GDPR - Privacy Notice

First published: November 25, 2024. Last updated: October 1, 2026.

This Privacy Policy explains how Pangeanic B.I. Europa S.L. (“Pangeanic”, “we”, “us”) processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (“LOPDGDD”), and other applicable data protection law. Pangeanic is a European AI Data Operations company specializing in multilingual and multimodal AI. Because our work involves data at every stage, from collection and annotation to evaluation and deployment, we treat data protection as part of the service we deliver, not as an afterthought.

This policy applies to personal data we process through pangeanic.com and its language versions, our platforms and portals, our commercial relationships, our supplier and contributor networks, and our data collection projects. Where a specific project, platform, or contract includes its own privacy notice or data processing terms, those specific terms complement this policy and prevail in case of conflict.

1. Who is responsible for your data?

Controller: Pangeanic B.I. Europa S.L.
Tax Identification Number (NIF/VAT): B97017461 (EU VAT: ESB97017461)
Registered office: Avinguda de les Corts Valencianes, 26, bloque 5, oficina 107, 46015 Valencia, Spain
Phone: +34 96 333 6333
Data Protection Officer: Manuel Herranz, privacy@pangeanic.com
Privacy contact: privacy@pangeanic.com

2. When Pangeanic acts as controller and when as processor

Pangeanic acts as data controller for the personal data of website visitors, business contacts, clients’ representatives, suppliers, linguists, annotators, evaluators, data contributors, job applicants, and platform account holders, as described in this policy.

When a client entrusts us with content that contains personal data (for example, documents for translation, anonymization, or annotation, client datasets for evaluation or model adaptation, or data processed through our platforms on the client’s behalf), Pangeanic acts as data processor under Article 28 GDPR. In those cases the client is the controller, decides the purposes and means of processing, and is responsible for having a valid legal basis and for informing the data subjects. We process that data only on the client’s documented instructions and under a data processing agreement. If you are a data subject whose data is contained in client content, please address your request to the relevant client; if you contact us, we will forward your request to the client and assist them as required by Article 28 GDPR.

3. What data we process, why, on what legal basis, and for how long

3.1 Website visitors and enquiries

Data: name, company, job title, email, phone, country, the content of your enquiry, and technical data such as IP address, browser and device data, and browsing activity collected through cookies and similar technologies.
Purposes: answering enquiries and requests for information, quotations, samples, or demos; operating, securing, and improving the website; producing aggregated usage statistics.
Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR); our legitimate interest in operating and securing the website and responding to business enquiries (Art. 6(1)(f)); your consent for non-essential cookies (Art. 6(1)(a) GDPR and Art. 22.2 of Spanish Law 34/2002, LSSI-CE).
Retention: enquiry data for as long as needed to handle the request and, if no business relationship follows, up to 2 years from the last interaction; cookie data according to our Cookie Policy.

3.2 Commercial communications

Data: name, email, company, interests, and interaction with our communications.
Purposes: sending newsletters, event invitations, and information about our services.
Legal basis: your consent (Art. 6(1)(a) GDPR), or, for existing clients, our legitimate interest in informing them about services similar to those they have contracted (Art. 21.2 LSSI-CE). You can unsubscribe at any time through the link included in every communication or by writing to us.
Retention: until you withdraw consent or object, plus the period needed to prove compliance.

3.3 Clients and their representatives

Data: identification and contact data of client representatives and contact persons, contractual, billing, and payment data, and communications related to projects.
Purposes: preparing quotations and proposals; performing and managing contracts for data for AI, datasets, AI Data Operations, model evaluation and alignment, sovereign AI, machine translation, and related services; invoicing and collection; quality management; handling claims.
Legal basis: performance of a contract and pre-contractual steps (Art. 6(1)(b)); compliance with legal obligations, including tax and accounting obligations (Art. 6(1)(c)); our legitimate interest in managing the business relationship with the legal entity the contact person represents (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD).
Retention: for the duration of the relationship and, afterwards, for the periods required by law, in particular 6 years for accounting records (Art. 30 Spanish Commercial Code) and 4 years for tax purposes (Art. 66 Spanish General Tax Law), and in any case until the statute of limitations for possible claims has expired.

3.4 Suppliers, linguists, annotators, evaluators, and other professionals

Data: identification and contact data; CV, qualifications, certificates, language pairs, domains of expertise, and professional affiliations; results of tests and quality evaluations; availability, rates, and project history; tax and banking data for payments; platform activity and productivity data related to the tasks performed.
Purposes: evaluating suitability for projects; assigning and managing work; quality assurance and performance evaluation of deliverables; payment, invoicing, and tax compliance; maintaining our supplier database.
Legal basis: performance of the supplier or service agreement and pre-contractual steps (Art. 6(1)(b)); compliance with legal obligations (Art. 6(1)(c)); our legitimate interest in ensuring the quality and traceability of deliverables (Art. 6(1)(f)). Supplier data are used internally and are not sold.
Retention: while you remain in our supplier database. If you have not worked with us for 4 years, we will ask whether you want to remain registered and delete your profile if you do not. Data linked to invoices and payments are kept for the legal periods indicated in section 3.3.

