Holded

Summary

The provided diff does not include the actual added, deleted, or replaced contract language. It only states:

> “Added approximately 141 words to the document”

Accordingly, it is not possible to identify:

• Changes to the customer’s data-use rights
• Whether customer data may be used to train, fine-tune, test, or improve AI models
• New data retention, ownership, confidentiality, or security obligations
• Any expanded license or permission granted to the provider
• Changes to liability, indemnification, audit, or termination rights
• Whether data may be combined with other customers’ data or used in aggregated or de-identified form

AI-Training Risk Assessment

No reliable assessment can be made because the text of the additions is missing. In particular, the diff does not reveal whether it:

• Authorizes training on customer content, prompts, outputs, metadata, or usage data
• Limits training to de-identified, aggregated, or anonymized information
• Provides an opt-out or requires the customer’s affirmative consent
• Allows use of data to train third-party, shared, or generally available models
• Preserves the provider’s rights to retain or use data after termination
• Gives the customer ownership or control over models trained using its data

Information Needed

Please provide the actual marked-up text showing the additions, deletions, and replacements. Once provided, the changes can be analyzed for legal effect and specific risks, including any new permissions to use customer data for AI model training.

Summary of Important Changes

1. Expanded company identification and contact details

• The policy now identifies HOLDED TECHNOLOGIES SL, including its Barcelona address, tax ID, and DPO email address.
• The DPO wording remains grammatically unclear (“in your organization”), which could create uncertainty about the formal DPO appointment and role.

2. New and expanded processing activities

The revised policy adds or clarifies processing for:

• “Contact us” forms, including name, surname, email, telephone number, and optional text messages.
• The 14-day free trial, including name, surname, phone, email, and password.
• Registration through Google and Facebook, with personal data processed by those providers.
• Customer support through instant messaging and chat, including email and other information users choose to provide.
• Job applications, including CVs and optional photographs, and applications submitted through LinkedIn and Indeed.
• Webinar registrations, including processing through Livestorm.
• Marketing concerning products, services, promotions, and events.

These additions increase the categories of personal data, purposes, and third-party providers covered by the policy. The policy should clearly distinguish controllers, processors, and independent third-party providers.

3. Broader purposes and legal bases

The revised wording replaces or supplements prior purposes with:

• Management of platform registration and services.
• Customer support.
• Marketing communications.
• Fraud prevention, communications with public authorities, and third-party claims.
• Statistical or historical purposes.
• Administration and enforcement of HOLDED’s legal rights.

Some processing is said to rely on consent, while other processing appears connected to contractual necessity, legal obligations, or legitimate rights. The wording is repetitive and structurally confused, creating a risk that the legal basis is not sufficiently specific or transparent under the GDPR.

4. Retention changes

The policy moves from more specific retention descriptions to broader language allowing retention:

• For as long as necessary for the relevant purpose.
• To comply with legal or regulatory obligations.
• To administer or pursue legal claims.
• For statistical or historical purposes.

This may permit longer retention than the previous wording. The policy does not consistently provide concrete retention periods or objective criteria for each category of data.

5. Third-party disclosures and international transfers

• The prior statement that data would not be sold to third parties is retained in substance.
• The revised text expressly identifies or references Google, Facebook, LinkedIn, Indeed, and Livestorm.
• International transfers outside the EEA are now addressed through processor agreements, Binding Corporate Rules, and European Commission standard contractual clauses.
• Users must contact HOLDED to obtain information about relevant providers, rather than receiving a complete provider list directly.

This creates transparency and transfer-compliance risks if provider identities, locations, and safeguards are not readily available.

6. Marketing and opt-out rights

Marketing use is expanded to include products, services, promotions, and events. The policy states that users may opt out through email instructions or by contacting HOLDED.

7. Data-subject rights

The revised policy reorganizes and expands rights information, including erasure, restriction, portability, objection, and safeguards concerning automated decision-making. The contact email for exercising rights is clearly stated as dpo@holded.com.

8. AI model training

No express provision authorizes or describes using customer data to train, fine-tune, evaluate, or improve AI models. The diff does not add a specific AI-training purpose, consent mechanism, opt-out, data-deletion process from models, or restrictions on using customer content for model development.

However, broad wording such as “statistical or historical purposes,” “improve services” (if applicable elsewhere), and processing of information supplied through chat could potentially be interpreted broadly. HOLDED should expressly state whether customer data or customer content is used for AI training and, if so, identify the data, legal basis, providers, safeguards, retention rules, and opt-out rights.

Summary

The diff only states that approximately 374 words were removed; it does not identify the deleted language or provide replacement text.

Key Legal Changes

• Unidentifiable substantive changes: Without the deleted text, it is not possible to determine whether the revisions affect confidentiality, liability, intellectual property, data protection, service levels, termination, or other legal terms.
• Potential narrowing of protections: Removing language could reduce the customer’s rights or the provider’s obligations, but the direction and significance cannot be confirmed.
• Interpretation risk: The revised document should be reviewed in full to determine whether the remaining language creates gaps, inconsistencies, or unintended changes in meaning.

Customer Data and AI Training

• No determination possible: The supplied diff does not show whether language was added, removed, or changed concerning the use of customer data to train, fine-tune, evaluate, or improve AI models.
• Important provisions to check: Compare the prior and current versions for terms addressing:
• Use of customer data, prompts, inputs, outputs, or personal information for model training or service improvement;
• Whether training use is automatic, optional, or subject to consent or opt-out;
• Whether data is anonymized, aggregated, de-identified, or retained;
• Whether third-party model providers may access or use the data;
• Ownership and licensing rights in data, inputs, outputs, and model improvements; and
• Deletion, retention, security, and confidentiality obligations.

Recommended Action

Obtain the actual 374-word deletion and any replacement language before approving the revision. The current diff is insufficient to assess legal impact or determine whether customer data may now be used for AI training.

Executive Summary

The revised policy materially expands and reorganizes the descriptions of HOLDED’s personal-data processing. It identifies the controller more precisely, adds new processing activities and service providers, revises retention language, and updates international-transfer and data-subject-rights provisions.

No express provision authorizing the use of customer data to train AI models appears in the diff. The changes do not mention artificial intelligence, machine learning, model training, model improvement, or use of customer content for such purposes. However, the broadened descriptions of data processing and third-party access should be reviewed alongside HOLDED’s product terms, DPA, and any AI-specific documentation.

Important Changes and Risks

1. Expanded data collection and processing

The policy now expressly covers:

• Free-trial registration, including name, surname, phone, email, and password.
• Registration through Google and Facebook, with data processed by those providers.
• Customer support through chat, including email and information voluntarily submitted by the user.
• Job applications, including CVs and optional photographs, with applications through LinkedIn and Indeed.
• Webinar registration through Livestorm, including email addresses.
• Marketing concerning products, services, promotions, and events.

Risk: The scope of processing is broader and more detailed. Information voluntarily submitted through chat or applications may include sensitive or confidential business information, yet the policy does not specifically limit or address such content.

2. Marketing and communications

Marketing data may be used to send communications about products, services, promotions, or events. Users may opt out through email instructions or by contacting HOLDED.

Risk: The revised wording may support a broader marketing purpose than the former policy. The policy should clarify whether consent, contract, or legitimate interest is relied upon for each type of communication.

3. Third-party providers and international transfers

The policy names or references Google, Facebook, LinkedIn, Indeed, and Livestorm. It states that providers may access data to perform services and that HOLDED uses processor agreements and, where relevant, European Commission standard contractual clauses or binding corporate rules.

Risk: Provider identities are not comprehensively listed in the policy. Customers may need to contact HOLDED to obtain the provider list. International transfers may therefore occur, including through cloud or support providers not specifically named.

4. Retention and deletion

Retention is now described by purpose, legal obligation, claims, rights administration, and statistical or historical purposes. Data may be anonymized when no longer needed.

Risk: Several retention periods remain open-ended (“as long as necessary”), making actual deletion timelines unclear. “Statistical or historical purposes” may permit continued retention after the original business purpose ends.

5. Data-subject rights

The revised policy more fully describes access, correction, erasure, restriction, portability, objection, and rights concerning solely automated decisions.

Risk: The policy states that deletion may be refused where data is needed for legal obligations, which is legally common but should be applied narrowly and transparently.

