Privacy Policy
Website: https://hybo.app
1. Data Controller
HYBO, HYBRID WORK SOLUTIONS, S.L. (hereinafter, “HYBO”) is the controller responsible for the processing of the personal data collected through the website https://hybo.app, its subdomains and its language versions (hereinafter, the “Website”).
| Corporate name | HYBO, HYBRID WORK SOLUTIONS, S.L. |
| Tax ID (NIF) | B-44747301 |
| Address | C/ Fontsanta, 46, 2nd Floor A — 08970 Sant Joan Despí (Barcelona), Spain |
| hello@hybo.app | |
| Website | https://hybo.app |
| Data Protection Officer | GRUPO ATICO34, S.L. |
This Privacy Policy does not apply to the processing of personal data that HYBO carries out on behalf of its customers in connection with the provision of its software services (the HYBO platform). In such cases, HYBO acts as a data processor and the processing is governed by the corresponding agreement entered into pursuant to Article 28 of the GDPR, with the customer acting as the data controller.
2. Applicable regulations and principles
HYBO processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, the General Data Protection Regulation (hereinafter, the “GDPR”), Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, the “LOPDGDD”) and Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (the “LSSI-CE”), applying the principles of lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and proactive accountability.
3. Purposes of processing, legal bases and retention periods
The personal data processing activities carried out by HYBO through the Website are detailed below:
3.1. Handling of inquiries and contact requests
| Purpose | To handle, manage and respond to inquiries, requests for information and requests submitted through the contact form, email or the Website’s support channels, as well as to follow up on them. |
| Legal basis | Article 6(1)(b) GDPR: taking steps at the request of the data subject prior to entering into a contract. Alternatively, Article 6(1)(f) GDPR: HYBO’s legitimate interest in responding to communications addressed to it. |
| Categories of data | Identification data (first and last name), contact details (email, telephone), professional data (company, position, country) and the content of the inquiry. |
| Retention period | For the time necessary to handle the request and, subsequently, for the statute-of-limitations period applicable to any liabilities that may arise from the contact. |
3.2. Demo requests and sales management
| Purpose | To manage product demonstration requests (“Book a demo”) and pricing access requests, to contact the requesting party, to prepare and send quotes and commercial proposals, and to follow up on the sales opportunity. |
| Legal basis | Article 6(1)(b) GDPR: taking pre-contractual steps at the request of the data subject. Where the contact person acts on behalf of a legal entity, Article 6(1)(f) GDPR: legitimate interest in maintaining the business relationship with the entity they represent, pursuant to Article 19 of the LOPDGDD. |
| Categories of data | Identification and professional contact details, data of the entity represented, position, country, and data arising from the business interaction. |
| Retention period | For as long as the commercial interest is maintained and deletion has not been requested; if the contract is formalized, for the duration of the relationship and the subsequent legal statute-of-limitations periods. |
3.3. Downloading of content (studies, reports and resources)
| Purpose | To provide access to and enable the download of studies, reports, guides and other content offered on the Website, upon completion of the corresponding form. |
| Legal basis | Article 6(1)(b) GDPR: performance of the data subject’s request for delivery of the content. The subsequent sending of commercial communications is subject to the legal basis set out in section 3.5. |
| Categories of data | Identification and professional contact details (name, email, company, position, country). |
| Retention period | For as long as the relationship is maintained and deletion has not been requested, subject to the limit of the legally applicable statute-of-limitations periods. |
3.4. Management of the contractual relationship with customers, suppliers and partners
| Purpose | To formalize, perform, maintain and manage the contractual relationship, manage invoicing and collections, provide the contracted services and fulfil the obligations arising from the contract. |
| Legal basis | Article 6(1)(b) GDPR: performance of a contract to which the data subject is party. Article 6(1)(c) GDPR: compliance with legal obligations of a commercial, accounting and tax nature. |
| Categories of data | Identification, contact, professional, economic, financial and billing data, and data arising from the performance of the contract. |
| Retention period | For the duration of the contractual relationship and, once it has ended, for the legally established statute-of-limitations periods (generally, six years pursuant to Article 30 of the Commercial Code and four years pursuant to the General Tax Law). |
3.5. Sending of commercial communications and newsletters
| Purpose | To send, by electronic means, commercial information, product news, invitations to events and webinars, blog content, newsletters and other promotional communications relating to HYBO’s products and services. |
| Legal basis | Article 6(1)(a) GDPR: consent of the data subject, given by means of an express affirmative action. In the case of persons with whom a prior contractual relationship exists, and with regard to HYBO’s own products or services similar to those initially contracted, Article 6(1)(f) GDPR and legitimate interest, pursuant to Article 21.2 of the LSSI-CE. |
| Categories of data | Identification and professional contact details, preferences and interests expressed, and data on interaction with communications (opens and clicks), as set out in section 3.6. |
