Privacy policy
1. Data controller
IBERITAL DE RECAMBIOS, S.A. Spanish Tax Identification Number (NIF): A08704546 Registered address: C. Laureà Miró, 371-373, 08980 Sant Feliu de Llobregat, Barcelona, Spain Contact email address and address for exercising data protection rights:
2. What personal data do we process and for what purposes?
IBERITAL processes personal data provided through its forms, contact channels and services for the following purposes:
a) Enquiries and requests for information
Data provided through forms, email or other contact channels will be processed to handle and respond to enquiries, requests for information and communications relating to IBERITAL’s products, services and activities.
The legal basis for the processing will be the implementation of pre-contractual measures or the performance of a contractual relationship where the enquiry relates to such matters. In all other cases, the legal basis will be IBERITAL’s legitimate interest in responding to the communications received.
b) Marketing communications and newsletters
Where authorised by the user, their contact details may be used to send commercial information, news and communications relating to IBERITAL.
The legal basis for the processing is consent, which may be withdrawn at any time without affecting the lawfulness of the processing carried out before its withdrawal.
c) Recruitment processes
The data and documentation provided through the “Work with us” section will be processed to manage the application and the recruitment processes in which the data subject participates.
The legal basis for the processing is the implementation of pre-contractual measures requested by the candidate.
Where the candidate is asked to authorise the retention of their application for future recruitment processes, such information will only be retained for the period previously indicated and on the corresponding legal basis.
d) Website security and operation
Technical data relating to access to and use of the website may be processed in order to ensure its security and proper operation and to protect it against fraudulent or unlawful use.
The legal basis for the processing is IBERITAL’s legitimate interest in ensuring the security of its systems and services.
The use of cookies and similar technologies is specifically governed by the Cookie Policy.
e) Internal Information System and Whistleblowing Channel
IBERITAL has an Internal Information System that allows potential infringements or irregularities to be reported either anonymously or by providing identification, in accordance with the terms established by the applicable legislation.
Any personal data processed through the channel will be used exclusively to:
- receive and manage submitted reports;
- analyse the reported facts and decide whether an investigation should be opened;
- maintain communication with the reporting person where they have identified themselves or provided contact details;
- adopt any corrective, disciplinary or legal measures that may be appropriate;
- comply with legal obligations relating to the Internal Information System and the protection of reporting persons.
The processing is based on compliance with the legal obligations applicable to IBERITAL, particularly those arising from Spanish Law 2/2023 of 20 February.
The channel allows reports to be submitted anonymously. Where the reporting person chooses to identify themselves, their data will be processed confidentially and their identity will not be disclosed to the persons affected by the reported facts.
Personal data that is not necessary for managing and investigating the report will not be requested or processed. Any data that is clearly unnecessary will be deleted.
The channel is managed internally by IBERITAL through a platform and database managed by the organisation itself. Access to the information is restricted to authorised persons in accordance with their duties and the applicable legislation.
Spanish Law 2/2023 specifically requires access to be restricted, the personal data processed to be minimised and specific retention periods to be applied within the system itself.
3. How long will we retain the data?
The data will be retained for the period necessary to fulfil the purpose for which it was collected and, thereafter, for the periods required to comply with legal obligations and address any potential liabilities.
In particular:
- Enquiries and requests: for the period necessary to respond to them and, thereafter, for the applicable statutory periods.
- Marketing communications: until the data subject withdraws their consent or requests to unsubscribe.
- Recruitment processes: for the duration of the relevant process and, where retention for future vacancies has been authorised, for the period previously indicated.
- Internal Information System: the data will remain within the system only for the period strictly necessary to decide whether an investigation should be initiated. Where no investigation is opened, the data will be deleted from the system three months after receipt of the report, except for any anonymised information that must be retained as evidence of the operation of the system. Where an investigation is opened, the necessary information may be retained outside the channel for the period required to conduct the investigation and address any legal liabilities that may arise.
The specific three-month rule applicable to reports that do not lead to an investigation derives directly from Article 32 of Spanish Law 2/2023.
4. To whom will the data be disclosed?
Personal data will not be disclosed to third parties except:
- where necessary to comply with a legal obligation;
- to public authorities or judicial or administrative bodies where appropriate;
- where necessary for the establishment, exercise or defence of legal claims;
- or where service providers act on behalf of IBERITAL as data processors and are subject to the corresponding contractual obligations regarding confidentiality and data protection.
Within the Internal Information System, access to the data will be restricted to persons legally authorised to access it. Where necessary, the data may be disclosed to the competent authorities or bodies, or to other persons whose involvement is strictly necessary to adopt corrective measures or conduct legal proceedings.
5. International data transfers
No international transfers of data are expected to arise from the internal management of the Internal Information System.
Where certain technology services or service providers may involve an international transfer of data, such transfers will only take place where there is a valid legal basis and the safeguards required by the applicable legislation have been implemented.
The use of cookies and third-party services is explained in the Cookie Policy.
6. Rights of data subjects
Where applicable, data subjects may exercise the following rights:
- Access
- Rectification
- Erasure
- Objection
- Restriction of processing
- Data portability
- Withdrawal of consent where the processing is based on consent
These rights may be exercised by contacting:
IBERITAL DE RECAMBIOS, S.A. C. Laureà Miró, 371-373, 08980 Sant Feliu de Llobregat, Barcelona, Spain Email address:
The request must include the information necessary to verify the identity of the applicant and specify the right being exercised.
In relation to processing connected with the Internal Information System, the exercise of certain rights may be subject to the limitations established by law in order to guarantee confidentiality, protect the reporting person and ensure the proper investigation of the reported facts.
The data subject also has the right to lodge a complaint with the Spanish Data Protection Agency.
7. Security and confidentiality
IBERITAL implements technical and organisational measures designed to protect personal data against loss, alteration, unauthorised access or unauthorised use, taking into account the nature of the information and the risks associated with the processing.
Persons authorised to access the data are subject to the corresponding duty of confidentiality.
8. Updates to the Privacy Policy
IBERITAL may amend this Privacy Policy in order to adapt it to regulatory or technical changes or to changes relating to its data processing activities.
The version in force will be the version published on the website.