Privacy policy

The controller of your personal data is Andruma (referred to below as "we" or the "Controller"). Use of the Site and the completion of forms involve the processing of personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR, also known as the RGPD), Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD) and supplementary Spanish legislation.

1. Data controller

No Data Protection Officer (DPO) is expected to be appointed. For any matter relating to data protection, you may contact us at the address shown.

2. Purposes of processing and legal basis

2.1. Handling of enquiries and contact

Purpose: to deal with requests you send us through the contact form, by email or by telephone.

Legal basis: the consent of the data subject (Article 6(1)(a) GDPR/RGPD) and, where applicable, steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR/RGPD).

Retention: for as long as necessary to deal with your request and, thereafter, for the applicable statutory periods (for example, civil or commercial liability), unless the data must be kept under a legal obligation.

2.2. Contractual or pre-contractual relationship

If you place an order or enter into a contract with us, we will process the data needed to manage the relationship, invoicing and compliance with legal obligations (accounting, tax and similar).

Legal basis: performance of the contract (Article 6(1)(b) GDPR/RGPD) and compliance with legal obligations (Article 6(1)(c) GDPR/RGPD).

2.3. Compliance with legal obligations

Where tax, employment or other legislation so requires, we will keep the information for the period required by law.

Legal basis: Article 6(1)(c) GDPR/RGPD.

2.4. Improvement of the Site and security (technical logs)

The server and systems may record technical data (IP address, date and time of access, and browser type) for security, diagnostics and improvement of the service.

Legal basis: legitimate interests (Article 6(1)(f) GDPR/RGPD), insofar as processing is necessary and proportionate, or consent where non-essential cookies are involved (see the Cookie policy).

3. Recipients and processors

We will not disclose your data to third parties except where there is a legal obligation or where it is necessary to provide the service (for example, hosting providers, email providers or management tools). Those third parties act as processors under a contract that requires them to process the data on our instructions and in accordance with the GDPR (RGPD).

4. International transfers

If a provider processes data outside the European Economic Area, we will ensure that there is an adequacy decision of the Commission, standard contractual clauses, or another appropriate safeguard under Chapter V of the GDPR (RGPD).

5. Rights of the data subject

You may exercise the following rights against the Controller:

• Access: to know which data we process and for which purposes.
• Rectification: to request the correction of inaccurate data.
• Erasure: to request deletion where it is applicable.
• Restriction of processing: in the cases provided for in Article 18 GDPR (RGPD).
• Portability: to receive the data in a structured, commonly used format, where processing is based on a contract or on consent and is carried out by automated means.
• Objection: to object to processing based on legitimate interests, unless there are compelling legitimate grounds.
• Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, you may write to info@andruma.com, stating the right you wish to exercise and providing proof of your identity. We will reply within the statutory period (usually one month, which may be extended).

6. Complaint to the supervisory authority

If you consider that the processing does not comply with the law, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) (www.aepd.es), C/ Jorge Juan, 6, 28001 Madrid.

7. Retention of data

Data will be kept for as long as necessary to fulfil the purpose for which they were collected and, where applicable, for the statutory limitation periods or the periods required by the tax authorities or other rules. Once those periods have elapsed, the data will be securely deleted or anonymised.

8. Children

The services are not directed at children under the age of 14. We do not knowingly collect data from children. If you become aware that a child has provided data to us, please tell us so that we can delete them.

9. Security

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the confidentiality, integrity and availability of the data.

10. Cookies

The Site may use cookies and similar technologies. Detailed information is set out in the Cookie policy.

11. Changes to this policy

We may update this policy to reflect legislative changes or developments in case law. The date of the update appears at the start of the document. You are advised to review it from time to time.