Privacy Policy
The personal data you provide to us on this website by any of the means enabled for this purpose will be processed in accordance with this privacy policy.
1. IDENTITY OF THE DATA CONTROLLER
All the processing referred to in this privacy policy is carried out by:
| Name | ZABALA INNOVATION CONSULTING, S.A. |
| VAT NUMBER | A31419773 |
| Address | Paseo Santxiki, 3 bis – E-31192 Mutilva (Navarra, Spain) |
| gdpr@zabala.es | |
| Phone | +34 948 198 000 |
2. DATA PROCESSING
This privacy policy details the processing of personal data, including the legal basis in accordance with the GDPR and the specific retention period of the data. These periods will be extended by the time necessary to comply with legal obligations and address any liabilities that may arise in relation to the fulfilment of the purpose for which the data were collected. If at any time your authorisation is requested for the processing of your data for a purpose of which your consent is required, the lack of granting (or its subsequent withdrawal) will have no consequences for you.
Data Relating to Our Relationship With You
| Processing and purposes | Data we collect about you | Legal basis (GDPR) | Retention period |
|---|---|---|---|
| Requests for information or queries (by any means you use, including collection at fairs, events and phone calls): We will use your data to respond to your requests for information, queries or complaints and manage what is necessary. We will also use them to prepare service or collaboration proposals. | Name, email, company, telephone, geographical location (region, country), tracking URLs, and any other information you voluntarily share with us in the forms. | Art. 6.1.a) GDPR – Consent. Art. 6.1.b) GDPR – Pre-contractual measures. | For the time necessary to address and manage your request and/or complaint. |
| Use of our websites, social media profiles and marketing emails: We will use the data from your visit to our websites to show you relevant content, analyse metrics and web traffic, and understand how you interact with us. | IP address, tracking URLs, device identifiers, approximate geographical location, how you interact with the website or email, and any other data through cookies. | Art. 6.1.a) GDPR – Explicit consent. | Provided you do not object and the Controller is authorized to process it. |
| In-person events and webinars: Manage your participation in them, including image/voice processing during online events. | Name, email, organisation, interests, attendance, participation, dietary preferences (offline events), voice, image, tracking URLs. | Art. 6.1.b) GDPR – Contract performance. Art. 6.1.a) GDPR – Explicit consent. | Provided the contractual relationship is in force and the Controller is authorized to process it. |
| Commercial communications: We will use your data to send you commercial communications, publications or newsletters that we consider may be of interest to you. | Name, email, company, telephone, interests, geographical location, tracking URLs, campaign interaction identifiers. | Art. 6.1.a) GDPR – Explicit consent. | As long as you do not withdraw your consent. |
Data Associated With Regulatory Compliance
| Processing and purposes | Data we collect about you | Legal basis (GDPR) | Retention period |
|---|---|---|---|
| Attention to the exercise of the rights of the data subjects: We will use the data you provide to evaluate your request and address it. | Name, email, address and any other data necessary to prove your identity. | Art. 6.1.c) GDPR – Legal obligation based on articles 15 to 22 of the GDPR. | As long as necessary to address the exercise of rights communicated to the Controller. |
Cookies
If you have accepted to receive cookies when you start visiting this website, the website’s cookie policy, accessible through the following link, will apply to you.
3. RECIPIENTS. INTERNATIONAL DATA TRANSFERS.
As a general rule, unless legally required, your data will not be communicated or transferred to any third party without your prior express consent. In any case, some communications and/or transfers of data to third parties may be imposed by certain regulations or to meet obligations with Public Administrations, the Public Prosecutor’s Office, Judges and Courts, and State Security Forces and Bodies.
Below, we list the purposes for which it may be necessary to communicate your data to third parties:
- Website hosting: The data hosted on our website will be communicated to the company that provides us with the web hosting service.
- Google Ireland Limited: Web analytics service “Google Analytics”. Involves international data transfers outside the EU, compliant through Standard Contractual Clauses established by the European Commission.
- Microsoft: Email, data hosting, videoconferencing. Adhered to the “EU-U.S. Data Privacy Framework (EU-U.S. DPF)”.
- LinkedIn Ireland Unlimited Company: Social network service. Involves international data transfers, certified for the EU-U.S. Data Privacy Framework.
4. RIGHTS
Regarding the personal data collected for processing, you have the possibility to exercise the rights of access, rectification, deletion and portability. Likewise, in certain circumstances, you will have the right to request the limitation or opposition to the processing of your data, in which case the Controller will cease processing them and will only keep them if there is a legal obligation to do so or until the prescription of the actions that may arise.
For any query or exercise of your rights you may contact ZABALA INNOVATION CONSULTING, S.A. using any of the channels indicated in the first section of this privacy policy.
Finally, you can also contact the supervisory authority when you deem it appropriate to file a complaint. For the appropriate purposes, we inform you that in Spain the Supervisory Authority is the Spanish Data Protection Agency.
5. MANDATORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED BY THE USER
By checking the corresponding boxes and entering data in the fields on the various forms on the website, users expressly, freely, and unequivocally accept that their data is necessary for the provider to respond to their request, with the inclusion of data in the remaining fields being voluntary. Users guarantee that the personal data provided to the data controller is accurate and are responsible for communicating any changes thereto.