Key Changes and Risks

1. AI-model training and data use

• No express change addresses AI training, machine learning, model development, or use of customer data to train AI models.
• The revised text does not expressly authorize HOLDED or its service providers to use personal data, customer content, prompts, outputs, or usage data for AI training.
• It also does not expressly prohibit such use. Accordingly, the policy is silent and potentially ambiguous on whether data submitted through HOLDED’s products may be used for model training.
• The revised references to statistical or historical purposes and external service providers should not automatically be treated as permission for AI training. If HOLDED intends to train models using customer data, it should state clearly:
• what data may be used;
• whether data is de-identified or aggregated;
• whether providers may retain or reuse the data;
• the legal basis and applicable opt-out or consent mechanism; and
• whether customer content is excluded from model training by default.

2. Broader processing purposes and legal bases

The revised policy substantially expands the listed purposes and legal bases, including:

• job applications and candidate management;
• webinar registration;
• chat and customer support;
• optional cookies accepted by the user;
• fraud prevention;
• communications with public authorities;
• third-party claims; and
• administration and enforcement of HOLDED’s rights.

This may permit broader processing than the prior wording. The policy should ensure that each purpose is linked to a specific legal basis and that consent is not used where another basis is more appropriate.

3. Retention changes

The previous general retention wording is replaced with more detailed criteria. HOLDED may retain data:

• for as long as needed to resolve inquiries or provide support;
• until the end of a consent or regulatory period;
• to comply with legal obligations;
• to pursue legal claims; and
• for statistical or historical purposes.

The addition of statistical or historical retention could extend storage beyond the original operational purpose. Deletion, anonymization standards, and retention periods remain relatively non-specific.

4. Third-party access and international transfers

• The policy now expressly permits external service providers to access personal data as processors under HOLDED’s instructions.
• Livestorm is identified for webinars, while other providers are not named.
• The policy adds processor agreements under Article 28 GDPR.
• Transfers outside the EEA are contemplated, supported by Binding Corporate Rules or European Commission model clauses.

Risk: Customers receive limited visibility into the identity, location, and categories of all providers and possible transfer destinations.

5. Data-sale language

The policy now expressly states that personal data will never be sold to third parties. However, it still permits disclosure to processors, public authorities, and other parties where legally required.

6. Rights and liability

The revised policy adds or clarifies rights to:

• information, rectification, erasure, restriction, portability, and objection;
• challenge solely automated decisions and profiling; and
• complain to a data protection authority.

It also expands disclaimers concerning inaccurate user-provided data, website content, security incidents, outages, and third-party interference. These disclaimers may not eliminate mandatory GDPR or consumer-law obligations.

7. Recommended follow-up

Clarify AI-training practices in the privacy policy and contractual terms, identify relevant providers and transfer locations, and make retention periods and legal bases more specific.

Summary of Important Changes

AI Training and Model Use

• No express authorization to use customer data to train AI models appears in the revised text.
• The policy does not state whether customer content, account data, support chats, webinar data, or other submitted information may be used to train, fine-tune, evaluate, or improve artificial-intelligence or machine-learning models.
• The absence of an AI-training provision creates uncertainty, particularly if HOLDED uses AI vendors or AI-enabled support tools. The policy should expressly state:
• whether customer data is used for model training;
• whether data is used only to provide the service or also for product improvement;
• whether data is aggregated or de-identified first;
• whether customers can opt out; and
• which AI providers receive the data.

Expanded Data Collection and Processing

• The revised policy adds detailed processing for:
• “Contact us” forms, including name, email, telephone number, and optional text messages;
• the 14-day free trial, including name, email, phone number, and password;
• registration through Google and Facebook;
• customer support through chat;
• job applications, including CVs and optional photographs;
• applications through LinkedIn and Indeed;
• webinars, including use of Livestorm;
• marketing, promotions, events, products, and services.
• These changes broaden the categories of personal data and purposes beyond the prior, more general wording.

Marketing and Communications

• Personal data collected through account creation or newsletter subscription may now be used for marketing communications about products, services, promotions, and events.
• Users may opt out through email instructions or by contacting HOLDED.
• The prior wording stated that data would be deleted from systems or anonymized when no longer needed. The revised wording instead focuses on opting out of communications, which may mean data remains retained for other purposes.

Retention and Secondary Uses

• Retention is now described as lasting as long as necessary for the relevant purpose, legal obligations, claims, rights administration, or statistical or historical purposes.
• This is broader and less definite than fixed or purpose-specific retention periods.
• “Statistical or historical purposes” may permit continued retention after the original business purpose ends, although the policy does not clearly require anonymization in every case.

Third-Party Providers and Transfers

• The policy identifies or references Google, Facebook, LinkedIn, Indeed, Livestorm, chat providers, and other service providers.
• It permits providers to access data to perform services and refers to GDPR Article 28 processor agreements.
• International transfers outside the EEA are expressly contemplated, using processor contracts, Binding Corporate Rules, or European Commission standard contractual clauses. This increases cross-border access risk, particularly because the provider list is not fully specified.

Rights and Liability

• GDPR rights are reorganized and expanded, including erasure, restriction, portability, objection, and rights relating to automated decision-making.
• The policy places stronger responsibility on users for the accuracy and updating of their data and seeks to limit HOLDED’s liability for inaccuracies.
• The heavily duplicated and poorly structured diff creates interpretive risk; the final published policy should be checked for internal consistency and missing sections.

Summary of Changes

Overall Change

• Approximately 374 words have been removed from the document.
• Because the deleted wording is not provided, it is not possible to determine precisely which rights, obligations, limitations, or protections were removed.
• The deletion itself creates a material review issue: important provisions may have been eliminated without replacement.

Customer Data and AI Training

• The available diff does not identify whether customer data may be used to train, fine-tune, evaluate, or improve AI models.
• It is therefore unclear whether the revised document:
• Prohibits or permits training on customer data;
• Limits use to aggregated, anonymized, or de-identified data;
• Requires customer consent or provides an opt-out;
• Covers prompts, inputs, outputs, uploaded files, metadata, or usage data;
• Restricts human review or disclosure of customer data;
• Applies different rules to personal data, confidential information, or business data; or
• Requires deletion or segregation of data used in model development.

Potential Risks

The removal may have deleted protections concerning:

• Purpose limitation: restrictions on using customer data only to provide the services;
• AI model training: a prohibition, consent requirement, or opt-out mechanism;
• Confidentiality: limits on using customer content for training or sharing it with model providers;
• Data retention and deletion: obligations to delete training data or customer content;
• Security and access controls: restrictions on employee, contractor, or third-party access;
• Ownership and licensing: rights granted to the provider to use customer content or resulting outputs;
• Regulatory compliance: commitments relating to privacy and data-protection laws; and
• Liability and indemnity: responsibility for unauthorized use or disclosure of customer data.

Practical Impact

• The customer should not assume that deletion of text means the provider’s rights have narrowed. Depending on the surrounding language, the remaining provisions may still authorize broad data use.
• Conversely, the deleted wording may have contained important customer protections, making the revised document more provider-favorable.
• The revised document should be compared with the full prior and current versions before approval. Particular attention should be given to sections titled Data Use, Customer Content, Confidentiality, Privacy, Artificial Intelligence, Service Improvement, Machine Learning, Security, Retention, and License.

Recommended Follow-Up

Request the complete deleted text or a clean copy of both versions and confirm expressly:

> Customer data, prompts, inputs, outputs, and confidential information will not be used to train or improve general-purpose AI models without the customer’s prior written consent.

Structured Summary of Important Changes

1. Controller identification and contact details

• The policy now identifies the organisation as HOLDED TECHNOLOGIES SL, with its Barcelona address, tax ID, and DPO email address.
• The DPO contact is stated more clearly, which improves transparency.

2. Expanded data collection and purposes

The revised policy expressly covers additional activities and data, including:

• 14-day free-trial registration, including name, surname, phone number, email, and password.
• Registration through Google and Facebook, with notice that those providers process personal data.
• Customer support through chat or instant messaging, including email and information voluntarily supplied by the user.
• Job applications, including name, contact details, CV, and optionally a photograph.
• Applications submitted through LinkedIn and Indeed.
• Webinar registration through Livestorm.
• Marketing communications concerning products, services, promotions, and events.

These additions broaden the stated purposes and categories of personal data processed.

3. Marketing and communications

• The policy now states that account or newsletter data may be used for marketing communications.
• Users may opt out at any time using email instructions or by contacting HOLDED.
• Data may be deleted or anonymised when no longer needed, although the policy also permits retention for legal, rights-enforcement, statistical, or historical purposes.

Risk: The marketing language is broad and does not clearly distinguish consent-based marketing from other lawful bases.

