Privacy Policy

GDPR PRIVACY POLICY

BY CLIMFO, SL
B30920557
28/01/2026

Purpose: What do we use your data for?

  • To carry out the sale or provide the contracted service.
  • To create a commercial or user profile based on the information supplied or obtained. We expressly state that profiles will never be created using a minor’s data.
  • Data retention: The personal data you provide will be kept for the duration of the contractual relationship or, where applicable, until you exercise your right to object or withdraw the consent granted. You may do so through the relevant section of our website or by emailing the address indicated in the section concerning the data controller.

Legal basis: Why do we use your data?

We are authorised to process your personal data on the following legal grounds:

  • Your unambiguous, informed and express consent in cases where it is legally required. Withdrawal of consent will not affect other processing operations based on a different legal ground, nor will it affect the lawfulness of processing carried out before consent was withdrawn.
  • A legal obligation applicable to the data controller.
  • Performance of the service agreement and/or contract for the sale of products entered into by you.
  • The legitimate interests of the data controller. These interests are supported by a prior proportionality assessment between the controller’s legitimate interests and the rights and freedoms of the data subjects. This assessment includes:
    • Evaluation of the legitimate interest.
    • Evaluation of the impact of the processing.
    • Balancing the two considerations.
    • Implementation of additional safeguards.

Where the final balancing test is favourable to the controller, processing may be carried out in accordance with the applicable personal data protection regulations.

If you have any questions or require clarification, please contact us using the email address provided in the section concerning the data controller.

Recipients: Who may we share your personal data with?

Your personal data may be disclosed to the following entities and organisations:

  • Spanish Tax Agency
  • Spanish Public Employment Service
  • General Treasury of Social Security
  • Spanish Data Protection Agency
  • Banks and financial institutions

No international transfers of data will be made to third countries or international organisations.

Source: What data do we process and how did we obtain it?

Files owned by the organisation:

  • FG01 Internal accounting management
  • FG02 Internal employment management
  • FG15 Internal tax management
  • FE01 IT maintenance
  • FE02 Occupational risk prevention
  • FE03 Transport and delivery
  • FE04 Internal legal matters
  • FE07 Document destruction
  • FE08 Personal data protection
  • FR01 Requests for information received
  • FR03 Internal staff recruitment
  • FR04 Advertising campaigns
  • FR05 Email communications
  • FR07 Management of incidents and/or security breaches
  • FR08 Collection of data subjects’ opinions
  • FR09 Software and hardware security
  • FP01 Customers

Source of the data:

  • The data subject.

Your rights: What rights can you exercise?

We guarantee that you may exercise the rights available to you in relation to the processing of your personal data.

In particular, you have the right to:

  • Obtain confirmation as to whether or not your personal data is being processed.
  • Exercise your right of access and obtain information about the purposes of processing, categories of data processed, recipients, retention period, source of the data and, where applicable, profiling or automated decision-making.
  • Exercise your right to rectification so that your data is accurate and up to date. You guarantee that the information provided is true and undertake to notify us of any changes.
  • Object to processing for reasons relating to your particular situation, unless there are overriding legitimate grounds for continuing the processing.
  • Request erasure of your data when it is no longer necessary or there is no legal basis for processing it.
  • Request portability of your data where processing is carried out by automated means and is based on a contract or your consent.
  • Request restriction of processing, in which case the data will be retained only for the establishment, exercise or defence of legal claims.
  • Object to automated decisions, including profiling.

These rights may be exercised free of charge, except in cases provided for by law, by sending a signed written request to the data controller at the addresses supplied for that purpose or by submitting it in person at any of our establishments.

You may also:

  • Lodge a complaint with the Spanish Data Protection Agency (AEPD) or the relevant supervisory authority.
  • Bring proceedings before the courts to seek compensation.
  • Withdraw your consent at any time as easily as you gave it, through our website or by emailing the address indicated in the section concerning the data controller.

Security measures

For each personal data processing activity, we analyse potential threats and impacts and apply appropriate security measures. These measures are reviewed regularly to ensure their effectiveness.

Our control system enables us to comply with the following principles:

  • Purpose limitation
  • Storage limitation
  • Data minimisation
  • Integrity and confidentiality

You may periodically receive surveys so that we can learn your opinion about the processing of your personal data and comply with the principles of transparency and accuracy.

If you have any questions or require clarification, please contact us using the email address provided in the first section.