Privacy and Cookie Policy
WHO IS RESPONSIBLE
ECOSTARS ESG AI, S.L. (CIF B06932792), Calle O’Donnell 11, 28009 Madrid, Spain, is the controller of the personal data collected through ecostars.ai, forms.ecostars.org and the Ecostars platform.
Contact: [email protected].
WHY WE USE YOUR DATA, LEGAL BASIS AND RETENTION
| Purpose | Legal basis | Retention |
|---|---|---|
| Answer enquiries and demo requests | Steps you request before a contract (art. 6.1.b GDPR) | Until resolved, plus 9 months |
| Provide certification, assessments and the platform | Contract (art. 6.1.b); for users invited by their organisation, our customer’s and our legitimate interest in giving its staff the access it contracted (art. 6.1.f) The data uploaded by hotels that register on the Ecostars platform is confidential, meaning that information such as occupancy or total consumption may not be made public. In any case, the Ecostars certification itself is considered public data, as well as the orders of magnitude derived from the ratios calculated using the provided data (never the raw data itself), such as the order of magnitude of the CO2 footprint or basic consumption levels. | While the account is active, plus 180 days Any hotel may renounce its Ecostars certification at any time, in which case the data associated with the hotel will be deleted, and its profile will remain as if it had never applied for our certification or provided any data. |
| Protect our website and platform against attacks and misuse | Legitimate interest in keeping our systems and users’ data secure (art. 6.1.f) | 6 months |
| Measure use of our website and platform with cookies | Consent (art. 6.1.a) | See Cookies below |
| Send the Matter newsletter | Consent (art. 6.1.a) | Until you unsubscribe |
| Tell customers about similar services | Legitimate interest in informing existing customers about services similar to those they contracted (art. 6.1.f; art. 21.2 LSSI-CE) | While you are a customer, plus 9 months, or until you opt out |
| Run events, webinars and contests | The registration or contest terms you accept (art. 6.1.b) | 12 months after the event |
| Publish public hotel profiles | Legitimate interest in offering a public hotel sustainability database (art. 6.1.f) | While the profile exists |
| Manage job applications | Steps you request before an employment contract (art. 6.1.b); consent to keep your CV for future roles (art. 6.1.a) | Until the process ends, plus 6 months with your consent |
| Manage customers, suppliers and invoicing | Contract (art. 6.1.b); legitimate interest in maintaining our relationship with the organisation you work for (art. 6.1.f; art. 19 LOPDGDD); tax and accounting obligations (art. 6.1.c) | The relationship, then 6 years (art. 30 Spanish Commercial Code) |
After each period, data is blocked and kept only to handle legal claims: 3 years for data protection matters (art. 72 LOPDGDD) and 5 years for contractual claims (art. 1964 Spanish Civil Code). It is then deleted.
If your organisation invites you to the platform, it gives us your name, business email and role. Public hotel profiles are built from public sources and contain business contact details.
WHICH DATA YOU MUST PROVIDE
| When | Required data, and why | If you do not provide it |
|---|---|---|
| Contact and demo requests | Name, business email and company, to reply to you | We cannot reply or arrange a demo |
| Certification, assessment and platform | Contact details and the hotel data the service uses, as a contractual requirement | We cannot provide the service |
| Events and contests | The fields marked as required, to register you | You cannot take part |
| Matter newsletter | Email, to send it | You will not receive it |
| Job applications | Contact details and CV, to assess you | We cannot consider your application |
| Invoicing | Company name, tax ID and address, required by Royal Decree 1619/2012 | We cannot provide paid services |
WHO RECEIVES YOUR DATA
We do not sell personal data. It is received only by:
- service providers acting on our behalf under article 28 GDPR: hosting and cloud infrastructure, email and newsletter, CRM, analytics, AI services and support tools
- your organisation’s administrators, if your platform account belongs to it
These providers process data outside the European Economic Area:
| Provider | Country | Safeguard |
|---|---|---|
| HubSpot, Inc. (CRM and website analytics) | United States | EU-US Data Privacy Framework, adequacy decision of 10 July 2023 |
You can request a copy of these safeguards at [email protected]
YOUR RIGHTS
You can access, rectify, erase or port your data, restrict or object to its processing, and withdraw consent at any time without affecting earlier processing. Email [email protected]. You can also complain to the Spanish Data Protection Agency at www.aepd.es.
AUTOMATED DECISIONS
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. If you accept marketing cookies, HubSpot links the pages you visit to your contact record, if you have given us your details, so we can tailor our communications.
COOKIES
Cookies are small files a website stores on your device to remember information about your visit. Functional cookies are needed for the site to work and do not require consent (art. 22.2 LSSI-CE); we use the others only if you accept them.
| Cookie | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| cmplz_banner-status, cmplz_consented_services, cmplz_policy_id, cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing | Ecostars (Complianz) | Store your cookie choices | Functional | 365 days |
| wp-wpml_current_language, wpml_browser_redirect_test | Ecostars (WPML) | Remember your language and check that cookies work for language redirection | Functional | Session |
| _icl_visitor_lang_js | Ecostars (WPML) | Store your browser language to show the site in it | Functional | 1 day |
| __cf_bm | HubSpot, via Cloudflare (privacy policy) | Distinguish people from bots to protect HubSpot’s services | Functional | 30 minutes |
| __hstc, hubspotutk | HubSpot (privacy policy) | Recognise you across visits and, if you have given us your details, link your visits to your contact record | Marketing | 6 months |
| __hssc, __hssrc | HubSpot (privacy policy) | Count visits and detect new sessions | Statistics | 30 minutes (__hssc), session (__hssrc) |
Third-party providers use their cookies under their own privacy policies, and any transfer outside the EEA is covered as described under Who receives your data.
Our banner lets you accept, reject or choose cookies by category. You can change or withdraw your consent at any time through “Update cookie preferences” in the website footer.
OTHER
Third-Party Links
This website may contain links to other sites that may be of interest to you. Once you click on these links and leave our site, we no longer have control over the site to which you are redirected and therefore are not responsible for the terms, privacy, or data protection of those third-party sites. Such sites are subject to their own privacy policies, so we recommend that you check them to confirm that you agree with them.