4. Third-party providers and international transfers

• The policy names or refers to additional providers, including Google, Facebook, LinkedIn, Indeed, and Livestorm.
• Providers may access data to perform services for HOLDED.
• The policy retains assurances regarding GDPR processor agreements and Article 28 compliance.
• International transfers outside the EEA are expressly contemplated, with safeguards such as processor agreements, Binding Corporate Rules, and European Commission standard contractual clauses.
• Users may request information about providers by contacting the DPO.

Risk: The policy does not provide a complete provider list or specify which providers receive which data, making the scope of disclosures difficult to assess.

5. Retention

• The previous, more specific retention criteria are replaced with broader wording: data is retained as long as necessary for the relevant purpose, legal obligations, rights enforcement, or statistical/historical purposes.
• This may permit longer or less predictable retention.

6. Data-subject rights

• Rights are reorganised and explained in greater detail, including access, rectification, erasure, restriction, portability, objection, and complaints to a supervisory authority.
• The policy now states that users may request that decisions based solely on automated processing, including profiling, not be made where they have significant legal or similar effects.

7. AI-model training

• No express provision authorising or describing use of customer data to train AI models appears in the diff.
• There is no stated right to opt out of AI training, no description of model-development purposes, and no distinction between service data and data used for training.
• Accordingly, the revised policy does not clearly grant or exclude an AI-training right. Any AI-training use would need to be assessed under the contract, product terms, or other policies.

8. Drafting concern

The diff appears to contain substantial duplication and section-ordering errors. The final published policy should be checked carefully for consistency and accidental omissions.

Key Changes and Risks

1. Scope and Legal Basis of Processing

• The policy is reorganized and expands the listed processing activities to include:
• Job applications.
• Webinar registration.
• Customer support through chat.
• Optional cookies accepted by the user.
• Fraud prevention, communications with public authorities, and third-party claims.
• Consent is identified as the legal basis for additional activities, including demo forms, registrations, newsletters, webinars, chat support, and optional cookies.
• Compliance with legal obligations is expressly added as a basis for fraud prevention, regulatory communications, and third-party claims.

Risk: The policy now covers more purposes and legal bases, but the wording is compressed and appears internally inconsistent. The organization should confirm that each purpose has a specific, appropriate legal basis and that consent is not used where another GDPR basis is required.

2. Retention and Deletion

• The former general retention language is replaced with more detailed criteria based on:
• The time needed to respond to inquiries.
• The duration of consent or a legal obligation.
• The period needed to provide support.
• Legal, regulatory, statistical, historical, and claims-related purposes.
• Job-application data will be deleted when no longer needed, or retained in records or anonymized so the applicant cannot be identified.
• HOLDED may retain data to administer legal rights and pursue court claims.

Risk: Retention periods remain largely open-ended. References to “statistical or historical purposes” could permit extended retention unless effective anonymization is actually performed.

3. Recipients and Service Providers

• The policy expressly permits access by external processors, including Livestorm for webinars and other auxiliary service providers.
• It adds processor agreements under Article 28 GDPR and confidentiality/security obligations.
• Data will not be sold to third parties.
• Disclosure to public authorities is limited to what is strictly necessary.

Risk: The policy does not provide a complete or specific list of providers, processing locations, or categories of data shared. Customers may need to contact the DPO for further information.

4. International Transfers

• The policy newly addresses transfers outside the EEA.
• HOLDED refers to safeguards including adequacy protections, Binding Corporate Rules, and European Commission standard contractual clauses.

Risk: The language does not identify the relevant countries, providers, transfer mechanisms, or supplementary measures. The practical level of protection may therefore be difficult to assess.

5. Data-Subject Rights and Liability

• Rights are expanded or clarified to include access/information, rectification, erasure, restriction, portability, objection, and protections against certain solely automated decisions.
• A right to complain to the competent data-protection authority is added.
• HOLDED adds broad disclaimers concerning user-provided information, third-party information, website availability, security incidents, and events beyond its control.

Risk: Some liability exclusions may not override mandatory GDPR obligations or statutory liability.

6. AI Model Training

• No express provision was added authorizing or prohibiting the use of customer or personal data to train, fine-tune, evaluate, or improve AI models.
• The policy also does not explain whether data submitted through chat, support, webinars, cookies, or the platform may be used for AI development.

Implication: The diff does not create a stated AI-training right, but it also does not provide affirmative protection against such use. If AI training is intended, a clear purpose, lawful basis, data categories, retention rules, opt-out/objection mechanism, and processor disclosures should be added.

Summary

The supplied diff does not include the actual amended legal language. It only states:

> “Added approximately 374 words to the document”

Accordingly, I cannot reliably identify:

• Changes to customer-data rights or permitted uses
• Whether customer data may be used to train, fine-tune, test, or improve AI models
• New data-retention, sharing, or disclosure rights
• Changes to confidentiality, security, or privacy obligations
• Customer opt-out, deletion, or restriction rights
• Liability, indemnity, or compliance risks

AI-Training Review

No substantive language concerning AI-model training is included in the supplied material. It is therefore impossible to determine whether the new text:

• Authorizes use of customer content or personal data to train general-purpose or internal models
• Distinguishes between “customer data,” “content,” “usage data,” prompts, outputs, or aggregated/deidentified data
• Permits human review or sharing with model providers and subcontractors
• Allows the provider to retain data after termination
• Gives the customer an opt-out or requires consent
• Limits training use to service improvement, abuse prevention, or product development

Information Needed

Please provide the complete diff, including the approximately 374 added words and any deleted or replaced language. Once provided, the analysis can identify the specific legal effect of each change and highlight any new AI-training, privacy, confidentiality, security, and liability risks.

Summary of Important Changes

1. AI-model training and data use

• No express provision authorizes or prohibits using customer data to train, fine-tune, evaluate, or improve AI models.
• The revised policy adds broader references to processing data for:
• customer support and chat;
• statistical or historical purposes;
• fraud prevention;
• legal claims and regulatory compliance; and
• service providers’ auxiliary processing.
• These additions do not clearly include AI training, but the absence of a specific restriction may create uncertainty about whether customer-submitted content, chat data, or other service data could later be used for model development.
• The policy should expressly state whether:
• customer data and user content are excluded from AI training;
• de-identified or aggregated data may be used for model improvement;
• prompts, outputs, chats, or support interactions are retained;
• third-party AI providers may receive or use the data; and
• customers can opt out or request deletion from training datasets.

2. Expanded purposes and legal bases

The revised policy substantially expands the listed processing activities and relies on additional legal bases, including:

• consent for demo forms, newsletters, webinars, chat support, job applications, and optional cookies;
• legal obligations, including fraud prevention, communications with public authorities, and third-party claims; and
• administration of HOLDED’s rights, including pursuing legal claims and maintaining data for statistical or historical purposes.

Risk: Several purposes are broad and may not clearly distinguish between necessary service processing, optional marketing, analytics, and secondary uses. This could create transparency and purpose-limitation concerns under the GDPR.

3. Retention and deletion

• The former general retention language is replaced with more detailed criteria based on the purpose of collection, consent periods, support needs, legal obligations, and claims.
• Data that is no longer needed may be deleted or anonymized.
• HOLDED may retain data to comply with legal obligations, administer rights, or preserve statistical/historical records.

Risk: “Statistical or historical purposes” and legal-claim retention may permit longer retention than users would expect. The policy does not provide precise periods for many categories.

4. Recipients and international transfers

• The revised policy adds broader disclosure to service providers, including webinar provider Livestorm and providers supporting processing activities.
• It states that data will not be sold to third parties.
• International transfers outside the EEA are now addressed through safeguards such as adequacy measures, Binding Corporate Rules, or EU Standard Contractual Clauses.

Risk: The policy remains general about the identity and locations of providers and does not specifically address foreign AI providers or subprocessors.

5. User rights and liability

• Rights are expanded and clarified, including access, rectification, erasure, restriction, portability, objection, and safeguards against solely automated decision-making.
• Users are made more responsible for accuracy and HOLDED’s liability disclaimers are broadened.
• Security language is updated to mention TLS/HTTPS but emphasizes that internet security is not impregnable.

Overall assessment: The revision improves GDPR-style disclosures but materially broadens processing, retention, provider access, and transfer language. A dedicated AI-data-use clause is recommended.

Summary

The provided diff does not include the actual contractual language that was added, deleted, or replaced. It only states:

> “Added approximately 374 words to the document”

Accordingly, no reliable legal analysis can be performed.

