1. Data Controller
Cookies Policy
This Cookies Policy explains what cookies are, which ones we use on houseofmojo.es, for what purpose, and how you can manage them. It forms part of our Privacy Policy and should be read alongside it.
1. Controller
The controller of the website and of data collected via cookies is House of Mojo, S.L.
Tax ID: B-25943937
Registered office:
Carretera de Mijas Km 3.6, Centro Idea,
Las Lagunas (Málaga), 29651, Spain.
Contact:
privacy@houseofmojo.es
2. What Cookies Are
Cookies are small text files downloaded to your device when you visit a website. They allow the site to function, remember your preferences, and where applicable collect analytics or advertising information.
We also use similar technologies (pixels, local storage), which this policy also refers to as “cookies.”
3. Categories of Cookies We Use
Strictly Necessary
Essential for the site to work (security, navigation, consent management, and operation of the support chat). These cannot be disabled and do not require consent.
Preferences
Remember your settings, such as language, currency, and other display options.
Analytics
Help us understand how the site is used so we can improve it. We use Google Analytics. These cookies are only set with your consent.
Marketing
Used to show you relevant offers across House of Mojo properties and on partner platforms. We use Meta Pixel and Google Ads. These cookies are only set with your consent.
4. Legal Basis
Strictly necessary cookies rely on our legitimate interest in operating the site.
All other cookies (preferences, analytics, and marketing) rely on your consent, which you give through the cookie banner and can withdraw at any time.
5. How to Manage or Withdraw Consent
When you first visit the site, a banner lets you:
• Accept all cookies
• Reject all non-essential cookies
• Customise your preferences by category
You can change your preferences at any time through the cookie settings link available on the site.
You can also configure your browser to block or delete cookies; if you do, some site features may not be available.
6. Third-Party Cookies and International Transfers
Some cookies are managed by third parties (for example, Google and Meta), who may process data outside the European Economic Area, including in the United States.
In such cases, those providers apply appropriate safeguards under the GDPR, including, where relevant, standard contractual clauses approved by the European Commission and, where applicable, their certification under the EU–US Data Privacy Framework.
You can consult those providers’ privacy policies for more information.
7. Retention
The lifespan of each cookie varies by purpose:
• Session cookies are deleted when you close your browser.
• Persistent cookies remain for the period necessary for their purpose or until you delete them.
8. Changes
We may update this Cookies Policy to reflect technical, regulatory, or cookie changes.
The version in force is always the one published on the site.
AI Governance Procedure
1. Accountability and Allocation of Responsibility (Controlling Clause)
This clause governs the whole document and prevails over anything that might be read against it elsewhere.
1.1 Controller
House of Mojo, S.L. is the data controller, within the meaning of Article 4(7) GDPR, for the personal-data processing that the Company determines for Mette and for its client and lead relationships, and is the legal person responsible and accountable for that processing.
This has been the position, in law, since that processing began; it is recorded, not created, here.
Certain third parties act as independent or joint controllers for their own purposes — notably Google and Meta in respect of their analytics and advertising functions, and Meta in respect of the WhatsApp Business platform. This clause does not purport to make the Company the controller of that independent third-party processing.
1.2 Company Decisions
Every decision the Company makes about Mette — her design, the channels she runs on, the transparency approach in Section 5, retention, vendor selection, and the consent architecture — is a decision of the Company, taken by or under the authority of the controller representative, in the Company’s name and for the Company’s account.
No such decision is the personal decision of any individual.
1.3 Individuals Act for the Company
Any founder, officer, employee or contractor involved in Mette — including the person performing the AI-governance-owner role in Section 3 — acts solely as an agent of the Company, within the scope of authority the Company confers.
Performing a Company function does not make that person a controller of the processing and does not, of itself, give rise to personal controllership or accountability for it; that sits with the Company under Section 1.1.
The Company is responsible for the acts and omissions of such persons acting within the scope of their role.
