GDPR Compliance Statement

Effective Date: September 17, 2026
Last Updated: September 17, 2026

Happy Whole Human Spain, S.L. processes personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Spanish Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (“LOPDGDD”).

This Statement summarizes how HWH meets specific GDPR obligations. For the plain-language user-facing description of our data practices, see our Privacy Policy. Where this Statement is more general than the Privacy Policy, the Privacy Policy controls.

Data Controller (Art. 4(7))

The data controller responsible for personal data processed under this Statement is:

Happy Whole Human Spain, S.L.
Registered office: Carrer del Bruc 5, #312, 08010 Barcelona, Spain
NIF / VAT: ESB21889415
Contact for data protection matters: contact@happywholehuman.com

Happy Whole Human Spain, S.L. is the sole legal entity operating the Happy Whole Human® ecosystem.

Data Protection Principles (Art. 5)

We process personal data in accordance with the seven principles of Article 5:

  • Lawfulness, fairness, and transparency (Art. 5(1)(a))
  • Purpose limitation — collected for specified, explicit, and legitimate purposes (Art. 5(1)(b))
  • Data minimization — limited to what is necessary for those purposes (Art. 5(1)(c))
  • Accuracy — kept accurate and, where necessary, up to date (Art. 5(1)(d))
  • Storage limitation — kept for no longer than necessary (Art. 5(1)(e))
  • Integrity and confidentiality — protected against unauthorized or unlawful processing and against accidental loss (Art. 5(1)(f))
  • Accountability — we are responsible for, and able to demonstrate, compliance with these principles (Art. 5(2))

Lawful Bases for Processing (Art. 6)

We process personal data based on one or more of the following:

  • Consent (Art. 6(1)(a)), which may be withdrawn at any time
  • Performance of a contract with you (Art. 6(1)(b))
  • Compliance with a legal obligation (Art. 6(1)(c))
  • Legitimate interests, balanced against your rights and freedoms (Art. 6(1)(f))

We identify and document the applicable lawful basis for each processing activity in our internal Records of Processing Activities.

Special Category Data (Art. 9)

Coaching content, assessment responses, and reflections may contain information that qualifies as special category data under Art. 9 (for example, information concerning health or intimate life). Where such data is processed, we rely on explicit consent (Art. 9(2)(a)) and apply enhanced confidentiality safeguards described in our Privacy Policy and in our Terms & Conditions.

Data Subject Rights (Art. 12-23)

Depending on your location and the applicable lawful basis, you have the right to:

  • Access your personal data (Art. 15)
  • Rectify inaccurate or incomplete data (Art. 16)
  • Erasure (“right to be forgotten”) (Art. 17)
  • Restrict processing (Art. 18)
  • Data portability (Art. 20)
  • Object to processing (Art. 21)
  • Not be subject to a decision based solely on automated processing (Art. 22)
  • Withdraw consent at any time where processing is based on consent (Art. 7(3))
  • Lodge a complaint with a supervisory authority (Art. 77)

Requests may be submitted to contact@happywholehuman.com.

We respond in accordance with GDPR timelines: within one month of receipt of the request (Art. 12(3)), extendable by two further months where necessary, taking into account the complexity and number of requests. Where an extension applies, we inform you within one month of receipt and provide the reasons for the delay.

Requests are handled free of charge unless manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request in accordance with Art. 12(5).

Processors and Sub-Processors (Art. 28)

We engage third-party service providers as data processors to support platform operations, security, hosting, payment processing, and AI service delivery. All processors are engaged under contractual data-protection obligations that meet the requirements of Art. 28, including:

  • Instructions to process personal data only on our documented instructions
  • Confidentiality obligations
  • Appropriate technical and organizational security measures
  • Assistance with data subject rights and breach response
  • Deletion or return of personal data at the end of the engagement
  • Availability for audit and inspection

A current list of primary processors is available on request for enterprise vendor review.

International Data Transfers (Art. 44-49)

Personal data is primarily processed within the European Economic Area, in Spain. Some processing occurs in third countries via our service providers, including in the United States (for example, our AI service provider).

Where personal data is transferred outside the EEA, we implement the safeguards required by Chapter V of the GDPR, including one or more of the following:

  • European Commission adequacy decisions (Art. 45), where applicable
  • Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c))
  • Supplementary technical and organizational measures, where necessary in light of the Schrems II judgment

You may request a copy of the safeguards applied to any specific transfer by contacting contact@happywholehuman.com.

Automated Decision-Making and AI (Art. 22)

Happy Whole Human® does not engage in solely automated decision-making that produces legal or similarly significant effects on individuals within the meaning of Art. 22 GDPR.

AI-enabled features are used to support reflection, learning, and continuity between coaching sessions. AI augments coaching; it does not replace human judgment. Participation in AI-supported features is optional, and users may opt out at any time.

Identifiable personal data is not used to train or fine-tune foundation AI models without explicit user consent. Where fully anonymized and aggregated data is used to improve platform functionality, such data does not identify individual users and is processed in accordance with applicable law and ethical standards.

AI Transparency. HWH uses Anthropic as an AI service provider and Claude Haiku 4.5 as its underlying model. Our AI governance framework aligns with the EU AI Act, GDPR, and LOPDGDD. Details are on our HWH AI page.

Records of Processing Activities (Art. 30)

We maintain internal Records of Processing Activities as required by Art. 30. Records are available for inspection by the Agencia Española de Protección de Datos (AEPD) on request, and can be summarized for enterprise vendor review under appropriate confidentiality obligations.

Data Protection Impact Assessments (Art. 35)

We conduct Data Protection Impact Assessments where required by Art. 35 for processing activities likely to result in a high risk to the rights and freedoms of individuals, including for the deployment of our AI-supported features.

Personal Data Breach Notification (Art. 33-34)

In the event of a personal data breach, we will:

  • Notify the Agencia Española de Protección de Datos (AEPD) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Art. 33
  • Notify affected data subjects without undue delay when the breach is likely to result in a high risk to their rights and freedoms, in accordance with Art. 34

Breach response follows our internal incident management procedures.

Data Protection Officer (Art. 37-39)

Happy Whole Human Spain, S.L. is not currently required to designate a Data Protection Officer under Art. 37(1). Voluntary designation is under evaluation as part of our ongoing compliance program.

Data protection queries in the interim may be directed to contact@happywholehuman.com.

Supervisory Authority (Art. 77)

You have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data infringes GDPR or LOPDGDD.

The competent supervisory authority for Happy Whole Human Spain, S.L. is:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
www.aepd.es

You may also contact the supervisory authority in your EU member state of residence, place of work, or place of the alleged infringement.

Related Documents

Contact

Happy Whole Human Spain, S.L.
Carrer del Bruc 5, #312, 08010 Barcelona, Spain
NIF / VAT: ESB21889415
Email: contact@happywholehuman.com
Website: www.happywholehuman.com