| Retention period | Until the data subject withdraws consent or objects to the processing. Withdrawal shall not affect the lawfulness of the processing carried out prior thereto. |
3.6. Browsing measurement, web analytics and commercial profiling
| Purpose | To record and analyze the browsing activity of Website visitors (pages visited, clicks on calls to action, scrolling and time spent) in order to measure the Website’s performance, improve its content and, where the visitor has previously been identified, associate such browsing activity with their contact record in HYBO’s customer relationship management (CRM) system, for the purpose of understanding their interests and tailoring the commercial actions and communications addressed to them. |
| Legal basis | Article 6(1)(a) GDPR: consent of the data subject, given through the Website’s consent management system (cookie banner), in connection with Article 22.2 of the LSSI-CE. Consent may be withdrawn at any time through the cookie settings panel. |
| Categories of data | Browser identifier, CRM contact identifier, browsing events (pages viewed, clicks, scrolling and time spent), technical connection and device data, and data arising from interaction with commercial communications. |
| Retention period | The retention period for each cookie is set out in the Cookie Policy. Browsing data associated with the contact record will be retained for as long as consent is maintained and, failing that, for a maximum of thirteen (13) months from the time it is collected. |
Additional relevant information: the association between browsing activity on the Website and the CRM contact record constitutes profiling within the meaning of Article 4(4) of the GDPR. Such profiling does not produce legal effects on the data subject or similarly significantly affect them, and is used exclusively for the purpose of tailoring commercial activity. The data subject may object at any time to this processing, including profiling linked to direct marketing, pursuant to Article 21.2 and 21.3 of the GDPR.
3.7. Personnel selection (“Work with us”)
| Purpose | To manage personnel selection processes, assess candidacies for advertised positions or future vacancies, and maintain contact with the candidate during the process. |
| Legal basis | Article 6(1)(b) GDPR: taking pre-contractual steps at the request of the data subject. For the retention of the candidacy for future selection processes, Article 6(1)(a) GDPR: consent of the data subject. |
| Categories of data | Identification and contact details, academic and professional data, work experience and any other data included by the candidate in their curriculum vitae or accompanying documentation. |
| Retention period | One (1) year from receipt of the application, unless the data subject requests its deletion earlier or gives consent to a longer period. |
3.8. Management of social media presence
| Purpose | To manage HYBO’s corporate profiles on social media (LinkedIn, Instagram and X, among others), respond to user interactions and disseminate information about the entity’s activity and services. |
| Legal basis | Article 6(1)(a) GDPR: consent of the data subject, expressed by following the profile or interacting with it, in accordance with the terms of the relevant social network. |
| Categories of data | Username or profile name, profile picture and content of interactions posted or sent. |
| Retention period | For as long as the data subject maintains the connection with the corporate profile or until they request the deletion of their comments or interactions. |
3.9. Regulatory compliance and exercise or defense of claims
| Purpose | To respond to requests from Public Administrations, authorities and Courts and Tribunals, as well as to bring, exercise or defend claims. |
| Legal basis | Article 6(1)(c) GDPR: compliance with a legal obligation. Article 6(1)(f) GDPR: legitimate interest in HYBO’s legal defense. |
| Categories of data | The data strictly necessary in each case, arising from the processing activities described above. |
| Retention period | For the legally established periods and the statute-of-limitations periods for the corresponding actions. |
4. Source of the data and nature of its provision
As a general rule, the personal data processed is provided directly by the data subject through the Website’s forms, email or the other communication channels made available. Additionally, data may be obtained arising from the data subject’s browsing activity on the Website and their interaction with the electronic communications sent by HYBO, as set out in section 3.6 and the Cookie Policy.
In certain cases, the data may come from the entity for which the data subject provides services (for example, when a customer designates a contact person), from publicly accessible sources or public registers, pursuant to Article 19 of the LOPDGDD.
Fields identified as mandatory in the forms are necessary in order to handle the corresponding request. Failure to provide them will prevent HYBO from processing the request. The data subject warrants the accuracy and truthfulness of the data provided and undertakes to notify any changes thereto.
Where the data subject provides personal data belonging to third parties, they must have previously informed those third parties of the content of this Privacy Policy and must be duly authorized to disclose such data to HYBO, with the data subject being liable for any claim arising from failure to comply with this obligation.
5. Recipients of the data
Personal data will not be disclosed to third parties, except where legally required or where necessary for the performance of the contractual relationship. In particular, data may be disclosed to Public Administrations and official bodies, to law enforcement authorities and to Courts and Tribunals, as well as to financial institutions for the management of collections and payments and to professional advisors, where legally required or necessary.
