1. Controller and contact details
The data controller is NORTH WORLD INDUSTRY IBERICA, S.L., tax identification number B40628620, with its registered office at Avenida del Oeste 26, 51, 46001 Valencia, Spain.
For privacy enquiries and rights requests, email [email protected] or write to the address above.
2. Data we process and where it comes from
We may process identification, contact and professional information you provide by email or telephone, such as your name, company, position, email address, telephone number and enquiry. If a contract is established, we also process the billing and payment information required.
Hosting and website protection may involve processing IP addresses, dates and times, requested resources, browser information and technical logs needed to provide the service and prevent abuse.
Data comes from you, the organisation you represent or your connection to the website. We do not request special categories of personal data or information about criminal convictions. Please avoid providing unnecessary sensitive information or third-party data.
3. Purposes and legal bases
We only use data needed for each purpose. The legal basis depends on the request and our relationship with the individual:
- Handling enquiries and commercial requests: steps at your request before entering into a contract when you request a quotation or purchase; legitimate interests in answering other communications and maintaining professional relationships, after balancing individuals’ rights.
- Managing contracts, invoicing, payments, warranties and after-sales support: performance of a contract when you are a party and compliance with legal obligations. Business representatives’ details are processed under legitimate interests in maintaining professional relationships.
- Serving and protecting the website, preventing abuse and resolving incidents: legitimate interests in network and information security.
- Where processing requires consent, we will request it specifically and it can be withdrawn. Sending an enquiry does not in itself authorise advertising messages.
4. Retention
Enquiries are retained for as long as needed to respond and manage follow-up. If they lead to a commercial relationship, relevant data becomes part of that relationship.
Contract records are retained during the relationship and for the applicable statutory periods, generally including six years for commercial records and four years for tax records, without prejudice to other mandatory periods or limitation periods for claims.
Technical logs are retained for the period needed to provide and secure the service, taking account of their purpose and provider configuration. Information needed for an incident, claim or legal obligation may be retained while that matter is handled. Data is then deleted or restricted from ordinary use where retention under Spanish law requires it.
5. Recipients and service providers
We use hosting, security, email and technology support providers that may access data to deliver their services. When they act as processors, their access is limited to the contracted service and is subject to confidentiality and data protection obligations.
Where needed for a contract or legal obligation, data may be disclosed to banks, professional advisers and competent authorities. If another group company or a manufacturer is needed to handle your request, only the necessary data will be shared, on a valid legal basis and with the applicable safeguards. We do not sell personal data.
6. International transfers
Technology providers may process data outside the European Economic Area. In those cases, transfers are covered by an applicable adequacy decision or GDPR safeguards, such as standard contractual clauses. These safeguards also apply to data shared with group companies outside the EEA.
You can request information about recipients and copies of the applicable safeguards at [email protected].
7. Your rights
You may request access, rectification, erasure, objection, restriction and portability where the legal conditions for each right are met. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. You may object to processing based on legitimate interests under GDPR Article 21.
Send requests to [email protected] or the controller’s postal address, stating the right you wish to exercise. Additional identity information will only be requested where necessary. We generally respond within one month; the law permits an extension of up to two additional months in specified circumstances, with notice of the extension.
You may also complain to the Spanish Data Protection Agency (AEPD) or the competent supervisory authority. You do not have to exhaust the company’s complaints process first.
9. Security and automated decisions
We apply technical and organisational measures appropriate to the risks and handle incidents in accordance with GDPR Articles 32 to 34. No transmission or storage system can guarantee absolute security.
We do not use this website to make decisions based solely on automated processing that produce legal or similarly significant effects on you.
10. Updates
We may update this policy when services or processing change. The last updated date appears at the beginning. We will inform you of any new processing purpose and request your consent where necessary.