PRIVACY POLICY
1. Information for the User
VIRUTEO, SL (hereinafter, the “Company”), as the data controller responsible for processing your personal data, informs you that, in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), your personal data will be processed as described in this Privacy Policy.
In this Privacy Policy, we describe how we collect your personal data and why we collect it, what we do with it, who we share it with, how we protect it, and the choices available to you regarding the processing of your personal data.
The transmission of data by the user of VIRUTEO S.L. services, its employees, suppliers and/or collaborators (hereinafter, the “user”) is carried out voluntarily, and the user is informed in advance about the processing, its use, and its purposes. If you accept the measures set out in this Policy, you agree that we process your personal data as described in this Policy.
Contact Information
Corporate name: VIRUTEO, SL
Trade name: VIRUTEO
NIF: B21884820
Registered address: c/ Aribau, 168-170, 1st floor, 1st door. 08036 – Barcelona
E-mail: viruteo@viruteo.com
3 Key Principles
We have always been committed to providing our services with the highest level of quality, which includes handling your data securely and transparently. Our principles are:
- Principle of lawfulness, fairness, and transparency: We will always rely on a legal basis for processing your personal data, which we will inform you of in advance with complete transparency.
- Principle of data minimization: We limit the collection of personal data to what is strictly relevant and necessary for the purposes for which it is collected.
- Principle of accuracy: We will keep your personal data accurate and up to date.
- Principle of purpose limitation: We will only collect your personal data for the stated purposes and only in accordance with your consent and intentions.
- Principle of access and rectification: We provide means for you to access or correct your data whenever you deem it appropriate.
- Principle of storage limitation: We store your personal data in a lawful and appropriate manner, and only for as long as necessary for the purposes for which it was collected.
- Principle of data security: We apply appropriate and proportionate technical and organizational measures to ensure that your data is not damaged, such as unauthorized disclosure or access, accidental or unlawful destruction, loss, or alteration.
- Principle of confidentiality: As the data controller, we guarantee the confidentiality of all personal data of the user to which we have access.
4. Processing of Personal Data
By providing us with your data through the website or by any other means, the user guarantees that such data is true, accurate, complete, and up to date, and shall be responsible for any direct or indirect damage or loss that may arise as a consequence of failing to comply with this obligation.
In the event that the user provides VIRUTEO S.L. with third-party data, the user must have obtained the consent of such third parties and agrees to inform them of the contents of this Policy, releasing VIRUTEO S.L. from any liability in this regard. However, the “Company” may carry out checks to verify this fact, adopting the appropriate due diligence measures.
4.1. Purposes of Processing
In order to provide the user with concise, transparent, understandable, and easily accessible information, VIRUTEO S.L. has grouped the processing activities into different categories:
A) Internal whistleblowing channel (Involved parties)
Compliance management: To manage and handle reports submitted by whistleblowers/complainants through the Internal Reporting System, in accordance with Law 2/2023 of 20 February. All legal provisions regarding retention periods, confidentiality (including anonymous reporting), and protection against retaliation shall be applied.
B) Job applicants
Processing of CVs received in order to carry out recruitment and selection processes, including interviews. No automated decision-making is carried out. Once the process is completed, the data will be deleted, except for those necessary if an employment relationship is established.
C) Customer data
Processing to execute the purchase made, carry out administrative, accounting, and tax management, as well as send commercial communications and manage web registration. The data will be retained as long as its deletion is not requested and for the number of years required by legal obligations. Data may be disclosed to the Tax Authorities, financial institutions, and data processors (hosting providers, management software providers, and advisors).
D) Prospective clients and contacts
Management of inquiries, complaints, or suggestions, as well as the sending of professional electronic or telephone commercial communications. Professional contact data will be retained for as long as the commercial relationship lasts, up to a maximum of 10 years from the last interaction, unless you object.
E) Supplier data
Management of the provision of contracted services, as well as tax, accounting, and administrative management. The data will be deleted upon termination of the relationship with the supplier, always respecting the applicable legal and tax limitation periods.
F) Exercise of data subject rights
Management and handling of requests to exercise data protection rights (Art. 6.1(b) GDPR). Data will be retained for a maximum period of three years in order to address possible claims before the competent authorities.
4.2. Legal basis for processing
The legal basis for processing your data may be:
- Your explicit consent (which you may withdraw at any time).
- By applicable legal requirement.
- For the legitimate interest of the Company (for example, sending commercial information to customers).
- For the performance of a contractual relationship or the provision of services.
5. User Rights
Any person has the right to obtain confirmation as to whether or not we are processing personal data concerning them. You may contact us at any time to exercise your rights to:
- Access to your personal data (Art. 15.1 GDPR).
- Rectification of inaccurate or incomplete data (Art. 16 GDPR).
- Erasure (“right to be forgotten”) of your data (Art. 17 GDPR).
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR).
- Objection to the processing of your data (Art. 21 GDPR).
To exercise these rights, you may send a reasoned request, including proof of your identity, to: viruteo@viruteo.com.
If you consider that your rights have been violated, you have the right to lodge a complaint with the competent Supervisory Authority (Spanish Data Protection Agency) through its website: www.aepd.es.
6. Legal Information
The requirements of this Policy complement, and do not replace, any other requirements existing under applicable data protection law, which shall prevail in any case.
This Policy is subject to periodic review, and the Company may modify it at any time. When this occurs, we will notify you of any changes and ask you to read the most recent version again.
7. Cookies
Access to the website may involve the use of cookies. Cookies are small pieces of information stored in each user’s browser so that the server can remember certain technical information, personal preferences, or site functionality.
For more information, you can consult our Cookies Policy.