Privacy policy

This English version is provided for information purposes only. In the event of any discrepancy, the Spanish version shall prevail.

Our data protection policy has been drawn up and communicated in accordance with the applicable legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter, the GDPR), and Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

This privacy policy is common to and applies to the companies SITTIC SERVICIOS INFORMÁTICOS DE TRATAMIENTO DE TEXTOS E IMPRESIÓN EN COLOR and SERVICIOS INTERNACIONALES PARA EL TRATAMIENTO DE TEXTOS E IMÁGENES EN COLOR S.L.U. (hereinafter jointly referred to as the Company).

The parties have entered into a joint controllership agreement and will implement the documents necessary to ensure the communication of personal data between the parties.

The technical and organisational measures necessary to ensure the confidentiality, security and proper processing of personal data have been adopted, preventing their alteration, loss, or unauthorised processing or access in accordance with the applicable legislation, taking effective measures and, in all cases, applying a level of security appropriate to the data processed. This work is carried out on an ongoing basis, taking into account legislative developments and developments within the Company.

This policy may change over time as a result of possible legislative changes or for other reasons relating to the management of the business. Any change will be reflected immediately on the website and, where applicable, the appropriate notifications will be made.

The firm handles data of natural persons in the performance of a position or professional function, as well as personal data in the private sphere. Both categories have been taken into account in establishing this privacy policy. The entity may act as DATA CONTROLLER or as DATA PROCESSOR. This privacy policy addresses and covers both roles.

Who is the data controller for your data?

SITTIC SERVICIOS INFORMÁTICOS DE TRATAMIENTO DE TEXTOS E IMPRESIÓN EN COLOR, with registered address at 28830 San Fernando de Henares, Madrid, Calle Montes de León, 15 and Tax ID (NIF) B-79526570. Email: sittic@sittic.com.

SERVICIOS INTERNACIONALES PARA EL TRATAMIENTO DE TEXTOS E IMÁGENES EN COLOR S.L.U., with registered address at 28850 Torrejón de Ardoz, Madrid, Calle Primavera, 18 and Tax ID (NIF) B-86299070. Email: sittic@sittic.com.

Purpose of processing and data retention

We process the information provided to us by our customers and other interested parties for the following purposes:

• a) CONTRACTUAL PURPOSES, in relation to associates, suppliers, partners and employees, to manage the performance of the rights and obligations arising from the contractual relationship.
• b) PURPOSES BASED ON THE DATA SUBJECT’S CONSENT: For the purpose of providing information on the entity’s activities and initiatives. The Company will be responsible for providing information and obtaining any consents required for the commercial use of the data.
• c) REGULATORY PURPOSES: To comply with its legal and/or regulatory obligations.
• d) PURPOSES BASED ON LEGITIMATE INTEREST, pursuant to Article 19 of the LOPDGDD (Organic Law 3/2018 of 5 December) and Article 6(1)(f) of Regulation (EU) 2016/679.

Data are processed in the capacity of DATA CONTROLLER when they are collected and processed by us. Data are processed in the capacity of DATA PROCESSOR when the firm processes the data in order to provide a service to a third-party entity that is the controller of the data.

Contact form on this website

The data you send us through the contact form (name, company, email address, telephone number and the description of your project) are used solely to respond to your enquiry and, where applicable, to prepare a quotation for you. The legal basis is the consent you give by ticking the acceptance box before submitting the form. The data are not disclosed to third parties unless required by law and are retained for as long as necessary to deal with your request and, thereafter, for the legally required periods.

Data retention

Personal data provided will generally be retained, with the exception of the provisions of the preceding paragraph, a) for as long as required to fulfil the purpose for which they were collected, or as required by the contractual relationship, including the time necessary, in accordance with the applicable legislation, to fulfil the relevant obligations and actions that may arise from it; b) for as long as the data subject does not request their erasure. The data will be blocked when the first of the two events mentioned above occurs.

From that moment, the data will be kept exclusively at the disposal of Judges and Courts, the Public Prosecutor’s Office or the competent Public Administrations, in particular the data protection authorities, to address any liabilities arising from the processing, during the limitation period applicable to such liabilities. Once that period has elapsed, the data will be erased.

No profiling is carried out.

Lawful processing

As DATA CONTROLLER, the legal basis for processing your data is:

• a) The contractual relationship and the performance of the contract entered into with us.
• b) Where you have expressly given your consent, the legal basis is that consent.
• c) Compliance with a legal obligation (regulatory purposes).
• d) Legitimate interest, pursuant to Article 19 of the LOPDGDD.

As DATA PROCESSOR, it is for the entity that has engaged us as service provider, in its capacity as DATA CONTROLLER, to establish the legal basis and processing model.

Recipients of the data

Data are communicated to our partners who provide services as subcontractors, law firms and other partners acting as data processors, as well as to authorities and public bodies that require them.

In the case of partners, the corresponding data processing agreement required by the General Data Protection Regulation is entered into with the recipient.

International data transfers

As a general rule, the Company does not carry out international data transfers. In relation to any transfer of your personal data to countries outside the EEA, the entity will implement the appropriate specific measures to ensure an adequate level of protection of your personal data.

Users’ rights

• a) Any person has the right to obtain confirmation as to whether or not we are processing personal data concerning them.
• b) Data subjects have the right to access their personal data and to request the rectification of inaccurate data or, where applicable, request their erasure where, among other reasons, the data are no longer necessary for the purposes for which they were collected.
• c) In certain circumstances provided for in Article 18 GDPR, data subjects may request restriction of the processing of their data, in which case we will retain them only for the exercise or defence of claims.
• d) Data subjects may object to the processing of their data for marketing purposes, including profiling. The Company will cease processing the data, except on compelling legitimate grounds or for the exercise or defence of possible claims.
• e) By virtue of the right to data portability, data subjects have the right to receive the personal data concerning them in a structured, commonly used and machine-readable format and to transmit them to another controller.

Exercise of GDPR rights by the user

By written request sent to the addresses indicated above.

User’s responsibility

The User warrants that the personal data provided through the form are true and undertakes to notify any changes to them. The User also warrants that the information provided reflects their actual situation and is up to date and accurate. Furthermore, the User undertakes to keep their data up to date at all times and shall be solely liable for any inaccuracy or falsehood in the data provided and for any loss or damage this may cause to the Company as owner of the website.

Complaints to the Spanish Data Protection Agency (AEPD)

If you consider that the Company has not dealt with your request properly, you may request the protection of the Spanish Data Protection Agency (AEPD), whose details are available at www.aepd.es.

Categories of data

What categories of data do we process?

• a) Identification and location data.
• b) Data relating to your professional role or activity.
• c) Financial and payment data.

As a general rule, the special categories referred to in Articles 9 and 10 of the GDPR are not processed. Should this be the case at any time, the entity will comply with the requirements of Articles 9 and 10, and explicit consent will be obtained.

The data received or collected are those necessary to fulfil the stated purposes and are processed confidentially in accordance with the privacy and security policies established by the firm.

Source of the data

As DATA CONTROLLER, the personal data we process come from the information you provide to us when you request services or resources from us, access our website or establish any kind of relationship with us, directly or indirectly.

As DATA PROCESSORS, the data come from the DATA CONTROLLER, or are collected by us on its behalf during the provision of the service contracted with the CONTROLLER.