Privacy Policy

§ 1 Who We Are & Data Controller

FutureProof is a digital intelligence service operated by an individual registered as Autónomo under Spanish law. We are based in Spain and our processing activities are subject to the GDPR (EU) 2016/679 and Spanish law (LOPDGDD).

§ 2 What Data We Collect

We collect only the data necessary to deliver your report. We do not collect data for marketing, profiling, or any purpose beyond fulfilling your order.

• Contact information — your name and email address, provided when you submit the order form
• CV / Résumé — the professional document you submit as part of the intake process. This is the primary input used to generate your report
• Intake questionnaire responses — your answers about your role, industry, goals, and career context
• Payment information — handled entirely by our third-party payment processor. We never see or store your card details
• Communication records — emails exchanged between you and FutureProof regarding your order

We do not use tracking pixels, behavioural analytics tools, or any form of automated profiling beyond what is needed to generate your report.

§ 3 Why We Collect It — Legal Basis

Every piece of data we collect has a specific purpose and a lawful basis under GDPR:

• Contract performance (Art. 6(1)(b) GDPR) — your name, email, CV, and questionnaire responses are processed to fulfil your order and deliver your report. Without this data, we cannot provide the service.
• Legal obligation (Art. 6(1)(c) GDPR) — we may retain certain transaction records to comply with Spanish tax law and accounting obligations (Agencia Tributaria requirements).
• Legitimate interests (Art. 6(1)(f) GDPR) — we retain email correspondence for a reasonable period to handle disputes, refund requests, or revision requests related to your order.

We do not process your data based on consent or for direct marketing. We will never send you unsolicited marketing emails.

§ 4 How Long We Keep Your Data

• CV and questionnaire data — deleted within 30 days of your report being delivered
• Email address and name — retained for up to 12 months after order completion to handle any follow-up queries, revisions, or disputes, then deleted
• Transaction records — retained for 5 years in accordance with Spanish accounting and tax law (Ley General Tributaria)
• Email correspondence — retained for 12 months after the last interaction, then deleted

§ 5 Who We Share Your Data With

We do not sell, rent, or trade your personal data. We share data only where strictly necessary to deliver the service:

• Payment processors — your payment is handled by a third-party processor (e.g. Stripe or equivalent). They receive your billing details but not your CV or report content. They operate under their own privacy policies and are GDPR-compliant.
• Email service providers — we use a third-party email platform to send you your report and order communications. Your email address is shared with this provider solely for this purpose.
• AI infrastructure providers — your CV and questionnaire data is processed through AI systems to generate your report. These providers are bound by data processing agreements and may not use your data for any other purpose.

We do not share your data with advertisers, data brokers, recruitment agencies, or any third party for commercial purposes.

§ 6 International Data Transfers

To analyze your career data and generate our intelligence reports, we utilize advanced third-party service providers (such as AI models, cloud hosting platforms, and payment processors). Some of these providers may process data on servers located outside the European Economic Area (EEA), primarily in the United States.

These international data transfers are strictly executed under the EU-US Data Privacy Framework, by utilizing Standard Contractual Clauses (SCCs) approved by the European Commission, or via Adequacy decisions, ensuring your data is treated with the rigorous protections mandated by the GDPR.

§ 7 Your Rights

Depending on your location, you have specific rights regarding your personal data. We honour all of the following for all clients globally, regardless of where you are based:

To exercise any of these rights, contact us at hello@futureproof.report. We will respond within 30 days. We will never charge a fee for a reasonable data request.

If you are an EU/EEA resident and believe we have handled your data unlawfully, you have the right to lodge a complaint with your national supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD) at aepd.es.

§ 8 Security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. These include:

• Encrypted email communications where supported
• Access to your data limited strictly to those involved in fulfilling your order
• Secure deletion of CV data within 30 days of delivery
• Use of reputable, GDPR-compliant third-party processors only

No method of transmission over the internet is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority as required by GDPR within 72 hours of becoming aware of it.

§ 9 Cookies

Our website uses a limited number of cookies. Please refer to our Cookie Policy for full details of what cookies we use, why, and how to manage them.

§ 10 Children's Privacy (COPPA)

Our services are directed exclusively at professional adults. We do not knowingly collect personal information from individuals under the age of 18. If we learn we have collected data from a minor, we will delete it immediately.

§ 11 California Privacy Rights (CCPA)

If you are a California resident, you have the right to know what personal data we collect and to request its deletion. FutureProof does not "sell" or "share" your personal information with third parties for their own commercial or advertising purposes as defined under the California Consumer Privacy Act (CCPA).

§ 12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of our service after any update constitutes acceptance of the revised policy.

§ 13 Contact & Complaints