Privacy Policy
Last updated: 20 May 2026
This Privacy Policy describes how ATOMTECH CONSULTING SL processes your personal data when you use Drago, the AI assistant for Lanzarote available at https://drago.atomtech.es. It complies with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), and Law 34/2002 on Information Society Services (LSSI-CE).
1. Data controller
ATOMTECH CONSULTING SL, Spanish VAT B27646694, registered office at CL. Chafarí 3 PTA 2, 35508 Teguise (Las Palmas), registered with the corresponding Companies Registry, is responsible for processing your data. You can contact us and exercise your rights at [email protected] with «GDPR» in the subject line.
2. What data we process
We process the following categories of data: (a) Identification obtained when you sign in with Google: name, email address and, optionally, profile picture. (b) Service usage: history of conversations with the assistant, questions asked, saved favourites, language and accessibility preferences. (c) Approximate location only when you expressly authorise it, for contextual suggestions. (d) Technical data: IP address, browser user agent, session identifier and anonymous usage telemetry (Umami). We do not process special categories of data (health, ideology, sexual orientation, etc.).
3. Processing purposes
We process your data to: (a) provide the AI-powered conversational assistant about places, events, news and activities in Lanzarote; (b) personalise your experience (language, preferences, favourites); (c) guarantee the security of the service, prevent abuse, fraud and misuse of the platform; (d) comply with our legal obligations; (e) analyse aggregated and anonymous product usage to improve it.
4. Legal basis
The legal bases for each processing activity are: (a) performance of the contract you accept with us when using Drago (art. 6.1.b GDPR), to provide the service and maintain your account; (b) your express consent (art. 6.1.a GDPR), for use of your location and for non-strictly-necessary cookies; (c) our legitimate interest (art. 6.1.f GDPR) in operating, improving and protecting the service against abuse, balanced against your rights and freedoms; (d) compliance with legal obligations (art. 6.1.c GDPR).
5. Data retention
We keep your account, conversations and favourites while the account remains active. If you request account deletion, we flag your data as erased immediately and remove it physically from our systems within 30 days at most, unless the law requires longer retention (e.g. to respond to court orders). Anonymous usage metrics (Umami) are kept for up to 12 months.
6. Recipients and processors
To provide the service we rely on the following providers, all bound by contract to obligations equivalent to ours: Google Ireland Limited (OAuth sign-in); Anthropic PBC (Claude language model that generates replies); Hetzner Online GmbH (server infrastructure in the European Union); Cloudflare Inc. (delivery network and attack protection); a self-hosted Umami instance (anonymous analytics). We do not sell, rent or share your data with third parties for commercial purposes.
7. International transfers
Some of our providers (Anthropic, Cloudflare) are established in the United States. These transfers are covered by the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) and, where applicable, by the EU-US Data Privacy Framework. You may request a copy of the applicable safeguards at [email protected].
8. Your rights
As the data subject you have the right to: access your data, rectify it, erase it («right to be forgotten»), object to processing, request restriction of processing, request data portability and not be subject to automated decisions producing legal effects. You can exercise these rights by emailing [email protected] with «GDPR» in the subject line. We will reply within one month at most. You also have the right to lodge a complaint with the Spanish Data Protection Agency (https://www.aepd.es) if you believe processing does not comply with applicable regulations.
9. Automated decisions and AI
Drago uses generative AI models to answer your questions. Replies are generated automatically, may be inaccurate or contain errors, and should not be considered professional advice (medical, legal, financial or otherwise). We do not make automated decisions producing legal effects on you or significantly affecting you in similar ways.
10. Minors
Drago is intended for people aged 16 or over. If you are under 16, you must not use the service or provide us with personal data. If we detect that we have processed data of a minor under 16 without valid authorisation from a person holding parental responsibility, we will delete it without delay.
11. Security measures
We apply reasonable technical and organisational measures to protect your data (TLS encryption in transit, access control, backups, environment segregation). No system is 100% secure: in the event of a breach that may pose a high risk to your rights, we will inform you without undue delay pursuant to art. 34 GDPR.
12. Changes to this policy
We may update this Privacy Policy to reflect legal, technical or service changes. We will always publish the date of the last update at the beginning of the document and, if changes are material, we will notify you by email or via a prominent notice in the application.
13. Contact
For any question about this policy, to exercise your rights or to file complaints please write to [email protected]. Include «GDPR» or «Privacy» in the subject so we can route your request to the right team.