AI Training and Customer Data

The diff does not identify whether the contract:

• Allows the provider to use customer data, prompts, outputs, or usage information to train AI models;
• Limits training use to aggregated, anonymized, or de-identified data;
• Requires the customer’s consent before training;
• Allows the customer to opt out of training;
• Permits use of data to improve models for other customers or commercial purposes;
• Gives the provider rights to retain data after termination;
• Addresses confidential information, personal data, or regulated data in connection with AI training; or
• Allocates responsibility for privacy, security, intellectual-property, or model-output risks.

Legal Risk Assessment

Because the underlying additions and deletions are missing, it is not possible to determine whether the changes:

• Expand the provider’s license to customer data;
• Reduce confidentiality or data-protection obligations;
• Create broader rights to use customer content;
• Change ownership of inputs, outputs, or derived data;
• Introduce new disclosure, retention, or subprocessors provisions; or
• Shift liability to the customer.

Information Needed

Please provide the actual redline text, including the words shown in {additions}, [deletions], and []{replacements}. The statement that approximately 374 words were added is insufficient to identify the legal effects or any changes concerning AI-model training.

Executive Summary

The revised privacy policy substantially reorganizes and expands HOLDED’s disclosures. It adds more detailed legal bases, retention rules, recipients, international-transfer safeguards, data-subject rights, and security language. However, the diff does not add any express provision authorizing or prohibiting the use of customer data to train artificial-intelligence models.

AI Training and Model Use

• No language expressly states that customer data, user content, prompts, account information, or support communications may be used to train, fine-tune, evaluate, or improve AI models.
• No language expressly prohibits such use.
• The policy continues to describe processing in broad terms, including:
• customer support and chat;
• statistical or historical purposes;
• product and service communications;
• use of third-party service providers.
• These general purposes might be argued to cover analytics or service improvement, but they do not clearly disclose AI training or identify the relevant legal basis, retention period, model providers, or opt-out rights. If HOLDED uses customer data for AI training, a specific disclosure and contractual treatment would be advisable.

Important Changes and Risks

1. Broader and more detailed processing purposes

The policy now covers applications, webinars, chat support, optional cookies, fraud prevention, communications with authorities, and third-party claims. This increases transparency but also expands the stated processing framework.

2. Retention and deletion

The former general retention language is replaced with purpose-based criteria. HOLDED may retain data for:

• legal or regulatory obligations;
• exercising or defending legal claims;
• statistical or historical purposes;
• the relevant consent or support period.

Although data is said to be deleted when no longer needed, the exceptions may permit extended retention. “Statistical or historical purposes” is relatively broad and should be tied to anonymization where possible.

3. Third-party access and international transfers

The revised text clarifies that service providers may access data under HOLDED’s instructions and Article 28 GDPR processor agreements. It also introduces transfers outside the EEA using adequacy measures, Binding Corporate Rules, or European Commission standard contractual clauses.

Risk: the policy does not identify all relevant providers, countries, or specific transfer mechanisms for each service.

4. Marketing

Marketing language is revised from HOLDED sending communications directly to communications being sent “outside the company,” apparently through third-party providers. This increases reliance on external marketing platforms and should be supported by appropriate consent, processor arrangements, and transfer safeguards.

5. User rights

The policy adds or clarifies rights to information, rectification, erasure, restriction, portability, objection, and safeguards against solely automated decisions. It also adds the right to complain to a data-protection authority.

6. Liability and security disclaimers

The revised wording more broadly disclaims responsibility for inaccurate third-party information, service interruptions, cyber incidents, and events beyond HOLDED’s control. These disclaimers may not eliminate mandatory GDPR or contractual liability.

7. Drafting quality

The diff contains extensive duplicated and apparently malformed text, inconsistent numbering, and awkward replacements. The final published version should be checked carefully for coherence and legal accuracy.

Summary

The diff does not include the actual added or revised contractual language. It only states:

> “Added approximately 374 words to the document”

Accordingly, it is not possible to determine:

• What contractual obligations or rights changed;
• Whether liability, confidentiality, privacy, security, payment, termination, or governing-law provisions were modified;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data may be shared with affiliates, service providers, or third parties;
• Whether the customer can opt out of AI training or request deletion of data used for that purpose; or
• Whether any new risks, warranties, indemnities, or limitations of liability were added.

AI Training and Data Use

No specific change concerning the use of customer data to train AI models can be identified from the provided diff. The added text itself is not included, so there is no basis to conclude whether the contract:

• Permits training on customer content, prompts, outputs, metadata, or usage data;
• Limits training to de-identified or aggregated information;
• Allows human review or retention of customer data;
• Grants the provider ownership or broad usage rights;
• Provides an opt-out, deletion right, or contractual restriction on model training; or
• Applies different rules to consumer, business, or confidential data.

Required Information

Please provide the actual 374-word addition and any surrounding deleted or replacement language. Without the substantive text, a legal comparison and risk assessment cannot reliably be performed.

Summary of Important Changes

AI Training and Model Use

• No express reference to AI, machine learning, generative AI, model training, fine-tuning, or using customer data to improve AI systems appears in the diff.
• The revised policy adds or clarifies several processing purposes—such as chat support, webinars, fraud prevention, statistical or historical purposes, and optional cookies—but does not expressly authorize using customer data to train AI models.
• The policy should not be read as granting a clear AI-training right. If HOLDED intends to use customer or user content, prompts, conversations, support tickets, or other data for model training, that purpose should be stated separately and precisely, including:
• the categories of data involved;
• whether data is anonymized or identifiable;
• whether third-party AI providers receive the data;
• the legal basis;
• retention and deletion rules; and
• available opt-out or objection rights.

Expanded Processing Purposes and Legal Bases

• The policy replaces the previous, narrower descriptions of forms and trial registration with broader purposes, including:
• demo applications and registrations;
• newsletters and marketing;
• job applications;
• webinars;
• chat and customer support;
• optional cookies; and
• fraud prevention, communications with public authorities, and third-party claims.
• It more clearly links certain processing to consent, legal obligations, contractual needs, and rights administration. However, the drafting remains heavily consolidated and may not clearly identify the legal basis for every purpose, creating transparency and GDPR compliance risk.
• Retention language is substantially expanded. HOLDED may retain data for legal or regulatory obligations, claims, statistical or historical purposes, and until the end of a requested support or communications period. This is broader than a simple “delete when no longer needed” standard.

Disclosures and Service Providers

• The policy now expressly states that data will never be sold to third parties.
• It adds more detail about processors and service providers, including Livestorm for webinars, processor agreements under GDPR Article 28, confidentiality obligations, and security requirements.
• Providers may access data only for the stated service purpose and under HOLDED’s instructions. Nevertheless, the categories of providers and data accessed remain somewhat general.

International Transfers

• The policy changes from generally stating that data is stored in the EU to acknowledging transfers outside the EEA.
• HOLDED refers to safeguards including adequacy measures, Binding Corporate Rules, and European Commission standard contractual clauses. This improves disclosure but still leaves uncertainty about the actual destination countries, providers, and applicable transfer mechanism.

Rights and Security

• Data-subject rights are expanded or clarified, including access/information, rectification, erasure, restriction, portability, objection, and rights concerning solely automated decision-making.
• The policy adds a right to complain to the competent data-protection authority.
• Security language is updated to mention TLS/RSA encryption and HTTPS, while also adding broad disclaimers for outages, cyber incidents, third-party intrusions, and other technical failures. These disclaimers may limit expectations but cannot remove mandatory GDPR security or liability obligations.

Key Risks

• Broad and sometimes grammatically unclear drafting may undermine transparency and informed consent.
• Retention for “statistical or historical purposes” and rights administration could permit longer retention than users expect.
• International-transfer disclosures are improved but not sufficiently specific.
• No AI-training permission is added; any intended model-training use remains undisclosed and should be addressed expressly.

Structured Summary of Important Changes

1. Expanded company identification and contact details

• HOLDED is now identified as HOLDED TECHNOLOGIES SL, with its Barcelona address, tax ID, and DPO email.
• The policy expressly states that HOLDED has appointed a Data Protection Officer.
• Risk/impact: This improves transparency and gives users a clearer contact point for privacy requests.

2. New and expanded processing purposes

The revised policy adds or clarifies processing for:

• “Contact us” forms, including name, email, phone number, and optional text messages.
• 14-day free-trial registration, including name, surname, phone, email, and password.
• Registration through Google and Facebook, with the implication that those providers will also process personal data.
• Customer support through instant messaging/chat, including email and information users choose to provide.
• Job applications, including name, contact details, CV, and optional photograph.
• Applications submitted through LinkedIn and Indeed.
• Webinar registration, including use of Livestorm.
• Marketing communications concerning products, services, promotions, and events.