1.4 Indemnity
The Company indemnifies and holds harmless each such individual, on the terms of a separate resolution of the Company to be adopted by its governing body, against claims, liabilities, penalties, losses and reasonable costs arising from work done for the Company in good faith and within the scope of their authority.
This covers work done from the inception of Mette to date and going forward.
The indemnity does not bind the AEPD, any court, or any third party, and does not extend to an individual’s own fraud, wilful misconduct, gross negligence, knowing breach of law, or any liability the law does not permit to be excluded.
1.5 Effect
No action undertaken by any individual acting within the scope of their functions for the Company shall displace the Company’s status as data controller or transfer any responsibility arising therefrom outside the Company.
Where responsibility is questioned in relation to any past or present processing activities determined by the Company, such responsibility shall rest with House of Mojo, S.L.
2. Purpose and Scope
This procedure sets out how House of Mojo, S.L. governs, oversees and maintains accountability for Mette, the artificial-intelligence assistant used to communicate with clients and prospective clients.
It applies to every channel on which Mette operates and to everyone involved in her configuration, supervision or maintenance, each of whom acts for the Company on the terms in Section 1.
3. System Description
Mette is a conversational AI assistant operating on behalf of House of Mojo and its brands across the website chat widget, WhatsApp, email, SMS and telephone, in up to 14 languages.
She is built on third-party services retained by the Company as processors.
Production Stack
- Language-model reasoning (the “brain”) — Anthropic (Claude) and OpenAI (GPT family), United States.
- Voice orchestration — Vapi, United States.
- Conversational voice and speech synthesis — ElevenLabs, United States.
- CRM and lead management — HubSpot, United States.
- Knowledge retrieval (RAG) and lead memory — Pinecone, United States.
- Telephony, SMS and WhatsApp transport — Twilio, United States.
- WhatsApp Business platform — Meta, United States / Global.
- Email send and receive — Google (Gmail / Workspace), United States / Global.
- Application database and audit logs — Supabase (PostgreSQL).
- Application hosting and compute — Render.
- Logging and monitoring — Better Stack, European Union.
- Secrets management — Doppler, United States.
- Website widget hosting — Vercel, United States / Global.
- Analytics and advertising — Google Analytics, Google Ads and Meta Pixel (subject to cookie consent).
Most of these providers process personal data in the United States.
The safeguards applicable to international data transfers are governed by the Company’s Data Processing and Retention Policy.
4. Roles and Responsibilities
All functions described below are performed for and on behalf of House of Mojo, S.L.
Identification of specific individuals is solely for operational and organisational purposes and does not imply that such individuals are personally responsible for the processing activities concerned.
Controller Representative
Mr. Per Moensted, in his capacity as Co-Founder, exercises the Company’s decision-making authority on behalf of the data controller, including adoption of the transparency approach described in Section 5.
AI Governance Owner
The configuration, oversight, logging, quality control and maintenance of Mette, and the upkeep of this procedure, are carried out under the AI-governance-owner role, currently performed by Champ as AI/IT Lead.
Legal
The Company’s legal function (Mojo Legal Department, with external Spanish counsel where required) reviews the compliance package and advises on regulatory risk.
Any material change to Mette’s behaviour, channels or transparency approach is reviewed under the AI-governance-owner role and approved by the controller representative on the Company’s behalf.
5. Transparency and Disclosure
House of Mojo’s approved approach to making Mette’s AI nature transparent rests on several measures operating together:
- The Privacy Policy identifies Mette as an automated AI assistant.
- Consent mechanisms link to that policy before contact.
- A dedicated “About Mette” explanation is available in the website chat interface.
- A mandatory honesty mechanism ensures Mette clearly confirms she is AI whenever asked and offers escalation to a human representative.
6. AI Transparency Approach and EU AI Act Alignment
The transparency measures described above form House of Mojo’s approved approach to compliance with GDPR transparency obligations and Article 50 of the EU AI Act.
