Privacy Policy

In line with the principles of lawfulness, fairness and transparency, we provide you with this Privacy Policy, applicable to the data we process through this website and our forms, regardless of the country from which you contact us.

Who is the data controller?

In compliance with Articles 5, 12 and 13 of Regulation (EU) 2016/679 (GDPR) and Article 11 of Spanish Organic Law 3/2018 (LOPDGDD), the data controllers, jointly referred to as “GRUPSA”, are:

  • GRUPSA GLOBAL, S.L. — Tax ID B82635905 — Commercial Registry: Volume 15,235, Book 0, Folio 61, Sheet M-255101.
  • GRUPO METAL SYSTEM, S.A. — Tax ID A78558897 — Volume 8,490, Book 3, Folio 56, Sheet 70,526-3.
  • SERVIGROUP KIRA, S.L. — Tax ID B83551200 — Volume 18,504, Book 0, Folio 86, Sheet M-321530.
  • ROMAYO, S.A. — Tax ID A81585382 — Volume 12,409, Book 0, Folio 126, Sheet M-197326.

Common registered office: Ctra. M-404, Km. 20 — 28971 Griñón (Madrid), Spain. Data protection contact: lopd@grupsa.com · Tel. +34 918 140 502.

What data do we process?

We process the data you provide through our forms (for example, the contact form) and within our relationship: identification and contact details (full name, company, job title, telephone, email, country), the sector and interest you indicate, the content of your message and, where applicable, any documentation you attach. We do not request special categories of data; please do not include them in your messages.

For what purposes do we process your data?

  • Prospective clients: managing the potential commercial and/or professional relationship; handling your enquiry and sending the requested information; providing offers of products or services of interest to you.
  • Clients: managing the commercial and/or professional relationship and providing offers of interest.
  • Suppliers: managing the commercial and/or professional relationship.
  • Candidates: managing personnel selection processes.
  • Commercial communications: if you tick the relevant box, sending you by email or other electronic means information about GRUPSA’s activities, products, services, news and events related to our sector.

What is the legal basis for processing?

  • Prospective clients: pre-contractual measures at your request (Art. 6.1.b GDPR); legitimate interest in handling your enquiry (Art. 6.1.f); and your consent to receive offers (Art. 6.1.a).
  • Clients and suppliers: performance of a contract (Art. 6.1.b GDPR).
  • Candidates: your consent (Art. 6.1.a GDPR).
  • Commercial communications: your consent (Art. 6.1.a GDPR and Art. 21 of Spanish Law 34/2002, LSSICE), which you may withdraw at any time without affecting the lawfulness of prior processing.

The data requested is adequate, relevant and necessary; you are not obliged to provide it, but failure to do so may prevent us from providing the service.

How long do we keep your data?

  • For the duration of the commercial or contractual relationship and, after it ends, for the applicable statutory limitation periods (generally up to 6 years for commercial and accounting obligations, and the corresponding tax periods).
  • For prospective clients with no subsequent relationship, up to 1 year from the last contact.
  • For commercial communications, until you withdraw your consent or object.
  • For candidates, a maximum of 1 year.

Recipients and data processors

GRUPSA does not transfer your data to third parties except where legally required. However, to provide its services it relies on suppliers that process data on its behalf as data processors (Art. 28 GDPR): in particular, Zoho (Zoho Corporation B.V.), which manages our web forms, contact database (CRM) and the sending of communications, hosting the data in European Union data centres. GRUPSA has signed the corresponding data processing agreement with these providers. Additionally, your data may be disclosed to banks and financial institutions to collect payment for services, and to public authorities where required by law.

Are there international data transfers?

As a general rule, your data is processed and hosted within the European Economic Area. Should any provider process data outside the EEA, the transfer would be covered by a European Commission adequacy decision, the Standard Contractual Clauses or another appropriate safeguard under the GDPR, a copy of which you may request at lopd@grupsa.com.

What are your rights?

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as the right not to be subject to decisions based solely on automated processing, by contacting lopd@grupsa.com or GRUPSA’s registered office, indicating the right you wish to exercise. GRUPSA may request the additional information strictly necessary to verify your identity.

Can you withdraw your consent?

Yes. You may withdraw at any time the consent given for a specific purpose (for example, commercial communications), without affecting the lawfulness of prior processing. To unsubscribe, use the link included in each communication or write to lopd@grupsa.com.

Where can you complain?

If you believe your data is not being processed correctly, you may address your complaint to lopd@grupsa.com or to the competent supervisory authority; in Spain, the Spanish Data Protection Agency (AEPD), www.aepd.es.

Security and confidentiality

GRUPSA has adopted the technical and organisational measures necessary to safeguard your data and prevent its alteration, loss or unauthorised access. All personnel involved in the processing are bound by a duty of confidentiality. Please inform us of any change to your data so we can keep it up to date.

Minors

This website and its forms are aimed at professionals; they are not intended for minors and we do not knowingly collect their data.

Changes to this policy

GRUPSA may amend this Privacy Policy to adapt it to applicable regulations or to AEPD guidance. We recommend that you review it periodically.