Risk/impact: The purposes and categories of data are substantially broader and more detailed. Users may provide information through external platforms whose own privacy terms will also apply.

3. Marketing and withdrawal rights

• Marketing data may be used to send communications about HOLDED’s products, services, promotions, and events.
• Users may opt out at any time using email instructions or by contacting HOLDED.
• Data may be deleted or anonymized so the individual can no longer be identified.

Risk/impact: Marketing purposes are broader than the previous wording. The policy does not clearly explain whether all marketing processing relies on consent or another legal basis.

4. Retention periods are more flexible

• The former general wording—retaining data only as long as necessary for the collection purpose—is replaced with detailed, purpose-based criteria.
• HOLDED may retain data for legal or regulatory obligations, claims, statistical or historical purposes, and rights management.

Risk/impact: Retention may extend beyond the original service interaction, particularly where legal, claims, statistical, or historical justifications are invoked. No precise maximum periods are provided for several categories.

5. Third-party providers and international transfers

• The policy names or refers to Google, Facebook, LinkedIn, Indeed, Livestorm, chat providers, and other service providers.
• It states that providers may access data to perform services and that Article 28 GDPR processor agreements will be used.
• International transfers outside the EEA may occur, with safeguards described as processor contracts, Binding Corporate Rules, or European Commission Standard Contractual Clauses.
• Users may request information about providers by contacting the DPO.

Risk/impact: The revised policy expressly permits broader reliance on external providers and possible non-EEA transfers. The actual provider list and transfer destinations are not included directly.

6. Data-subject rights and automated decision-making

• Rights are reorganized and expanded, including erasure, restriction, portability, objection, complaints, and rights concerning solely automated decisions or profiling.
• The contact email for exercising rights is clearly stated.

7. AI-model training

• No express provision authorizes or describes using customer data, personal data, chat content, uploaded information, or service data to train, fine-tune, evaluate, or improve AI models.
• The diff contains no meaningful AI-training disclosure, restriction, opt-out, retention rule, or statement that customer data will not be used for training.
• Risk/impact: The absence of an AI-specific provision leaves uncertainty. The broad wording permitting processing of information supplied through chat or services could create ambiguity if HOLDED later uses such information for AI development. A separate, explicit AI-use clause should be requested or added.

Summary of Important Changes

AI model training

• No express provision authorizes or prohibits using customer data to train AI models.
• The revised policy does not mention artificial intelligence, machine learning, model training, prompts, inputs, outputs, or whether customer data is used to improve HOLDED’s services.
• Accordingly, the policy does not provide a clear contractual commitment that customer data will not be used for AI training. If AI functionality is offered elsewhere, the applicable service terms, data-processing agreement, or product-specific documentation should be reviewed.
• The revised language permitting access by service providers is limited to processing under HOLDED’s instructions and for performing the contractual relationship. It does not expressly address whether providers may use data for their own model training or service improvement.

Expanded processing purposes and legal bases

• The policy adds processing activities for:
• Job applications;
• Webinar registration;
• Chat-based customer support;
• Optional cookies accepted by the user;
• Fraud prevention;
• Communications with public authorities; and
• Third-party claims.
• Consent is identified as a legal basis for additional activities, including demo forms, newsletter registration, webinars, chat support, and optional cookies.
• Legal obligations are added as a basis for fraud prevention, regulatory communications, and third-party claims.
• The policy now refers more broadly to processing necessary to administer HOLDED’s rights, including pursuing claims in court.

Retention and deletion

• Retention language is replaced with more detailed criteria based on the purpose of collection, the period of consent or support, legal obligations, and potential claims.
• Data may be retained for legal or regulatory compliance, rights administration, statistical or historical purposes, or litigation.
• Job-application data will generally be deleted from systems when no longer needed, but may be retained as records or anonymized.

Recipients and third parties

• The policy expressly states that data will never be sold to third parties.
• It identifies external providers, including Livestorm for webinars, and permits service providers to access data under HOLDED’s instructions.
• Processor agreements under Article 28 GDPR are referenced.
• Disclosures to public authorities or other parties may occur where legally required and limited to what is necessary.

International transfers

• The prior general EU-storage statement is qualified: processing may involve transfers outside the EEA.
• HOLDED refers to safeguards including adequacy measures, Binding Corporate Rules, and European Commission standard contractual clauses.
• This creates greater transparency but also confirms a potential risk of non-EEA processing.

Rights, security, and liability

• Data-subject rights are expanded and clarified, including information, rectification, erasure, restriction, portability, objection, and protections concerning solely automated decisions.
• A right to complain to the competent data-protection authority is added.
• Security language is updated to mention TLS/RSA encryption and HTTPS.
• HOLDED adds broad disclaimers for outages, cyberattacks, third-party intrusions, and other technical failures, potentially limiting recovery for resulting losses.

Summary of Important Changes

1. Expanded company identification and contact details

• The policy now identifies the controller as HOLDED TECHNOLOGIES SL, with its Barcelona address, tax ID, and DPO email.
• The DPO contact is stated as dpo@holded.com.
• This provides more complete controller information than the prior “HOLDED”/“Organization” wording.

2. Broader and more detailed data collection

The revised policy describes additional processing for:

• Free-trial registration: name, surname, phone, email, and password.
• Social-login registration: data processed through Google and Facebook.
• Customer support/chat: email and any information voluntarily provided through the chat.
• Job applications: name, surname, email, telephone number, CV, and optional photograph; applications may be submitted through LinkedIn and Indeed.
• Webinars: email address, including registration through Livestorm.
• Marketing: personal data supplied when creating an account or subscribing to newsletters may be used for communications about products, services, promotions, and events.

These additions increase the categories of personal data and third-party platforms covered by the policy.

3. Expanded purposes and legal bases

The updated wording adds or clarifies processing for:

• Managing the platform’s free-trial service.
• Providing customer and user support.
• Managing employment applications.
• Administering webinar registrations.
• Sending marketing communications.
• Fraud prevention, communications with public authorities, legal obligations, and third-party claims.

Marketing communications may be sent subject to the applicable legal basis. Users may opt out through email instructions or by contacting HOLDED.

4. Retention periods are less specific in places

The prior policy contained more purpose-specific retention language. The revised policy generally states that data will be retained:

• For as long as necessary for the purpose collected.
• For the period required by law or regulation.
• To establish, exercise, or defend legal claims.
• For statistical or historical purposes, where applicable.

This may permit longer retention than users would expect, particularly for legal, statistical, or historical purposes.

5. Third-party providers and international transfers

• The policy now expressly references Google, Facebook, LinkedIn, Indeed, and Livestorm.
• HOLDED states that providers may access data to perform services and that processor agreements under GDPR Article 28 are used.
• International transfers outside the EEA are expressly contemplated, using processor agreements, Binding Corporate Rules, or European Commission standard contractual clauses.
• Users may request information about relevant providers by contacting the DPO.

6. Data-subject rights and automated decision-making

The policy more clearly describes rights to access, rectification, erasure, restriction, portability, objection, and complaint to a data-protection authority.

It also expressly addresses decisions based solely on automated processing or profiling that produce legal or similarly significant effects. This is a clarification, not an express statement that HOLDED currently makes such decisions.

7. AI model training

No express authorization or prohibition concerning AI training appears in the supplied diff. The revised text does not state that customer data, account data, chat content, CVs, or other personal data may be used to train, fine-tune, evaluate, or improve AI models.

Accordingly:

• The policy does not create a clearly stated AI-training permission.
• It also does not provide a specific opt-out, retention rule, anonymization standard, or assurance that data will not be used for AI training.
• This omission should be clarified, especially if HOLDED or its service providers use customer content in AI systems.

Summary of Important Changes

AI Training and Model Use

• No express provision authorizing or prohibiting AI training was added.
• The revised policy does not state whether customer or user data—including chat content, support inquiries, webinar registrations, applications, cookies, or other submitted information—may be used to train, fine-tune, evaluate, or improve artificial-intelligence models.
• This omission is significant if HOLDED or its service providers use such data for AI development. The policy should clearly distinguish:
• Service delivery and support;
• Product analytics and statistical purposes;
• AI model training or evaluation;
• Whether data is anonymized, aggregated, or retained;
• Whether customer content is shared with AI vendors; and
• Whether customers can opt out.
• The revised wording that external providers may access data “for the sole purpose of properly performing” the contractual relationship supports a limited processor role, but it does not clearly address secondary AI-training uses. Any such use could create purpose-limitation, transparency, confidentiality, and GDPR lawful-basis risks.

