Privacy policy

This policy explains how Science 4 Insights, S.L. ("ValuesCheck", "we") processes personal data in three situations: when someone visits the website or writes to us (section A), when a company is a client and uses the platform (section B) and when a person is the subject of a digital reputation report (section C).

Controller

A. Website visitors and contact requests

What data we process

What you provide in the forms (name, company email, company, service of interest, message) and the technical data of your visit (IP address, browser, pages viewed), the latter only with the cookies you accept. See the Cookie policy.

Purposes and legal bases

• Answering your request and preparing a proposal: pre-contractual steps at the data subject's request (Art. 6(1)(b) GDPR).
• Sending you commercial information about our services if you asked for it or are a client: legitimate interest (Art. 6(1)(f)) and, where applicable, consent (Art. 6(1)(a)). You may object at any time.
• Measuring site usage in aggregate: consent to analytics cookies (Art. 6(1)(a)).

Retention

Contact requests are kept for 2 years from the last communication. Analytics data, for the period stated in the Cookie policy.

B. Clients and platform users

We process the contact details of the people acting on behalf of the Client (name, work email, role), access credentials and the platform activity log (orders, reports viewed, downloads) to provide and invoice the service, ensure security and meet accounting and tax obligations. Legal bases: performance of the contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)) and legitimate interest in security (Art. 6(1)(f)). Data are kept for the duration of the relationship and, afterwards, for the statutory limitation periods.

C. People analysed in the reports

This section is addressed to the people who are the subject of a report. Because the information is obtained from public sources and not from the person directly, this policy informs you of the processing in accordance with Article 14 GDPR.

Who

People with a public profile: content creators, public figures, political candidates and office holders, artists and spokespeople, when a Client proposes them for a commercial collaboration or a candidacy.

What data and from where

Identification data (name, public name, public social accounts), public activity (career, statements, public posts and videos, commercial collaborations), media coverage and a sample of public comments by third parties, quoted without their author's name. Sources: press and media, open sources on the internet and the person's own public profiles on Instagram, TikTok, YouTube, X and Twitch. Never private accounts, messages, irregularly obtained data or non-public databases.

Where the person has manifestly made public data of special categories (for example, political opinions or beliefs expressed in their posts), the report may record them only insofar as they are relevant to reputational risk, under Article 9(2)(e) GDPR.

Purposes and legal basis

To prepare, at a Client's request, a report that allows it to assess the reputational risk of a collaboration or a candidacy. The legal basis is the legitimate interest of the Client and of ValuesCheck (Art. 6(1)(f) GDPR) in making informed decisions about commercial and institutional associations with people in the public sphere, balanced against the person's rights. That balance is implemented through safeguards: public information only; scope limited to public activity and to the defined period; express distinction between verified facts, opinions and unconfirmed reports; a prohibition on the Client disseminating the report or using it for any other purpose; and limited retention.

Automated decisions

The report is produced by artificial-intelligence systems with a proprietary model and, in the supervised option, reviewed by an expert. The report contains a recommendation but does not by itself produce decisions with legal effects on the person: the decision is made by the Client, with human involvement and its own judgement.

Recipients

The Client that requests it, contractually bound to confidentiality and limited use. Providers that process data on behalf of ValuesCheck under processing agreements: hosting and database in the European Union, providers of artificial-intelligence models and of public social-media data collection, some established in the United States, with whom the European Commission's standard contractual clauses and any necessary supplementary measures apply. No report is published or disclosed to third parties outside the engagement.

Retention

Research session data are deleted when each report is finished. Reports are kept on the Client's platform for 12 months from delivery and then deleted, unless a legal obligation or an ongoing claim requires otherwise.

Rights

Anyone may exercise their rights of access, rectification, erasure, restriction, portability and objection by writing to hello@valuescheck.com with the subject "Data protection" and identifying themselves. People analysed may also object to the processing on grounds relating to their particular situation; we will weigh the objection against the legitimate interest that justifies the report and reply within one month. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security

We apply appropriate technical and organisational measures: encryption in transit, credential-based access control, activity logging, separation of environments and deletion of research data when each report is finished.

Changes

Any change to this policy will be published on this page with its update date.