and protecting the website (art. 6.1.f GDPR); consent for analytics (art. 6.1.a GDPR and art. 22.2 LSSI-CE). Details in the Cookie Policy.
  • Retention: the technical logs, for the time necessary for the security of the website; the analytics, for the retention period of the tool.

3.2 Form, WhatsApp, email and phone

  • Data: those you provide when contacting us (name, company, email, phone, sector, listing volume) and the content of the messages or the call.
  • Purpose: to handle your commercial or support request and prepare a proposal.
  • Legal basis: pre-contractual measures or performance of the contract (art. 6.1.b GDPR); for general enquiries, legitimate interest in responding to whoever writes to us (art. 6.1.f GDPR). The form checkbox confirms that you have read this policy.
  • Retention: while the handling of the request or the commercial relationship lasts and, afterwards, for the time necessary to address any liabilities.

Opening the website's WhatsApp button also applies the privacy policy of that service.

3.3 Platform customers and users

  • Data: identification and contact data of users and contact persons, access credentials, billing data, authorisations to connect the customer's accounts on its channels and systems, activity logs and support conversations.
  • Purpose: to create and manage the account, provide the contracted service, give support, invoice and collect payment, and give notice of changes, incidents and service news.
  • Legal basis: performance of the contract (art. 6.1.b GDPR); tax and commercial obligations (art. 6.1.c GDPR); for the people who work at the customer company, legitimate interest in maintaining the relationship with the company (art. 6.1.f GDPR and art. 19 LOPDGDD).
  • Retention: while the contract lasts. Afterwards, the data is blocked during the legal limitation periods (art. 32 LOPDGDD); the accounting documentation, for the period set by commercial and tax regulations.

3.4 Commercial communications to customers

Emails about Portal Hero functions and services similar to those contracted, based on art. 21.2 LSSI-CE and legitimate interest (art. 6.1.f GDPR). You can unsubscribe at any time from the email itself or by writing to contacto@portalhero.pro.

3.5 Security and defence of claims

We retain what is necessary to detect and prevent improper access or fraud and to formulate or defend ourselves against claims, based on legitimate interest (art. 6.1.f GDPR) and, where applicable, on a legal obligation (art. 6.1.c GDPR), until the actions become time-barred.

4. Data we process on behalf of our customers

When a seller uses Portal Hero, the Platform processes on its behalf the data of its buyers, leads and contacts: identification and contact, shipping addresses and order data, messages (text, voice and images), calls with their recordings, transcriptions and summaries, classifications of the conversations and documents signed from the CRM. With them the Platform displays the conversations in a single inbox, responds on behalf of the seller (manually or with the AI assistant if it is activated), imports the orders into its management system and synchronises them with each channel. When the customer connects a messaging platform such as WhatsApp Business, we access the messages, the sender's data, the channel's configuration and its statistics only to provide the service, in accordance with that platform's conditions.

The seller is the controller: it decides which channels it connects and which functions it activates, and must inform its buyers and have a legal basis, including for recording calls. Portal Hero acts as processor in accordance with the Data Processing Agreement that forms part of the contract with each customer. We do not use that data for our own purposes, we do not sell it, we do not advertise with it and we do not use it to train AI models. On termination of the contract, the data is returned or deleted, unless the law requires it to be retained.

If you are a buyer or lead of a seller that uses Portal Hero, exercise your rights before that seller. If you write to us, we will forward your request without delay.

5. Artificial intelligence and automated decisions

The Platform uses AI models from external providers to respond to buyers with the seller's information and rules (if it activates the assistant), transcribe and summarise calls and messages, classify conversations and prioritise leads, and draft and categorise listings. No decisions are taken based solely on automated processing that produce legal effects or significantly affect you (art. 22 GDPR): the AI proposes and summarises, and the seller's team can review and intervene in any conversation. We do not train our own models with personal data and we contract the AI services, to the extent that the available plans allow, under terms in which the provider does not use the data to train its models. Whoever writes to a seller with the assistant active has the right to know that they are speaking with an AI (art. 50 of Regulation (EU) 2024/1689): the seller must inform of this and Portal Hero may include that identification in the conversation.

6. Recipients

Data is processed on behalf of Portal Hero, under a data processing agreement, by providers of hosting and infrastructure, of email and internal work tools, of web analytics (only with your consent), of artificial intelligence, of telephony and of messaging. In addition, on the customer's instruction, the data is sent to the sales channels it connects, which are independent controllers with their own policies, and to its management system or online shop. Banks, advisers and public authorities receive data when it is necessary to collect payment, comply with legal obligations or address requirements from authorities. We do not sell data.

7. International transfers

Some providers are outside the European Economic Area or may access data from there. We only work with providers covered by an adequacy decision of the European Commission (art. 45 GDPR) or by standard contractual clauses with the appropriate complementary measures (art. 46 GDPR). You can request a copy of the applicable safeguards at dpo@portalhero.pro.

8. Your rights

You can exercise at any time the rights of access, rectification, erasure, objection, restriction of processing and portability (arts. 15 to 22 GDPR), withdraw consent without it affecting what was processed beforehand (for web analytics, from the "Cookie settings" link in the footer) and not be subject to automated decisions with legal or significant effects.

Write to dpo@portalhero.pro indicating which right you wish to exercise; we will only ask you to prove your identity if we have reasonable doubts. It is free and we respond within one month, extendable by two further months in complex cases with prior notice. If your data is processed by a seller that uses Portal Hero, address that seller (section 4). The relatives or heirs of deceased persons may exercise these rights under the terms of art. 3 LOPDGDD.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (https://www.aepd.es). We would be grateful if you write to us first to try to resolve it.

9. Security

We apply technical and organisational measures appropriate to the risk (art. 32 GDPR): encrypted communications, role-based access control, protected passwords, backups and secure management of the access keys to external services. If we suffer a security breach affecting personal data, we will notify the AEPD when it is mandatory (art. 33 GDPR), the affected persons when it entails a high risk (art. 34 GDPR) and, if it affects a customer's data, that customer without undue delay.

10. Minors

The website and the Platform are aimed at businesses and professionals. We do not knowingly collect data of minors under 14 years of age (art. 7 LOPDGDD); if we detect that we have done so, we will delete it.

11. Changes to this policy

We may update this policy when the processing or the regulations change. The date of the latest version appears at the beginning. If the change is relevant for customers or for people whose email we hold, we will communicate it by email before it applies.