Expanded Processing Purposes and Legal Bases

• Processing purposes now expressly include:
• Job applications;
• Webinar registration;
• Chat-based customer support;
• Optional cookies accepted by the user; and
• Fraud prevention, communications with public authorities, and third-party claims.
• The policy adds or clarifies several legal bases, including consent and compliance with legal obligations. However, the drafting appears heavily reorganized and internally inconsistent, creating uncertainty about which legal basis applies to each processing activity.
• Marketing communications remain consent-based, with an opt-out mechanism.

Retention and Deletion

• Retention language is substantially expanded. Data may be retained:
• For the time needed to resolve inquiries or provide support;
• Until the end of a consent or regulatory period;
• To comply with legal obligations;
• To administer or pursue legal claims; and
• For statistical or historical purposes.
• Job-application data will be deleted or anonymized when no longer needed, but broad legal, claims, statistical, and historical exceptions may permit longer retention.

Recipients and International Transfers

• The policy identifies service providers, including Livestorm, and states that processors may access data under HOLDED’s instructions and GDPR Article 28 agreements.
• It expressly states that data will never be sold to third parties.
• International transfers outside the EEA are now addressed through adequacy safeguards, Binding Corporate Rules, or European Commission standard contractual clauses.
• The list of recipients remains general; users may need to contact HOLDED for provider details.

Rights, Security, and Liability

• Data-subject rights are expanded or clarified, including access, rectification, erasure, restriction, portability, objection, and safeguards against solely automated decisions.
• Users are directed to the competent data-protection authority for complaints.
• Security language adds TLS/RSA encryption and HTTPS, but broadly disclaims responsibility for outages, attacks, and other events beyond HOLDED’s control.
• HOLDED may terminate services where submitted data is false, incomplete, inaccurate, or outdated.

Key Risks

• The policy’s fragmented wording may create ambiguity about purposes, legal bases, retention periods, and provider roles.
• The absence of an AI-training clause leaves a material transparency gap and does not provide a clear customer choice regarding model training or AI vendor use.

Summary of Important Changes

AI Model Training

• No express reference to artificial intelligence, machine learning, generative AI, model training, or use of customer data to train models appears in the supplied diff.
• The revised policy does not clearly authorize or prohibit using customer content, account data, support chats, or other personal data for AI training.
• Because the policy refers broadly to processing data to provide products and services and to third-party service providers, customers should seek clarification on whether any AI vendors process customer data and whether such data is used for training, fine-tuning, evaluation, or product improvement.
• The absence of an AI-training provision creates uncertainty, rather than a clear new permission to train models.

Expanded Data Collection and Processing

The revised policy adds or clarifies processing for:

• 14-day free trials, including name, surname, phone number, email, and password.
• Registration through Google and Facebook, with personal data processed by those providers.
• Customer support through instant messaging/chat, including the email address and information voluntarily provided in chat.
• Job applications, including name, contact details, CV, and optional photograph; applications through LinkedIn and Indeed are also addressed.
• Webinar registrations, including email address, with Livestorm identified as a provider.
• Marketing communications about products, services, promotions, and events.

These changes increase the range of personal data and external platforms involved.

Marketing and Retention

• Marketing data may be used to send promotional communications, with an opt-out mechanism via email or direct contact.
• The policy states that data may be deleted or anonymized when no longer needed, but permits retention for legal or regulatory obligations, exercising legal rights, statistical or historical purposes, and other stated purposes.
• Retention language is generally broader and more flexible than the previous formulation.

Third-Party Sharing and International Transfers

• The revised policy identifies broader categories of service providers and states that they may access data to perform services for HOLDED.
• It retains a “no sale” statement, but permits disclosures to providers, public administrations, and other parties where legally necessary.
• International transfers outside the EEA are expressly contemplated, supported by processor agreements, Binding Corporate Rules, or European Commission Standard Contractual Clauses.
• Customers may contact the DPO for information about providers, but the policy does not provide a complete provider list.

Data Subject Rights and Liability

• GDPR rights are reorganized and expanded, including erasure, restriction, portability, objection, and safeguards concerning solely automated decisions.
• The policy places stronger responsibility on users for the accuracy, validity, authenticity, and updating of submitted data, while seeking to limit HOLDED’s liability for inaccuracies.

Overall Risk

The revision materially broadens stated processing activities, third-party involvement, retention grounds, and transfer mechanisms. The principal unresolved issue is the lack of transparency about whether customer data—including chat or business data—is used in AI systems or shared with AI providers.

Summary

The diff indicates that approximately 374 words were removed from the document. However, the actual deleted text is not provided.

Key Legal and Commercial Risks

Because the deleted language is unspecified, it is not possible to determine:

• Which obligations, rights, warranties, or limitations were removed.
• Whether liability protections, confidentiality requirements, security commitments, or termination rights were weakened.
• Whether commercial terms, service levels, pricing provisions, or dispute-resolution terms changed.
• Whether any provisions favorable to the customer were deleted.

The removal of a substantial block of text creates a risk that important protections or restrictions have been eliminated, but the impact cannot be reliably assessed without the underlying language.

AI Training and Customer Data

The provided diff does not show whether the document’s treatment of customer data has changed in relation to AI models. In particular, it is not possible to determine whether the deletion:

• Permits or restricts using customer data to train, fine-tune, or improve AI models.
• Changes whether customer data may be used for product development, analytics, or benchmarking.
• Removes requirements to de-identify, aggregate, or anonymize data before use.
• Changes ownership or licensing rights in customer data, inputs, outputs, or derived data.
• Removes consent requirements or opt-out rights for AI training.
• Changes confidentiality, security, retention, or deletion obligations applicable to data used for AI purposes.
• Allows data to be shared with affiliates, vendors, or third-party model providers.

Recommended Next Step

Provide the actual 374 words that were removed, or a redline showing the deleted provisions. Those provisions should be reviewed specifically for language such as:

• “train,” “fine-tune,” “improve,” or “develop” models;
• “machine learning,” “artificial intelligence,” or “derived data”;
• rights to use “usage data,” “customer data,” “inputs,” or “outputs”; and
• consent, opt-out, anonymization, deletion, confidentiality, or data-retention terms.

Without the deleted text, no reliable conclusion can be reached about the legal effect of the change or any AI-training rights.

Executive Summary

The revised policy substantially expands and reorganizes the descriptions of personal-data processing. It adds more detailed processing purposes, new categories of data, additional third-party providers, and broader retention language. The diff does not expressly authorize using customer data to train, fine-tune, evaluate, or improve AI models. However, it also does not expressly prohibit such use or clarify whether customer content submitted through the platform may be used for AI purposes.

Key Changes and Risks

1. New and expanded data collection

The policy now identifies processing of:

• Name, surname, email, telephone number, password, and chat communications.
• Job-application information, including CVs and optional photographs.
• Data obtained through Google, Facebook, LinkedIn, Indeed, and Livestorm.
• Information users choose to provide through chat and support channels.

Risk: The wording “any other information you decide to communicate” may permit collection of broad, unstructured information, potentially including confidential business data or sensitive personal data.

2. Broader processing purposes

New or clarified purposes include:

• Operating free-trial registrations.
• Providing customer support through instant messaging.
• Sending marketing communications about products, services, promotions, and events.
• Managing webinars and recruitment applications.
• Administering legal rights and retaining data for statistical or historical purposes.

Risk: Marketing and “statistical or historical” purposes may allow secondary use beyond the original service interaction. The policy should specify whether statistical use is aggregated or anonymized and whether it includes customer-generated content.

3. AI-model training

• No express language has been added permitting or restricting AI training, model improvement, profiling, or generative-AI development.
• The expanded references to chat data, support communications, statistical purposes, historical purposes, and “any other information” could create ambiguity about whether such data may be used in analytics or AI systems.
• The policy adds language concerning automated decision-making and profiling rights, but this concerns individuals’ rights and does not itself authorize AI training.

Recommended clarification: State expressly whether customer data—including uploaded content, support chats, prompts, outputs, and business records—may be used to train or improve AI models. If permitted, identify the legal basis, opt-out mechanism, retention period, anonymization standards, model providers, and whether data is used for general or customer-specific models.

4. Third-party and international transfers

The policy now names or references multiple external providers and permits access for service delivery. It adds safeguards for transfers outside the EEA, including processor agreements, Binding Corporate Rules, and European Commission standard contractual clauses.

