AML Ops Málaga
Legal

Privacy Policy

Last updated: 10 July 2026. This notice explains what personal data we process when you use amlmalaga.com and our services, and the rights you have under the EU General Data Protection Regulation (GDPR).

This page is maintained by Ai Risk Intelligence AS to answer common privacy questions about AML Ops Malaga. It is not a certification, audit report, or legal advice.

1. Who we are (Data Controller)

The controller of your personal data is Ai Risk Intelligence AS, operating the AML Ops Malaga service, based in Málaga, Spain.

Privacy contact: ah@airi.no. Please use this address for any privacy question, request, or complaint.

2. What data we process

  • Contact & enquiry data you submit through our waiting list, contact form, book-a-call form, or by email (name, work email, company, phone if provided, message content).
  • Account & service data if we enter into an engagement (business contact details, invoicing information, records related to service delivery).
  • Technical & usage data collected automatically when you visit the site (IP address, browser type, pages viewed, referrer, timestamps). We use a privacy-friendly analytics provider that does not use cookies to identify you.
  • Cookie / local storage preferences — see our Cookie Policy.

We do not knowingly collect personal data from children, and we do not process special-category data through this website.

3. Why we process it and legal basis

  • Responding to enquiries and pre-contractual requests — Art. 6(1)(b) GDPR (steps taken at your request prior to entering a contract) or Art. 6(1)(f) (our legitimate interest in replying to prospective clients).
  • Providing our services and administering the client relationship — Art. 6(1)(b) (performance of a contract).
  • Complying with legal obligations, including accounting, tax, and AML/CTF record-keeping duties — Art. 6(1)(c).
  • Securing and improving the website, aggregated analytics, fraud prevention — Art. 6(1)(f) (legitimate interests).
  • Marketing emails only where you have given consent — Art. 6(1)(a). You can withdraw consent at any time via the unsubscribe link in any message.

4. Who we share data with

We share personal data only with service providers acting as processors under a written data processing agreement, and only to the extent necessary. Categories include:

  • Hosting and application platform (Lovable / Cloudflare edge network).
  • Database, authentication, and backend infrastructure (Lovable Cloud).
  • Privacy-friendly website analytics (Plausible Analytics, EU-hosted).
  • Transactional email delivery (Resend).
  • Professional advisors (accountants, lawyers) and, where required, competent authorities.

We do not sell personal data and we do not use it for automated decision-making that produces legal or similarly significant effects on you.

5. International transfers

Our providers may process data outside the European Economic Area. Where this occurs, transfers are protected by an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism under Chapter V GDPR.

6. How long we keep data

  • Enquiry and waiting-list data: up to 24 months from last contact, then deleted or anonymised.
  • Client engagement records: for the duration of the engagement and while required by law (typically 5–10 years for AML and accounting records).
  • Website analytics: aggregated, no personal identifiers retained.
  • Marketing consent records: until you unsubscribe, plus a minimum retention needed to prove your consent status.

7. Your rights

Under GDPR you have the right to:

  • access your personal data and receive a copy;
  • rectify inaccurate or incomplete data;
  • erase your data (right to be forgotten), subject to legal retention duties;
  • restrict or object to processing based on legitimate interests;
  • data portability for data you provided under consent or contract;
  • withdraw consent at any time, without affecting prior lawful processing.

To exercise any right, contact ah@airi.no. We aim to respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (in Spain: the Agencia Española de Protección de Datos, www.aepd.es).

8. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS), access controls, least-privilege service roles, and logging. No system is 100% secure; if you believe your data has been affected, please contact us immediately.

9. Changes to this notice

We may update this notice to reflect changes in our services or applicable law. The "Last updated" date at the top of the page indicates when it was last revised.

10. Contact

Ai Risk Intelligence AS — AML Ops Malaga · Málaga, Spain · ah@airi.no