The approach will be reviewed before Article 50 becomes applicable on 2 August 2026 and during the annual compliance audit.
7. Human Oversight and Escalation
Users may request a human representative at any time through any communication channel.
If requested, Mette must terminate the automated interaction and transfer the user to a member of House of Mojo’s human team.
Mette does not:
- Confirm final prices.
- Confirm contractual terms.
- Provide legal advice.
- Provide financial advice.
Any such matters must be handled by authorised human personnel.
8. Logging, Monitoring and Quality Control
- Calls, chats and messages may be recorded and transcribed.
- Mette uses approved RAG sources to reduce inaccurate or fabricated answers.
- Mette is configured not to invent property, pricing, legal or financial information.
- Responses are periodically reviewed for accuracy, tone and policy compliance.
Communication channels may only be used where a valid legal basis and required consent exist.
9. Profiling, Automated Decisions and Assessments
Mette maintains an operational memory of prospective clients and personalises communications based on available information.
This constitutes profiling under GDPR.
However, no legally significant decisions are made solely by automated means. All binding decisions remain subject to human intervention.
The Company maintains:
- A DPIA and/or Legitimate Interest Assessment (LIA).
- A documented assessment regarding whether a Data Protection Officer (DPO) is required.
10. Incident Handling and Review
If Mette malfunctions, provides materially incorrect information, contacts an individual without a valid legal basis, or otherwise breaches this procedure, the matter will be escalated to the Artificial Intelligence Governance Officer.
Where necessary:
- The affected functionality will be temporarily suspended.
- The cause will be investigated.
- Corrective measures will be implemented.
- Affected users will be informed where appropriate.
Any personal data breach will be handled under the Company’s Data Processing and Retention Policy.
This procedure will be reviewed annually and whenever significant changes occur to Mette’s channels, providers, functionality, transparency mechanisms, legislation or regulatory guidance.
Data Processing & Retention Policy
1. Controller and Allocation of Responsibility (Controlling Clause)
This clause governs the whole document and prevails over anything that might be read against it elsewhere.
1.1 Controller
House of Mojo, S.L. (“House of Mojo”, “the Company”) is the data controller, within the meaning of Article 4(7) GDPR, for the personal data described in this policy and processed for the purposes the Company determines.
This has been the position in law since processing began; it is recorded, not created, here.
Each provider listed in Section 5 acts as a processor on the Company’s documented instructions, except where certain providers act as independent or joint controllers for their own purposes, including Google and Meta for analytics and advertising and Meta for the WhatsApp platform.
1.2 Individuals Act for the Company
Any founder, officer, employee or contractor who configures, accesses, instructs or maintains this processing, including the governance-owner role, does so solely as an agent of the Company within the scope of authority conferred by the Company.
Performing a Company function does not create personal controllership or accountability. Responsibility remains with the Company.
1.3 Indemnity
The Company indemnifies and holds harmless each such individual against claims, liabilities, penalties, losses and reasonable costs arising from processing carried out for the Company in good faith and within the scope of their authority.
This does not extend to fraud, wilful misconduct, gross negligence, knowing breach of law or any liability that cannot legally be excluded.
1.4 Effect
Where responsibility or accountability for any processing activity determined by the Company is questioned, responsibility rests entirely with House of Mojo, S.L.
2. Purpose
This policy sets out how House of Mojo, S.L. processes and retains personal data, ensuring retention is justified, secure, periodically reviewed and aligned with:
- GDPR
- Spanish LOPDGDD
- House of Mojo Privacy Policy
3. Categories of Data and Purposes
Identification and Contact Data
Name, email address, telephone number and postal address.
Purpose: To provide services and communicate with clients and prospective clients.
Commercial and Preference Data
Properties of interest, budget, search criteria, communication preferences, lead journey stage and interaction history.
Purpose: To manage client relationships and personalise services.
