MJ LABS1. Controller
MJ Strategi Tech Solutions SL ("MJLabs.AI", "we")
CL Nou 12, 2 2B, 17001 Girona, Spain
NIF/VAT: ESB22575567
Data protection contact: privacy [at] mjlabs.ai
Phone: +46 76 685 10 53
We have not appointed a Data Protection Officer, as we are not required to have one.
2. What we process and why
| Situation | Data | Purpose | Legal basis (GDPR Art. 6(1)) | Retention |
|---|---|---|---|---|
| Contact form on mjlabs.ai | Name and company (optional), email or phone, your message, language and timestamp. To protect the form against spam and abuse we also store your IP address and browser type. | Reply to your enquiry and conduct business dialogue | Legitimate interest (f) in answering enquiries and developing business relationships; pre-contractual steps (b) where the enquiry concerns a contract with you | 12 months after the last contact, if no contract is concluded |
| Name, email address, content, attachments | Communication with clients, prospects and suppliers | Legitimate interest (f); contract (b) | 12 months after the last contact. With clients: during the contract and 5 years after. | |
| Phone and our AI phone assistant | Phone number, name, what you say during the call and any booking details. Calls are not recorded as audio. What is said is turned into text, which is stored. You can also leave a message. | Answer calls, book appointments and get back to you | Legitimate interest (f) in taking calls around the clock; pre-contractual steps (b) | The call text for 30 days. Bookings for as long as they are needed. |
| Phone number, name, messages | Communication when you choose to contact us that way | Legitimate interest (f) | 12 months after the last contact | |
| Contacting businesses that may benefit from our services | Company name, website, industry, town and the company's general email address and phone number. In some cases the name of a contact person or a personal work address. | Contact the company about our services and ask about its needs | Legitimate interest (f) in reaching businesses that may benefit from the services | Until you decline, otherwise no longer than 12 months after the last contact. If you decline, we keep only what is needed to avoid contacting you again. |
| Contact persons at business clients and suppliers | Name, role, company, work email, phone, correspondence | Conclude and perform contracts, invoicing, client relationship | Legitimate interest (f) where the client company/supplier is the contracting party; legal obligation (c) for accounting | During the contract and 5 years after; accounting records as long as required by law (in Spain 6 years) |
| Website operation and security | IP address, browser data, timestamps (server logs, attack protection) | Security, troubleshooting, abuse prevention | Legitimate interest (f) | 30 days |
Providing data is not mandatory, but without contact details we cannot reply to you. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you (Art. 22).
When a client relationship has ended, we block the data for the period the law requires us to keep it (Spanish LOPDGDD Art. 32). It is then used only if an authority or a court requests it or if we need it in a dispute, and it is deleted when the period has ended.
When you call us, the call may be answered by an AI assistant. It says so at the start of the call. Read more in our AI policy.
When we provide services and process personal data on behalf of a client (e.g. in the client's booking system, customer register or AI solution), the client is the controller and we act as processor under a separate data processing agreement. This policy does not cover that processing.
3. Where the data comes from
Most data comes directly from you. Data we use to contact businesses about our services was collected from the companies' own websites and other public sources. If you do not want to be contacted, simply reply to the email or use the unsubscribe link and we will remove the data.
4. Recipients
We do not sell personal data. Data may be shared with:
- service providers processing data on our behalf (processors): server and hosting within the EU (Bahnhof AB in Sweden for our service systems and a hosting provider in the Netherlands for the website mjlabs.ai), network and security (Cloudflare, Inc.), email (one.com) and the AI service behind the phone assistant (OpenAI Ireland Ltd);
- our telephony operator 46elks AB, Sweden, which carries calls and text messages and is an independent controller for that service;
- WhatsApp (Meta Platforms Ireland Ltd) when you contact us that way. Meta acts as an independent controller for some processing;
- accountants, auditors and legal advisers;
- authorities where required by law.
Enquiries and customer details are stored in our own system on our server, not in a third party's customer register.
5. Transfers outside the EU/EEA
Our own systems and servers are located in the EU/EEA. Some providers (Cloudflare, WhatsApp/Meta and OpenAI) may process data outside the EU/EEA, including in the United States. Such transfers rely on an adequacy decision (e.g. the EU–US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses (GDPR Arts. 45–46). You can request information about the safeguards at privacy [at] mjlabs.ai.
6. Fonts
The website's fonts are served from our own server and no data is sent to Google when you visit the site.
7. Your rights
You have the right to request access, rectification, erasure, restriction and data portability (Arts. 15–20). You have the right to object to processing based on legitimate interest (Art. 21). You can always object to direct marketing, and we will then stop contacting you. Where processing is based on consent, you may withdraw it at any time. Contact privacy [at] mjlabs.ai. We reply within one month.
8. Complaints
You may lodge a complaint with a supervisory authority, in particular in the country where you live, work or where the alleged infringement took place (Art. 77):
- Spain: Agencia Española de Protección de Datos (AEPD), www.aepd.es (our lead supervisory authority)
- Sweden: Integritetsskyddsmyndigheten (IMY), www.imy.se
9. Security
We use appropriate technical and organisational measures, including encrypted transmission (HTTPS), access control, two-factor authentication and regular backups.
10. Changes
We may update this policy. The current version and date are always shown on this page.