← Back to home

Legal Center

Hurus legal documents and policies

Data Exclusion

Last updated: March 2026 · Hurus AI Systems, S.L. · info@hurus.io

1 Data that Hurus does not process

Courtesy translation. In case of any discrepancy, the Spanish version prevails.

Hurus AI Systems, S.L. does not, under any circumstances, collect, process or store the following types of data:

——Special categories of data (art. 9 GDPR): health data, racial or ethnic origin, religious, philosophical or political beliefs, trade union membership, genetic or biometric data, data concerning sex life or sexual orientation, or other sensitive data.
——Data of persons under 18 years of age: Hurus's services are aimed exclusively at professionals in B2B business contexts. Hurus does not knowingly process data of minors and, if it detects that any such data has been provided, it will erase it immediately.
——Personal financial data of data subjects: bank account numbers, credit card data or other personal financial information of natural persons, other than that strictly necessary for B2B invoicing with the Client, which is processed through specialized third parties under their own security safeguards.
——Real-time geolocation data or personal device identifiers.
——End-consumer (B2C) data: Hurus operates exclusively in B2B environments. It does not process or request data of end customers or individual consumers of its client companies.
——Access credentials: Hurus does not request or store passwords, access tokens or credentials of third-party accounts.

2 Legal basis for B2B prospecting

Within the framework of its commercial prospecting services, Hurus may process professional contact data —name, job title, company, corporate email address and professional social network profile— obtained from publicly accessible sources (corporate websites, company publications, professional networks) or provided by the Client.

The processing of this data for B2B commercial communication purposes is based on the legitimate interest of the data controller, in accordance with art. 6.1.f of the GDPR and Recital 47 of the same Regulation, which expressly recognizes the processing of contact data for direct marketing purposes as a legitimate interest that may be invoked.

This legal basis is valid provided that:

——The data processed is professional in nature and relates to the data subject's work role.
——The communications are relevant to the recipient's professional activity.
——The data subject is informed at first contact of the source of their data, the identity of the controller and their right to object.
——Any request for exclusion or objection is handled immediately.

Hurus guarantees that every prospecting campaign carried out on behalf of a Client includes transparent information on the identity of the controller and a simple opt-out mechanism in each communication.

3 Right to object and exclusion request

Any person who has received a commercial communication from Hurus or from a Hurus client, or who considers that their data is being processed within the framework of Hurus's services, may exercise their right to object or request exclusion from any list or activity at any time and without needing to give a reason.

How to exercise it:

——By replying directly to the prospecting email received with the text 'Exclusión' ('Exclusion') or 'Baja' ('Unsubscribe').
——By writing to info@hurus.io stating your name, company and the action you wish to take (objection, exclusion or erasure).

Response time: Hurus will handle your request within a maximum of 5 business days of receipt, and in any case within the maximum period of 30 calendar days established by art. 12.3 GDPR.

4 Permanent suppression list

Once a request for exclusion or objection has been received and processed, the data subject's data is added to an internal permanent suppression list. This list ensures that:

——The data subject will not be contacted in any future campaign carried out by Hurus, regardless of whether their data appears in new prospecting sources.
——The exclusion is communicated to the relevant Client so that it is also applied in the Client's own systems.
——The suppression list is not used for any purpose other than ensuring the effectiveness of the exclusion.
——The data included in the suppression list is retained only for the time necessary to ensure its effectiveness (minimum 3 years from the request), in blocked form and with restricted access.

5 Client responsibility in outreach

When Hurus carries out prospecting campaigns on behalf of a Client, the Client acts as the data controller of its prospects' data. The Client warrants to Hurus that it has a sufficient legal basis for the commercial communications carried out, and that the instructions it gives to Hurus comply with applicable regulations.

Hurus shall not be liable for claims arising from communications made under the Client's instruction and with the lists or data provided by the Client, provided that Hurus has acted in accordance with those instructions and with good B2B prospecting practices.