3.5 Participants in data collection projects

Some of our projects involve collecting new data (for example speech recordings, images, videos, texts, or human judgments) to build datasets for training, fine-tuning, and evaluating AI systems. Each project has its own information sheet and consent form that describe the specific data collected, the tasks, compensation, and the intended uses. This section summarizes the general rules that apply to all of them.

Data: the recordings, images, texts, or other content you produce or provide; associated metadata (for example language, accent or variety, age range, gender, region, recording conditions); identification, contact, and payment data needed to manage your participation; and the record of your consent.
Purposes: creating, validating, annotating, and quality-checking datasets; licensing or delivering those datasets to clients for the development, training, adaptation, and evaluation of AI systems; managing your participation and compensation.
Legal basis: your explicit and informed consent (Art. 6(1)(a) GDPR) for the collection and use of your contributions in datasets, and the performance of the participation agreement (Art. 6(1)(b)) for managing your participation and payment. We do not use voice recordings, images, or videos to uniquely identify individuals, and we do not intend to collect special categories of data under Article 9 GDPR unless a project specifically requires it, in which case we will request your explicit consent for that purpose.
Safeguards: we separate identification and contact data from contributed content, deliver datasets in pseudonymized or anonymized form whenever the project allows it, apply data minimization to metadata, and contractually require dataset licensees to use the data only for the licensed purposes, not to attempt re-identification, and to apply appropriate security measures.
Withdrawal of consent: you can withdraw your consent at any time by writing to us. Withdrawal does not affect the lawfulness of processing carried out before it. Once we receive your request, we will stop using your contributions in new datasets and deliveries and remove them from datasets that have not yet been delivered. Where your contributions have already been delivered to licensees in a form that still allows them to be linked to you, we will inform those licensees of your withdrawal where this is technically feasible and does not involve disproportionate effort. Contributions that have been irreversibly anonymized are no longer personal data and cannot be withdrawn.
Age: our data collection projects are designed for adults (18 years or older), and we do not knowingly collect contributions from minors. Should a project ever require the participation of minors, it would only take place with the prior, verified consent of their parents or legal guardians and with additional safeguards specific to that project.
Retention: participation management data for as long as needed to manage your participation and payment, plus the legal periods in section 3.3; contributed content for as long as the dataset is maintained and licensed, unless you withdraw your consent; consent records for as long as needed to demonstrate compliance.

3.6 Users of our platforms and portals

This section covers users of Pangeanic platforms and tools that require a user account, such as ECO and PECAT.

Data: account and login data, organization, role, usage logs, and technical and security data.
Purposes: providing access to the platform; user authentication and access control; security, fraud prevention, and incident investigation; technical support; service improvement based on aggregated usage information.
Legal basis: performance of the contract or terms of use (Art. 6(1)(b)); our legitimate interest in keeping our platforms secure and improving them (Art. 6(1)(f)).
Content you upload: for contracted services, content uploaded by clients is processed as described in section 2, under the client’s instructions, and is not used to train or improve our models unless the client has expressly agreed to it.
Retention: account data while the account is active and for up to 1 year after its closure; security logs for up to 12 months unless needed to investigate an incident.

3.7 Free online translation portal (translate.pangeanic.com)

Data: the source text you submit and the translation produced, together with technical data such as language pair, date and time, and IP address.
Purposes: providing the translation you request; analyzing input and output text to evaluate and improve the quality of our machine translation and language models; preventing abuse of the service.
Legal basis: the terms of use you accept when using the portal (Art. 6(1)(b)) for providing the translation, and our legitimate interest in evaluating and improving our models (Art. 6(1)(f)). The free portal is not designed for personal or confidential content: do not submit personal data, special categories of data, or confidential information. For confidential or personal content, use our contracted services, where your content is processed as described in section 2 and is not used to improve our models.
Retention: input and output texts are kept for as long as they are needed for the analysis and improvement purposes described above; technical data for abuse prevention for up to 12 months. You can ask us to delete texts you have submitted by writing to privacy@pangeanic.com and providing enough information for us to locate them.

3.8 Job applicants

Data: CV, contact details, education, professional experience, and any information you choose to provide, plus interview notes.
Purposes: managing recruitment processes for current and future positions.
Legal basis: pre-contractual steps at your request (Art. 6(1)(b)) and, for keeping your application for future openings, your consent (Art. 6(1)(a)).
Retention: up to 1 year from receipt for future openings, unless you ask us to delete it earlier.

