Privacy policy

Last updated: 19 September 2026

This Privacy policy explains how Autonality processes personal data in connection with the website https://www.autonality.ai, its forms and applications, email communications and business or professional relationships with customers, prospects, suppliers, partners and other contacts.

1. Data controller

• Controller: Autonality Fleet Control, S.L.
• Tax ID (NIF): B88681440
• Address: ETOPIA Centro de Arte y Tecnología, Av. de la Ciudad de Soria, 8, 50003 Zaragoza, Spain
• Email: x@autonality.ai

2. Who this policy applies to

This policy applies, among others, to:

• People who browse the Website or use its calculators and content.
• People who submit a form, email Autonality, request information, a meeting, a proposal or an analysis.
• Contacts at customers, prospective customers, suppliers, partners, associations or other organisations with which Autonality has or may establish a professional relationship.
• Authorised users of Autonality applications or services.

3. Personal data we may process

Depending on the relationship and service used, we may process the following categories of data:

• Identification and contact data: name, surname, email address, telephone number and equivalent contact details.
• Professional data: company or organisation, role, area of responsibility, professional relationship and information needed to maintain contact with the organisation you represent or work for.
• Communications and request content: messages, replies, meeting notes, information requests, proposals and other information you choose to provide to Autonality.
• Account and service usage data: credentials or user identifiers, preferences, actions performed in the application and records needed to provide and protect the service.
• Fleet and operational data: information about vehicles, routes, services, depots, chargers, charging events, incidents, documents, telematics or other operational data. Some data in this category may be personal data where it can identify or be linked to an individual.
• Technical and security data: IP address, browser, device, access logs and other technical records necessary to operate, maintain and secure the systems.
• Website analytics data: navigation and interaction information where you have consented to the relevant analytics cookies.

4. Where the data comes from

Personal data may come from different sources depending on your relationship with Autonality:

• Directly from you, for example when you submit a form, send an email, attend a meeting or event, or use the service.
• From the company or organisation you work for or represent where this is necessary to manage a professional or contractual relationship.
• From lawfully accessible professional sources, such as company websites, professional profiles, business directories, associations, event information or professional referrals, where it is reasonable to contact your organisation in connection with your role.
• From customers, authorised users, devices or integrations connected to the service when Autonality provides fleet management, analysis or monitoring functionality.

Where data has not been obtained directly from you and is used to contact you, this policy provides additional information on the categories and source of the data, the purposes of processing and your rights.

5. Purposes and legal bases

We process personal data only for purposes compatible with the relevant relationship and on an appropriate legal basis. In particular:

• Handling enquiries and requests: responding to forms, emails, meeting requests, demonstrations, analyses or proposals. The legal basis may be taking pre-contractual steps at the data subject’s request or our legitimate interest in managing professional communications.
• Managing customer, supplier and partner relationships: providing services, maintaining the contractual or professional relationship, handling support, billing and necessary communications. The legal basis may be performance of a contract, compliance with legal obligations and, for representatives or contacts at an organisation, our legitimate interest in managing the relationship with that organisation.
• Maintaining professional contacts with organisations: processing professional data limited to what is necessary to locate and maintain a relationship with the company or organisation for which the individual works. Where its requirements are met, this processing is based on legitimate interests under Article 6(1)(f) GDPR and Article 19 of the Spanish Organic Law 3/2018 (LOPDGDD).
• Sending marketing communications: only where consent or another applicable legal authorisation exists. Electronic marketing communications will also comply with the requirements of the Spanish Information Society Services Act (LSSI), including a simple means to object or unsubscribe where required.
• Providing, maintaining and protecting Autonality products: managing accounts, permissions, functionality, support, security, abuse prevention and service continuity. The legal basis will be, as applicable, performance of a contract or our legitimate interest in operating and protecting our systems.
• Website analytics: understanding Website usage to improve content and performance where you have consented to analytics cookies. You can withdraw that consent at any time through the cookie settings.
• Compliance and claims: retaining or disclosing information where required by law or where necessary to establish, exercise or defend legal claims.

A legitimate interest in processing professional contact data does not, by itself, authorise electronic marketing communications where the LSSI requires consent or another specific legal basis.

6. Retention periods

Personal data will be kept for as long as necessary for the purpose for which it was collected and, afterwards, for any retention or limitation periods required by applicable law.

• Enquiries and requests will be kept for as long as needed to handle them and carry out reasonable follow-up.
• Customer, supplier and user data will be kept while the relationship remains in force and, afterwards, for as long as necessary to meet legal obligations and potential liabilities.
• Professional contact or prospect data will be reviewed periodically and will cease to be used when it is no longer relevant to the professional relationship or when the individual validly objects to the processing.
• Data processed on the basis of consent will no longer be used for that purpose once consent is withdrawn, without prejudice to the minimum retention necessary to evidence its management or comply with legal obligations.

7. Recipients and international transfers

Autonality does not sell personal data. Data may be processed by providers that deliver services needed for Autonality’s activities, such as hosting, infrastructure, databases, forms, email, support, security or analytics. Where applicable, those providers act as data processors and are subject to appropriate contractual and confidentiality obligations.

Data may also be disclosed to public authorities, regulators, courts or other third parties where required by law or where necessary to establish, exercise or defend legal rights.

Where a provider processes data outside the European Economic Area, the mechanisms required by applicable law will be used, such as adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, standard contractual clauses or other appropriate safeguards.

8. Data processed on behalf of customers

Some Autonality services may allow a customer organisation to add data relating to its fleet, employees, drivers, users, suppliers or other individuals. Where Autonality processes personal data on the customer’s instructions, the customer will normally be the data controller and Autonality will act as a data processor.

Where applicable, this processing will be governed by the relevant contractual terms and data processing agreement. Data subjects should normally direct requests concerning such data to the relevant controller, without prejudice to Autonality’s assistance in meeting the controller’s obligations.

9. Your rights

Where applicable, you may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and you may withdraw consent at any time for processing based on consent.

To exercise your rights or ask a privacy question, email x@autonality.ai. Additional information to verify your identity will only be requested where there are reasonable doubts and it is necessary to prevent disclosure of data to someone other than the data subject.

You may also lodge a complaint with the competent supervisory authority. In Spain, this is the Spanish Data Protection Agency (AEPD).

10. Cookies and analytics

The use of cookies and similar technologies on the Website is described in the Cookie policy. Analytics tools requiring consent are not activated until the user accepts them.

11. Information security

Autonality applies reasonable technical and organisational measures to protect personal data against loss, alteration, unauthorised access or improper disclosure, taking into account the nature of the data, the context of processing and reasonably foreseeable risks.

12. Changes to this policy

This Privacy policy may be updated when the services, processing activities or applicable rules change. The date of the latest revision is shown at the top of the page.