Risk: The provider list is not fully itemized, and the policy directs users to contact HOLDED for details. Customers may lack transparency regarding which vendors, including AI vendors, access their data.

5. Retention and deletion

Retention is now tied to the purpose, legal obligations, rights enforcement, statistical/historical purposes, and regulatory periods.

Risk: Retention remains potentially open-ended, especially for statistical or historical uses. The policy should provide clearer periods or objective criteria for customer content and AI-related data.

Summary

Scope of the Change

• The diff states that approximately 374 words were removed from the document.
• However, the actual deleted language is not provided. As a result, it is not possible to determine precisely:
• Which rights or obligations were removed;
• Whether liability, confidentiality, security, data-use, or termination provisions changed; or
• Whether the customer’s data may now be used to train AI models.

AI Training and Data Use

• No specific AI-training language appears in the supplied diff.
• The deletion could nevertheless be important if the removed text addressed:
• Whether customer data, prompts, outputs, or usage data may be used to train or improve AI models;
• Whether such use requires customer consent or an opt-out;
• Whether data is anonymized, aggregated, or de-identified before use;
• Whether human reviewers, contractors, or third-party model providers may access the data;
• Whether customer data is retained after termination; or
• Whether the provider must delete customer data from training datasets or models.

Potential Legal Risks

Because the deleted wording is unavailable, the principal risk is loss of contractual protections through omission. In particular, removing provisions could:

• Expand the provider’s practical ability to use or disclose customer data if no separate restriction remains;
• Eliminate an express prohibition on using customer content for model training;
• Remove consent, notice, opt-out, deletion, or audit rights;
• Reduce the provider’s confidentiality or security obligations;
• Remove limits on use of data by affiliates or subprocessors;
• Create ambiguity about ownership and permitted use of AI-generated outputs; or
• Weaken remedies if data is used improperly.

These risks depend on the remaining agreement and any incorporated privacy policy or product terms.

Recommended Review

Obtain the full redline or the text of the 374 deleted words before approving the change. Confirm that the agreement expressly states:

1. Whether customer data and prompts may be used to train or improve AI models;

2. Whether training use is prohibited by default or requires affirmative consent;

3. Whether inputs and outputs are retained, reviewed, or shared with third parties;

4. What de-identification or aggregation standards apply;

5. Whether the customer can opt out and require deletion; and

6. That customer data will not be used for unrelated purposes without authorization.

Bottom line: The available diff is insufficient to identify the precise change, but deletion of data-use or AI provisions could materially reduce the customer’s protections.

Summary of Important Changes

1. No express AI-training authorization identified

• The diff does not appear to add any provision expressly allowing HOLDED to use customer data, account data, uploaded content, communications, or usage data to train, fine-tune, evaluate, or improve AI models.
• It also does not expressly prohibit such use.
• The revised policy refers generally to processing data to provide and support HOLDED’s products and services, but that wording should not automatically be treated as consent to AI training, particularly for customer business data or communications.
• The policy should be checked against the service terms, product-specific AI terms, data-processing agreement, and any “AI features” documentation, which may contain separate training rights or opt-out mechanisms.

2. Expanded and more specific data collection

The revised policy adds or clarifies processing for:

• Free-trial registration, including name, surname, phone, email, and password.
• Registration through Google and Facebook, with personal data processed by those providers.
• Customer support through chat, including email and any information voluntarily provided.
• Job applications, including CVs and optional photographs, and applications through LinkedIn and Indeed.
• Webinar registration through Livestorm.
• Marketing communications concerning products, services, promotions, and events.

Risk: “Any other information you decide to communicate” through chat is broad and could capture confidential, sensitive, or customer business information without clear limits on use.

3. Broader marketing use

• Marketing data may now be used to send communications about products, services, promotions, and events.
• The revised wording provides an opt-out through email instructions or by contacting HOLDED.
• The policy no longer focuses only on deletion from systems; it allows continued processing in anonymized form where the individual can no longer be identified.

Risk: The scope of promotional communications is broader, and the policy does not clearly distinguish consent-based marketing from other legal bases.

4. Retention periods are less specific

• The former policy used more purpose-specific retention descriptions.
• The revised policy generally retains data as long as necessary for the relevant purpose, legal obligations, claims, rights management, or statistical/historical purposes.

Risk: These standards are flexible and may permit longer retention, with no concrete time limits for many categories.

5. Third-party providers and international transfers

• The revised policy names or identifies additional providers, including Google, Facebook, LinkedIn, Indeed, and Livestorm.
• It confirms processor agreements under GDPR Article 28 and describes safeguards such as Standard Contractual Clauses and Binding Corporate Rules.
• It states that data is generally stored in the EU but may be transferred outside the EEA.

Risk: More providers and international transfers increase the number of parties and jurisdictions involved. The policy does not provide a complete provider list directly, instead directing users to contact HOLDED.

6. Other notable changes

• HOLDED’s full legal identity, Barcelona address, tax ID, and DPO email are added.
• Data-subject rights are reorganized and expanded, including portability, restriction, objection, and rights relating to automated decision-making.
• Users receive stronger responsibility for the accuracy and updating of submitted data.

Summary of Important Changes

1. Expanded processing purposes and legal bases

• The policy now expressly covers additional activities, including:
• Job applications and recruitment.
• Webinar registration.
• Customer support through chat and instant messaging.
• Optional cookies accepted by the user.
• Fraud prevention, communications with public authorities, and handling third-party claims.
• Consent is identified as the legal basis for several activities, including demo forms, newsletter registration, webinars, chat support, and optional cookies.
• Legal obligations are added as a basis for fraud prevention, regulatory communications, and third-party claims.

Risk: The policy appears to group many distinct processing activities under broad consent language. Consent may need to be specific, informed, granular, and separately collected for each purpose.

2. New and more detailed retention rules

• The former general retention language is replaced with purpose-based criteria, including:
• Keeping inquiry data until the request is resolved.
• Retaining consent-based data until consent is withdrawn or the relevant period ends.
• Retaining information for legal, regulatory, statistical, historical, or litigation purposes.
• Recruitment data will be deleted or anonymized when no longer needed, rather than necessarily being deleted immediately.

Risk: “Statistical or historical purposes” and legal-claim retention are broad and should be supported by documented retention periods and appropriate safeguards.

3. Broader disclosures to providers and third parties

• The policy identifies external providers, including Livestorm for webinars, and permits service providers to access data under HOLDED’s instructions.
• It adds references to GDPR Article 28 processor agreements.
• The policy states that data will not be sold to third parties.
• Disclosure to public authorities or other parties may occur where legally required.

Risk: The provider categories remain relatively general, and the policy does not provide a complete or readily accessible list of processors, purposes, or locations.

4. International transfers

• The policy now expressly addresses transfers outside the EEA.
• Safeguards may include adequacy measures, Binding Corporate Rules, and European Commission Standard Contractual Clauses.

Risk: The wording does not identify the countries, specific transfer mechanisms used for each provider, or supplementary measures. “Necessary security measures” is not itself a complete transfer explanation.

5. Expanded data-subject rights

The revised policy adds or clarifies rights relating to:

• Access and information.
• Rectification.
• Erasure.
• Restriction of processing.
• Data portability.
• Objection.
• Protection against solely automated decisions producing legal or similarly significant effects.
• Complaints to the competent data-protection authority.

6. Liability and security disclaimers

• HOLDED adds broader disclaimers for inaccurate user-provided information, third-party content, service interruptions, cyber incidents, and events outside its control.
• It states that internet security measures are not impregnable and mentions TLS/HTTPS encryption.

Risk: These disclaimers may attempt to limit responsibility, but they cannot override mandatory GDPR security and accountability obligations.

7. AI-model training

No provision in the supplied diff expressly authorizes, restricts, or explains use of customer data to train, fine-tune, evaluate, or improve AI models. The revised policy also does not define whether chat, support, webinar, cookie, or product-use data may be used for AI training.

Key gap/risk: If HOLDED or its providers use customer data for AI training, this purpose should be stated clearly, with the applicable legal basis, data categories, opt-out or objection rights where relevant, retention, provider disclosures, and international-transfer details.

Executive Summary

The revised policy substantially rewrites and reorganizes the privacy notice. It adds more detailed descriptions of collection channels, service providers, retention, international transfers, and data-subject rights. However, the diff appears heavily fragmented or mechanically merged, creating possible drafting and compliance risks.

