Privacy policy

2. Scope of this policy

This policy applies to personal data processed when browsing this website, making enquiries and requests for information or quotes, using its tools and in professional relationships connected with our services.

Processing is governed by Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Organic Law 3/2018 (LOPDGDD) and other applicable rules. Where we provide a service involving processing data on behalf of a customer, that processing will also be governed by the relevant data processing agreement.

3. What data we process and where it comes from

  • Data you provide: name, email address, telephone number, company or role where supplied, the department your request is addressed to and the content of your communications.
  • Professional relationship data: contact information and the administrative, contractual and billing data required when you request or contract a service.
  • Technical information: when you request a page or resource, your browser sends servers data such as your IP address, browser type and the information needed to handle the connection.
  • Website tools: information you enter to use a feature. The password generator creates passwords in your browser. The secure link generator sends the encrypted content, the PIN if you set one, and the link’s validity and view parameters to the server.

In general, the data comes from you. If you act on behalf of a company or provide other people’s data, supply only the information needed and ensure you have a legitimate basis for disclosing it. Avoid including health data or other particularly sensitive information in general contact forms.

4. Purposes and legal bases

  • Handling enquiries and quote requests. When you request a service, the basis is taking pre-contractual steps at your request (Article 6(1)(b) GDPR). For other enquiries, the basis is our legitimate interest in responding to people who contact the company (Article 6(1)(f)).
  • Managing services and professional relationships. Performance of the contract justifies the processing needed to provide the service (Article 6(1)(b)). Data relating to representatives and contact persons is used to maintain the professional relationship, on the basis of legitimate interest and under the terms of Article 19 LOPDGDD.
  • Complying with legal obligations. We process the information needed to meet tax, accounting and data protection obligations, as well as requests from competent authorities (Article 6(1)(c) GDPR).
  • Providing the features you request and protecting the website.Using a tool requires processing the data needed to provide that feature (Article 6(1)(b)). Preventing fraudulent use and managing security incidents are based on the legitimate interest of protecting systems and their users (Article 6(1)(f)), while respecting their rights.

We do not currently send newsletters or advertising communications. Sending an enquiry, requesting a quote or reading this policy does not authorise the use of your data for advertising.

Where processing requires your consent (Article 6(1)(a)), it will be requested specifically for the relevant purpose and you may withdraw it at any time.

5. Retention periods

  • Enquiries and quotes: for the time needed to respond and follow up on your request. If a contract is entered into, the necessary information becomes part of the contractual relationship.
  • Contracted services: throughout the relationship and subsequently for the periods required to comply with obligations or address liabilities. Commercial documentation is generally retained for six years from the last entry, under Article 30 of the Commercial Code. Tax periods and any interruptions are governed by the General Tax Law.
  • Tools and security: for the time needed to provide the requested feature or manage an incident. Expiry and view limits determine the availability of secure links; they do not in themselves determine the retention period for the service’s technical logs.

Where data due for erasure must be retained to address potential liabilities, it will be blocked under Article 32 LOPDGDD and not used for other purposes. It will be deleted once the applicable periods have ended.

6. Recipients and providers

Hosting, email, IT maintenance and administrative, accounting or legal advisory providers may be involved in managing communications and services. Where they act on our behalf, their access must be limited to what is necessary and governed by the data processing agreements required by the GDPR.

Data may also be disclosed to public administrations, courts and other authorities where there is a legal obligation. If a requested service requires disclosing data to another provider acting as an independent controller, the relevant information will be provided before that disclosure.

7. External resources and international transfers

The website loads fonts from Google Fonts. When downloading these fonts, your browser connects to its servers and sends technical data, such as your IP address. You can consult Google’s privacy policy.

Some providers may operate outside the European Economic Area. Any international transfers we make must have a valid mechanism under Chapter V GDPR, such as an adequacy decision or standard contractual clauses, together with any necessary supplementary measures. You can request information about the recipients, countries and safeguards applicable to your data through our contact email.

Links to social networks, maps and other external pages take you to services with their own policies. This policy does not replace the information those controllers must provide.

8. Your rights and how to exercise them

In the circumstances provided for by the GDPR, you may exercise the following rights:

  • Access: find out whether we process your data and obtain information and a copy.
  • Rectification: correct inaccurate data or complete incomplete data.
  • Erasure: request deletion where applicable.
  • Restriction: request that processing be restricted in the cases provided for by law.
  • Objection: object to processing based on legitimate interest on grounds relating to your situation.
  • Portability: receive the data you have provided and transmit it to another controller where automated processing is based on consent or a contract.
  • Withdrawal of consent: withdraw consent without affecting the lawfulness of earlier processing.

You can send your request to comercial@avannubo.com or the registered address provided, identifying the right you wish to exercise and the details needed to locate the processing. We will only request additional information to verify your identity if there are reasonable doubts about it.

We will generally handle your request free of charge within one month of receiving it. In cases involving complexity or the number of requests as provided for by the GDPR, this period may be extended by a further two months. We will inform you of the extension and its reasons within the first month.

If you believe the processing infringes your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), without being required to contact us first.

9. Required data and automated decisions

Mandatory fields in each form are used to process your request. If you do not provide essential information, we may be unable to handle it. Additional data, such as a telephone number where it is not marked as mandatory, is optional.

The contact-related processing described here is not intended to make decisions based solely on automated processing that produce legal effects or significantly affect you. If such processing were introduced, the specific information and safeguards required by the GDPR would be provided.

10. Local storage and measurement tools

The website uses local storage to remember theme and language preferences and the temporary dismissal of a notice. These preferences can be cleared through your browser settings.

We do not currently use Google Analytics or advertising tools. If we introduce Google Analytics or other measurement tools in the future, we will update the information about their purposes, providers, retention and transfers. Where consent is required, it will be requested before activation, with options to accept, reject and withdraw your choice without preventing general access to the website.

Local storage does not replace any consent that may be required for non-exempt purposes. You can also consult our cookie policy.

11. Confidentiality and security

Data will be processed confidentially, with technical and organisational measures appropriate to the risk to prevent unauthorised access or use. Do not send passwords or particularly sensitive information through general contact channels.

12. Updates to this policy

We will update this information when processing activities or applicable regulations change. If a change requires additional information or fresh consent, these will be provided before the relevant processing begins.

See also our Legal Notice page.