Additionally, HYBO uses service providers that access personal data as data processors, with whom the corresponding agreements have been entered into pursuant to Article 28 of the GDPR. The main categories of processors are as follows:
| Provider category | Purpose of data access | Location of processing |
| Web hosting and infrastructure provider | Hosting of the Website and its databases, and content delivery network and security services | European Union / United States |
| Customer relationship management and marketing automation platform (HubSpot) | Management of contacts, sales opportunities, forms and sending of electronic communications | European Union / United States |
| Web analytics and measurement providers (Google, Hotjar, Microsoft Clarity) | Audience measurement and browsing behavior analysis | European Union / United States |
| Data measurement and activation services provider (Aidda) | Implementation and operation of the proprietary browsing measurement system and its activation in the CRM | European Union |
| Cloud services and data analytics provider (Google Cloud / BigQuery / Looker Studio) | Storage and analytical processing of browsing data | European Union |
| Consent management platform (Cookiebot) | Collection, recording and evidencing of consent for the use of cookies | European Union |
| IT, development and maintenance service providers | Technical support, development and maintenance of information systems | European Union |
| External advisors and Data Protection Officer | Provision of legal advisory and regulatory compliance services | European Union |
6. International data transfers
Some of the providers referred to in the preceding section are established outside the European Economic Area or may access the data from third countries, mainly the United States. In such cases, HYBO ensures that international transfers are carried out under one of the mechanisms provided for in Chapter V of the GDPR, in particular:
- An adequacy decision of the European Commission, in the case of entities adhering to the EU-U.S. Data Privacy Framework, pursuant to Implementing Decision (EU) 2023/1795.
- Standard Contractual Clauses approved by the European Commission through Implementing Decision (EU) 2021/914, supplemented, where necessary, with the additional measures arising from the corresponding transfer impact assessment.
The data subject may obtain additional information on the international transfers carried out and the safeguards applied by contacting the Data Protection Officer at the address indicated in section 1.
7. Automated decisions and profiling
HYBO does not make decisions based solely on automated processing of data that produce legal effects on the data subject or similarly significantly affect them, within the meaning of Article 22 of the GDPR.
Notwithstanding the foregoing, HYBO carries out the profiling for direct marketing purposes described in section 3.6, subject to the data subject’s prior consent. The data subject may object to such processing at any time, without needing to state a reason, through the cookie settings panel or by contacting the addresses indicated in section 1.
8. Security measures
HYBO has adopted appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity to the rights and freedoms of individuals.
Such measures include, among others, access control based on the principle of least privilege, encryption of communications, performance of backups, staff training, execution of confidentiality undertakings, and periodic review of the effectiveness of the measures implemented.
9. Rights of data subjects
The data subject may exercise the following rights at any time, free of charge:
| Right | Content |
| Access (Art. 15 GDPR) | To find out whether HYBO processes their personal data and, if so, to obtain information about the processing and a copy of the data. |
| Rectification (Art. 16 GDPR) | To request the correction of inaccurate or incomplete data. |
| Erasure (Art. 17 GDPR) | To request the deletion of the data when, among other reasons, it is no longer necessary for the purposes for which it was collected. |
| Restriction of processing (Art. 18 GDPR) | To request that the processing of the data be suspended in the legally established cases, in which case it will be retained solely for the exercise or defense of claims. |
| Portability (Art. 20 GDPR) | To receive the data provided in a structured, commonly used and machine-readable format, and to transmit it to another controller. |
| Objection (Art. 21 GDPR) | To object to the processing of the data on grounds relating to their particular situation. Where the processing is carried out for direct marketing purposes, including any related profiling, objection may be exercised at any time and without needing to state a reason. |
| Withdrawal of consent (Art. 7.3 GDPR) | To withdraw consent given at any time, without affecting the lawfulness of the processing carried out prior to its withdrawal. |
| Not to be subject to automated decisions (Art. 22 GDPR) | Not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect them. |
These rights may be exercised by submitting a request to HYBO, HYBRID WORK SOLUTIONS, S.L., at C/ Fontsanta, 46, 2nd Floor A, 08970 Sant Joan Despí (Barcelona), or to the email address hello@hybo.app, indicating the right to be exercised and enclosing a copy of a document proving the identity of the applicant. HYBO will respond to the request within one month of receipt, which may be extended by a further two months depending on the complexity and number of requests.
Likewise, the data subject has the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (C/ Jorge Juan, 6, 28001 Madrid; www.aepd.es), particularly where they have not obtained satisfaction in the exercise of their rights, as well as to contact the Data Protection Officer beforehand.
10. Minors
The Website’s services and content are aimed at professionals and persons over the age of fourteen (14), pursuant to Article 7 of the LOPDGDD. HYBO does not knowingly collect data from minors under that age through the Website. Should such a case be detected, the data will be deleted immediately.
11. Amendments to this Privacy Policy
HYBO reserves the right to amend this Privacy Policy in order to adapt it to legislative or case-law developments or to the criteria of the supervisory authorities, as well as to changes in its processing activities. Any amendment will be published on the Website with reasonable advance notice and, where required, will be communicated individually to data subjects.
Last updated: August 2026.