Meeting recording policy

1. Data controller

Azahar Data Insights, S.L., with tax identification number (NIF) B22711154 and address at Avenida José Jornet Navarro 1, Bloque A, Escalera 2, planta 5, puerta C — 03005 Alicante, is the controller of the personal data arising from the recording of video call meetings.

For any enquiry about this processing, you can write to us at info@azahardata.com.

2. Purpose of the processing

We record and transcribe video call meetings, using the native recording and transcription features of Google Meet, for the following purposes:

• To ensure accuracy in note-taking and to avoid the loss of relevant information.
• To have transcripts that allow all parties to focus their attention on the conversation.
• To keep a reliable, shared record of the agreements reached, which can be consulted in the event of disagreement.
• To facilitate the follow-up and completion of the tasks and commitments agreed.
• To document the content of the meeting for future reference and to comply with legal, administrative or contractual obligations.

To draft the minutes from the transcript we use the artificial intelligence built into Notion, the tool in which we manage our projects. We review, correct and approve the minutes ourselves, manually.

3. Legal basis

The main legal basis is your consent, under Article 6(1)(a) of the GDPR. It is freely given, specific, informed and unambiguous, and you can withdraw it at any time as set out in section 10.

Additionally, and solely with regard to drawing up and keeping the minutes as a contractual follow-up document, the legitimate interest provided for in Article 6(1)(f) of the GDPR applies.

4. Categories of data processed

During recording, we process the image and voice captured in the video call, the name and, where applicable, the job title, as well as the content of what each participant says.

We do not request or deliberately record special categories of data within the meaning of Article 9 of the GDPR.

As a large proportion of our projects are carried out in the healthcare field, data concerning the health of third parties may be mentioned during a meeting. Our practice is for these conversations always to be kept in aggregated or pseudonymised terms. If a mention that could identify a specific person were to occur incidentally, it is removed from the transcript and the minutes, and the corresponding part of the recording is deleted.

In order to apply the data minimisation principle in Article 5(1)(c) of the GDPR, we may extract the audio from video recordings and delete the visual component before the general retention period expires, where that extraction is sufficient for the purposes pursued.

5. Retention period

Data are kept according to the specific artefact and the purpose it serves, in line with the storage limitation principle in Article 5(1)(e) of the GDPR:

• Raw video recording: a maximum of six months from the date of the meeting. Once that period has elapsed, it is deleted.
• Text transcript and audio extract: for the duration of the project to which the meeting relates, plus a maximum of six months after its closure.
• Minutes and record of agreements: for the period applicable to the contractual relationship, including the limitation period for actions arising from the contract and the periods imposed by tax and accounting legislation. As they are the record of what the parties agreed, they are kept for that period even if the recording and the transcript are erased.

Under no circumstances do we keep data for longer than strictly necessary. We periodically review our records to carry out the corresponding deletions.

6. Recipients

Recordings and transcripts may be processed by:

• Authorised Azahar Data Insights personnel with a legitimate need for access in the context of the relevant project. At present, the persons who hold office as joint and several directors (administradoras solidarias) of the company.
• Google Ireland Limited, which provides the Google Meet video conferencing service and acts as a processor under a contract that meets the requirements of Article 28 of the GDPR. Recording and transcription are carried out with the service's own native features, without any additional participant or assistant joining the meeting.
• Notion Labs, Inc., provider of the tool in which we manage projects and draft the minutes, including its artificial intelligence feature, which acts as a processor under a contract that meets the requirements of Article 28 of the GDPR.

You can read their privacy policies at policies.google.com and at notion.so.

We do not disclose data to any other third parties unless required by law.

7. International transfers

The video conferencing provider may transfer data to the United States, applying the safeguards provided for in Chapter V of the GDPR.

The transfer is based on the adequacy decision for the EU-US Data Privacy Framework, under which Google LLC is listed as certified.

Notion Labs may also process data in the United States. Those transfers are based on the same adequacy decision where the provider is certified or, failing that, on the Standard Contractual Clauses adopted by the European Commission.

For up-to-date information on where data are stored and the safeguards that apply, see the policies linked in section 6.

8. Security measures

We apply technical and organisational measures appropriate to the level of risk, in accordance with Article 32 of the GDPR, to ensure the confidentiality, integrity and availability of recordings and transcripts throughout their life cycle. These include encryption of communications in transit and of data stored on the processors' systems, access control based on legitimate need, and periodic verification of deletion mechanisms.

Azahar Data Insights personnel with access to the recordings are bound by a duty of professional secrecy regarding the content of the meetings, indefinitely and beyond the end of their relationship with the company.

9. Your rights

Under the terms of Articles 15 to 22 of the GDPR, you have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Request the erasure of your data, including recordings and transcripts.
• Request the restriction of processing.
• Object to processing based on our legitimate interest (section 3).
• Withdraw your consent at any time (section 10).
• Request the portability of your data.
• Lodge a complaint with the Agencia Española de Protección de Datos (AEPD), Spain's data protection authority, at
  aepd.es
  .

You can exercise them by writing to info@azahardata.com. You do not need to send us a copy of your identity document: we will only ask you for additional information to verify who you are if there are reasonable doubts about your identity.

10. Consent and withdrawal

Consent to record each meeting is requested expressly and before the meeting takes place, through a first layer of information included in the coordination email or in the equivalent channel through which the meeting is arranged. That first layer refers to this policy as the detailed second layer of information.

Consent may be given:

• By an express affirmative reply in writing to the coordination email, which is kept as evidence.
• By an express verbal statement at the start of the meeting, which is explicitly recorded in the minutes.

If neither occurs, the meeting takes place without recording or automated transcription.

You can withdraw your consent at any time by writing to info@azahardata.com. Withdrawal does not affect the lawfulness of prior processing. Once the request has been received, we stop the processing and delete the recording and the transcript within a maximum of 30 days. The minutes, which we draft separately, are kept for the period set out in section 5.

11. Updates to this policy

We may amend this policy to adapt it to legislative or case-law developments, or to changes in the technology providers we use. Any substantial amendment will be published on this page reasonably in advance of its entry into force.

You can also consult the legal notice, the privacy policy and the cookie policy.

12. Relationship with data processing agreements

Where Azahar Data Insights acts as a processor on behalf of a client entity, the conditions for recording meetings may be specifically governed by the relevant data processing agreement. In that case, the terms agreed in that agreement prevail over the provisions of this policy.

This policy was last updated on 15 October 2026.