Key Changes and Risks

1. Expanded personal-data collection

The revised policy identifies additional data and collection contexts, including:

• Free-trial registration: name, surname, phone, email, and password.
• Social-login registration through Google and Facebook.
• Customer support through chat: email and other information voluntarily provided.
• Job applications: name, contact details, CV, and optional photograph.
• Applications through LinkedIn and Indeed.
• Webinar registration through Livestorm.
• Marketing and communications data, including information supplied when creating an account or subscribing to newsletters.

Risk: The policy now covers more processing activities, but the legal bases and purposes are not always clearly matched to each category. The language should be checked for completeness and consistency under GDPR transparency requirements.

2. Marketing communications and opt-out

The revised policy states that data may be used for marketing communications concerning products, services, promotions, and events. It adds that users may opt out through email instructions or by contacting HOLDED.

Risk: The policy should clearly distinguish consent-based marketing from marketing based on legitimate interests, identify applicable electronic-marketing rules, and explain whether opting out affects service communications.

3. Retention periods broadened

The prior wording focused on retaining data only as long as necessary for the purposes for which it was collected. The revised wording adds retention for:

• Legal and regulatory obligations.
• Administration and enforcement of HOLDED’s rights and claims.
• Statistical or historical purposes.
• Other information needed to manage services and support.

Risk: These are broader and less specific retention grounds. The policy should provide concrete periods or clear criteria for each processing activity, particularly for chat records, job applications, marketing data, and trial-account information.

4. Third-party providers and international transfers

The revised policy names or references external providers, including Google, Facebook, LinkedIn, Indeed, and Livestorm. It states that providers may access data to perform services and that Article 28 GDPR processor agreements, Binding Corporate Rules, or European Commission standard contractual clauses may be used.

Risk: The policy does not provide a complete provider list or clearly identify each provider’s role, processing location, and transfer mechanism. The international-transfer wording should be verified against the actual vendor arrangements.

5. Data-subject rights updated

The revised policy expressly describes rights of access, rectification, erasure, restriction, portability, objection, and safeguards concerning solely automated decisions. It also provides the DPO email address for requests and complaints.

Risk: The wording concerning erasure and legal-retention exceptions should be reviewed for accuracy and clarity.

AI Training and Model Use

No express provision in the supplied diff authorizes HOLDED to use customer or user data to train, fine-tune, evaluate, or improve AI models. The revised policy refers generally to statistical or historical purposes and anonymization, but those terms do not clearly authorize AI training, especially where personal data or identifiable customer content could be involved.

Important implication: If HOLDED intends to use customer data, support chats, account data, or uploaded content for AI training, this policy does not clearly disclose that purpose, define the data involved, identify the legal basis, or explain opt-out/deletion rights. A specific AI-training provision and corresponding contractual terms should be considered.

Summary of Important Changes

AI model training

• No express provision was added or removed concerning the use of customer data to train, fine-tune, evaluate, or improve AI models.
• The revised policy does not grant HOLDED an explicit license to use customer content, account data, chat data, or other personal data for AI training.
• However, the policy broadly refers to processing data for service provision, statistics, historical purposes, legal compliance, fraud prevention, support, and administration of HOLDED’s rights. Depending on how HOLDED operates AI features, these purposes could potentially be used to justify some model-development activities unless contract terms or product-specific documentation impose stricter limits.
• Customers should seek clarification in the applicable service agreement, DPA, AI terms, or subprocessor list regarding:
• Whether customer content is used for model training or product improvement;
• Whether data is de-identified or aggregated first;
• Whether training is performed by HOLDED or third-party providers;
• Whether customers can opt out; and
• How deletion requests affect training data, logs, and model outputs.

Expanded processing purposes and legal bases

• The policy adds or clarifies processing for job applications, webinars, chat-based customer support, optional cookies, fraud prevention, communications with public authorities, and third-party claims.
• Consent is identified as a legal basis for a wider range of activities, including demo forms, registrations, newsletters, webinars, chat support, and optional cookies.
• Compliance with legal obligations is expressly added as a basis for fraud prevention, regulatory communications, and third-party claims.
• These additions broaden HOLDED’s stated processing activities and may increase the range of uses for which customer data is retained or disclosed.

Retention and deletion

• The prior general retention language is replaced with more detailed criteria based on the purpose of collection, consent periods, support periods, legal obligations, and potential litigation.
• HOLDED may retain data for legal/regulatory compliance, pursuing claims, and statistical or historical purposes.
• Data no longer needed for active use may be deleted, retained in records, or anonymized. “Statistical or historical purposes” is relatively broad and may permit longer retention.

Disclosure to third parties and transfers

• The policy expressly states that data will not be sold to third parties.
• It clarifies that service providers may access data as processors under HOLDED’s instructions and Article 28 GDPR agreements.
• Livestorm is identified for webinar registration.
• International transfers outside the EEA are contemplated, supported by adequacy safeguards, Binding Corporate Rules, or European Commission standard contractual clauses.
• The policy permits disclosure to public authorities or others where legally required.

Rights and liability

• Data-subject rights are expanded and described more fully, including access, rectification, erasure, restriction, portability, objection, and rights relating to solely automated decision-making.
• HOLDED adds broader disclaimers concerning inaccurate third-party information, website availability, security incidents, and events beyond its control.
• Users assume greater responsibility for the accuracy and currency of submitted information, with possible termination for inaccurate or incomplete data.

Key risks to review

• Broad purposes and retention exceptions may permit extended use of data.
• No clear AI-training restriction or opt-out is included.
• International transfers and unidentified service providers may create transparency and transfer-risk concerns.
• The policy contains apparent drafting inconsistencies and malformed text, which may create interpretation and compliance uncertainty.

Summary

The diff does not include the actual added language. It only states that approximately 374 words were added. As a result, the legal and commercial impact cannot be reliably assessed.

AI Training and Data Use

• No specific language is provided concerning:
• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether prompts, inputs, outputs, usage data, or personal information are retained;
• Whether customer data is shared with affiliates, vendors, or third-party model providers;
• Whether data is anonymized, aggregated, or de-identified before use;
• Whether the customer may opt out of AI training or secondary data use; or
• Ownership and permitted use of AI-generated outputs.

Accordingly, no conclusion can be reached about whether the new wording expands or restricts the provider’s rights to use customer data for AI-related purposes.

Other Legal Risks

The text supplied does not permit analysis of potential changes to:

• Confidentiality and data-security obligations;
• Privacy-law compliance and data-processing terms;
• Intellectual-property ownership or licenses;
• Service limitations, warranties, or liability allocation;
• Data retention, deletion, or return obligations;
• Subcontracting or third-party access;
• Audit, suspension, or termination rights; or
• Governing law and dispute-resolution provisions.

Required for Further Review

Please provide the actual 374 words that were added, together with the surrounding contract language if possible. The additions should be reviewed for broad terms such as “improve,” “develop,” “train,” “analyze,” “aggregated,” “de-identified,” “service data,” and “usage data,” because these terms can materially expand the provider’s ability to use customer information, including for AI model development.

Summary

The diff indicates that approximately 374 words were removed from the document, but it does not identify:

• Which clauses were deleted;
• Whether any language was added or replaced;
• Whether the deleted text concerned data use, confidentiality, security, intellectual property, liability, or other terms.

AI Training and Customer Data

No specific change regarding the use of customer data to train AI models can be determined from the information provided.

In particular, the diff does not show whether the document now:

• Permits or prohibits using customer data to train, fine-tune, or improve AI models;
• Allows use of customer data for service improvement or product development;
• Permits human review or labeling of customer data;
• Allows customer data to be combined with other users’ data;
• Requires anonymization, de-identification, or aggregation before AI use;
• Gives the customer an opt-out or deletion right;
• Restricts retention of data used for training; or
• Addresses ownership of models, outputs, or intellectual property derived from customer data.

Potential Risks

The removal of approximately 374 words could create material risk if the deleted provisions previously:

• Restricted the provider’s rights to use customer data;
• Required confidentiality or data-security safeguards;
• Limited use of data to providing the contracted services;
• Required deletion or return of data;
• Allocated liability for unauthorized use or disclosure; or
• Gave the customer audit, consent, or opt-out rights.

Conversely, the deletion could reduce unnecessary restrictions or duplicate language. Its legal effect cannot be assessed without the actual deleted text and the surrounding provisions.

Information Needed

To perform a reliable legal comparison, provide either:

1. The full redline showing the deleted language; or

2. The prior and revised versions of the document.

Without that information, no definite conclusion can be reached about changes to AI training rights or other customer-data protections.