Our employees receive specific information about the processing of their personal data through internal channels.

3.9 Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR. Automated tools may support quality checks on annotations or contributions, but decisions about suppliers and participants are reviewed by our staff.

4. Who receives your data?

We do not sell personal data. Personal data may be disclosed to the following categories of recipients, only to the extent necessary for the purposes described above:

Service providers acting as processors, bound by data processing agreements under Article 28 GDPR. These include cloud infrastructure and storage providers (Amazon Web Services and Microsoft Azure), data center and hosting services (ProRed, Parque Tecnológico de Paterna, Valencia, Spain), website hosting, CRM, and marketing automation (HubSpot), project and supplier management (XTRF), as well as providers of email and collaboration tools, IT security, and payment services.
Linguists, annotators, and other professionals working on a client project, when the project requires access to data, under confidentiality obligations and, where applicable, as sub-processors authorized by the client.
Clients and licensees of datasets, for contributions of data collection participants, as described in section 3.5 and only within the scope of the consent given.
Banks and financial institutions, for payments and collections.
Professional advisers, such as auditors, lawyers, and tax advisers, under duties of confidentiality.
Public authorities, including tax authorities, courts, and law enforcement, when required by law.
Funding bodies of research projects (for example European Union programs), only when required by the applicable grant agreement and limited to what is strictly necessary.

5. International data transfers

Some of our service providers, suppliers, or licensees may be located outside the European Economic Area. When personal data are transferred outside the EEA, we ensure an adequate level of protection through one of the following mechanisms: an adequacy decision of the European Commission (including, for certified US recipients, the EU-U.S. Data Privacy Framework), Standard Contractual Clauses approved by the European Commission together with supplementary measures where necessary, or another safeguard permitted under Chapter V GDPR. You may request information about the safeguards applied by writing to our privacy contact.

6. How we protect your data

Pangeanic applies technical and organizational measures appropriate to the risk, including access control based on the principle of least privilege, encryption in transit and, where appropriate, at rest, separation of identification data from contributed content, pseudonymization and anonymization, confidentiality agreements with staff and suppliers, logging and monitoring, and secure deletion. Our information security management system is certified under ISO/IEC 27001. In the event of a personal data breach, we will notify the Spanish Data Protection Agency and, where required, the affected individuals, in accordance with Articles 33 and 34 GDPR.

7. Your rights

Under the GDPR and the LOPDGDD you have the right to:

Access your personal data and obtain a copy of it.
Rectify inaccurate or incomplete data.
Erase your data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
Restrict processing in certain circumstances, in which case we will only keep the data for the exercise or defense of claims.
Object to processing based on our legitimate interest, for reasons related to your particular situation, and at any time to processing for direct marketing.
Data portability, to receive the data you have provided to us in a structured, commonly used, and machine-readable format, where processing is based on consent or contract and carried out by automated means.
Withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, write to privacy@pangeanic.com or to our postal address, indicating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it. We will respond within one month of receipt, which may be extended by two further months where necessary, taking into account the complexity and number of requests; we will inform you of any extension. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.

Some rights are subject to limitations established by law. For example, we may keep certain data when required to comply with a legal obligation or for the establishment, exercise, or defense of legal claims, and rights cannot be exercised over data that has been irreversibly anonymized.

If you consider that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your place of residence or work. We encourage you to contact us first so that we can try to resolve your concern.

8. Where your data comes from

We obtain personal data directly from you, through our website forms, emails, platforms, supplier registration, participation in data collection projects, and job applications. We may also obtain business contact data of client and supplier representatives from the organization they work for, and professional data from publicly available professional sources, always within the purposes described in this policy. When we obtain data from sources other than you, we will inform you as required by Article 14 GDPR.

9. Your responsibilities

You guarantee that the data you provide are accurate and up to date, and you will inform us of any changes. If you provide personal data of third parties (for example colleagues in your organization), you guarantee that you have informed them and, where necessary, obtained their consent. Clients who provide content containing personal data guarantee that they have a valid legal basis for its processing and for its communication to Pangeanic, in accordance with our Terms and Conditions and the applicable data processing agreement.

10. Cookies

We use cookies and similar technologies on our website. You can find detailed information about them, and manage your preferences, in our Cookie Policy.

11. Links to other websites

Our website may contain links to third-party websites. This policy does not apply to those websites, and we recommend that you review their privacy policies.

12. Changes to this policy

We may update this Privacy Policy to reflect changes in our services, legal requirements, or processing activities. The current version is always available on this page with its date of last update. When changes are significant, we will inform affected individuals through appropriate means.