Communication Records
Chat, call, SMS, WhatsApp and email transcripts and recordings involving Mette or team members.
Purpose: Quality assurance, training, customer relationship management, security and compliance.
Consent and Lawful-Basis Records
Records showing what was agreed, when consent was provided and through which form or channel.
Purpose: To evidence lawful processing.
Economic and Financial Data
Where required for a transaction.
Purpose: To deliver services and comply with legal obligations.
4. Legal Bases
Personal data is processed on the basis of:
- Performance of a contract (Art. 6(1)(b) GDPR)
- Consent (Art. 6(1)(a) GDPR)
- Legitimate interest (Art. 6(1)(f) GDPR)
- Compliance with legal obligations (Art. 6(1)(c) GDPR)
Outbound WhatsApp communications remain disabled until an appropriate platform opt-in consent mechanism is in place.
5. Sub-Processors, Storage Locations and International Transfers
Personal data may be processed by the following providers on behalf of the Company:
- Anthropic (Claude) – United States
- OpenAI (GPT family) – United States
- Vapi – United States
- ElevenLabs – United States
- HubSpot – United States
- Pinecone – United States
- Twilio – United States
- Meta (WhatsApp Business) – United States / Global
- Google Workspace (Gmail) – United States / Global
- Supabase (PostgreSQL)
- Render
- Better Stack – European Union
- Doppler – United States
- Vercel – United States / Global
- Google Analytics, Google Ads and Meta Pixel (website only and subject to cookie consent)
International transfers are protected using GDPR-compliant safeguards, including:
- Data Processing Agreements (DPAs)
- EU Standard Contractual Clauses (SCCs)
- EU-US Data Privacy Framework certification where available
- Transfer Impact Assessments (TIAs) where required
Exceptions Register
Any provider lacking a completed DPA or valid transfer mechanism is recorded in a controlled exceptions register until remediation is completed.
6. Retention Principle and Schedule
Personal data is retained only for as long as reasonably necessary for business, legal, operational, security, customer relationship and compliance purposes.
House of Mojo does not commit to fixed public deletion periods.
Data will be deleted or anonymised when no longer reasonably necessary unless legal obligations require continued retention.
Indicative Retention Categories
- Identification, contact, commercial and preference data
- Communication records
- Consent and lawful-basis records
- Accounting and tax records
- Anti-money-laundering records where applicable
7. Retention, Sub-Processor and Register Review
The Company reviews:
- Retained data
- Sub-processor register
- Exceptions register
- Record of Processing Activities
Reviews take place at least annually to ensure:
- Unnecessary data is deleted or anonymised
- Retention remains justified
- DPAs remain valid
- International transfer mechanisms remain current
8. Security Measures
- Need-to-know access controls
- Secure secret management through Doppler
- Encryption in transit
- Encryption at rest where supported
- Row-level security and least-privilege access controls
- Auditable consent records
- Periodic review of provider and staff access
9. Impact Assessments and DPO
The Company maintains:
- A Data Protection Impact Assessment (DPIA) and/or Legitimate Interest Assessment (LIA)
- A documented assessment regarding whether a Data Protection Officer (DPO) is required
Both assessments are reviewed according to the scheduled review process.
10. Data Subject Rights and Breach Response
Requests relating to:
- Access
- Rectification
- Erasure
- Restriction
- Objection
- Data portability
- Withdrawal of consent
should be sent to:
Identity is verified before action is taken.
Data subjects may also lodge complaints with the Spanish Data Protection Agency (AEPD).
Any suspected personal data breach is escalated immediately to the governance function and Legal Department.
Where required by law, breaches will be reported to the AEPD within applicable deadlines, including the GDPR 72-hour notification requirement.
11. Review
This policy is reviewed at least annually during the August–October internal compliance audit and whenever processing activities, sub-processors, technologies or applicable laws materially change.
Reviews are carried out for and on behalf of House of Mojo, S.L.