PRIVACY POLICY
1. INFORMATION FOR THE USER
Who is responsible for the processing of your personal data?
Bitter Lemon Media is the CONTROLLER of the USER’s personal data and informs you that such data will be processed in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Organic Law 3/2018 of 5 December (LOPDGDD).
This section provides information about the conditions of access to and use of this website, which the user must be aware of. General information about chema.armendariz@gmail.com is provided for the purposes set out in Law 34/2002 on Information Society Services and Electronic Commerce.
Who is responsible for the processing of your personal data?
You can contact the CONTROLLER using the following details:
IDENTIFYING INFORMATION
Owner: Chema Armendariz Freire
Phone: +34 645 552 946
Email of Data Protection Officer: chema.armendariz@gmail.com
DATA PROTECTION CONTACT INFORMATION
Phone: +34 645 552 946
e-mail: chema.armendariz@gmail.com
Commitments: We will never use your data for any activity not consented to by you during your visit to the website.
Purpose: Your data will be used to address your requests and provide our services, including:
• Provision of services requested by the user
• Estimates, accounting, tax, and administrative services
• Quality surveys
• Managing and resolving complaints
• As well as any necessary national and international procedures required to fulfill the services requested by the user and/or client
What is the purpose of processing your personal and/or legal data?
You can browse most of the website pages without providing any personal information. In some cases, to provide the information you request, you need to provide your phone number, email, and other complementary data in the web forms.
If you decide to request information in order to receive a service or product, we will process the information according to the policy outlined in this document, where we explain the use of your personal and/or legal data, privacy, data processing, and the security measures we implement.
To maintain a commercial relationship with the user, the operations planned for data processing include:
• Sending communications via email, fax, SMS, MMS, instant messaging, social networks, or any other electronic or physical means, present or future postal address, that enables communication. These communications will be carried out by the CONTROLLER and will relate to products and services already contracted by the user.
• If you have accepted promotions and advertising, you may receive promotional communications about other similar products or services, potential cross-sales, and/or offers and updates. You may also receive communications from our collaborators or suppliers with whom we have agreed on promotions. In these cases, third parties will never have access to your personal and/or legal data.
• Conduct studies and statistical analyses to improve our commercial actions through online and/or offline channels.
• Process orders, requests, respond to inquiries, or any type of request made by the USER through any of the contact methods available on the CONTROLLER’s website.
• Send the online newsletter about news, offers, and promotions regarding our activity, exclusively related to products or services contracted by clients.
• Conduct satisfaction surveys to improve our products and services for users and/or clients.
• Manage and resolve complaints.
• Handle bureaucratic procedures related to the services and products provided.
• Fulfill our legal obligations under applicable national and international legislation.
The personal and/or legal data you provide is managed by the CONTROLLER and its DATA PROCESSORS. The processors are third parties contracted through formal procurement procedures, with signed data protection agreements, ensuring compliance with the law and implementation of security measures to protect such data.
Why do we process your personal and/or legal data?
The processing is legitimized under Article 6 of the GDPR as follows:
• When the USER has given consent to receive commercial communications and newsletters, they may receive these communications, whether from us or third parties, through our company.
• Based on the legitimate interest of the CONTROLLER: to conduct market studies, statistical analyses, and to process orders, requests, etc., at the USER’s request.
According to Law 34/2002 on Information Society Services and Electronic Commerce:
When the USER has purchased or subscribed to a product, service, or campaign, commercial communications or newsletters about similar products, services, or campaigns may be sent under Article 21.2 of the LSSI, provided there is a prior contractual relationship, the recipient’s contact information was obtained lawfully, and consent was given to receive commercial communications about similar services or products to those initially contracted or subscribed to by the USER.
The user may object to receiving such communications by exercising their right of objection: Objection (Model of the Spanish Data Protection Agency).
Browsing data is used to manage and provide a better service. We process your web personal and/or legal data to manage and send electronic communications if requested and/or for statistical purposes.
We process your web personal and/or legal data to manage your participation in personnel selection processes through a specific web form.
We only request personal and/or legal data necessary to respond to your request. If you would like more information about the processing of your data, we are at your disposal.
When subscribing to our newsletters, we also request an email address to provide the service. You can manage your unsubscription at any time; we provide the necessary tools, documents, and time to do so.
Legal Basis
At Bitter Lemon Media, we process the personal and/or legal data provided by users navigating the website based on the following legal grounds, depending on the personal and/or legal data provided and the user’s request with Bitter Lemon Media:
• Purpose: “Contact, management, and processing of inquiries and requests from users of the website, via phone, email, or other online or offline communication channels.” Bitter Lemon Media bases this on managing and processing the legal relationship where the user and Bitter Lemon Media initiate communication through a request submitted by the user for the management of their own request. This contact between the parties and, where applicable, the provision of the service requested by the user, constitutes their explicit consent to initiate a commercial relationship by providing their personal and/or legal data to carry out the requested service.
• If advertising is carried out, it will be based on the user’s consent, obtained in accordance with Law 34/2002 on Information Society Services and Electronic Commerce, and will relate to products and services previously contracted.
How long will we keep your personal and/or legal data?
Data will be retained no longer than necessary to fulfill the purpose of processing or as required by legal obligations. Once the data is no longer needed, it will be deleted using appropriate security measures to ensure anonymization or complete destruction.
Recipients: To whom do we provide your personal and/or legal data?
No personal and/or legal data will be communicated to third parties except when necessary for the development and execution of the processing purposes, to our providers or collaborators of services related to the services to be provided and/or product supply, with whom the CONTROLLER has signed confidentiality agreements and data processing contracts as required by current privacy legislation and legal obligations.
You have the right to obtain information about the processing of the data you provide to our company, Bitter Lemon Media. You can exercise your rights to access, rectify, delete, or transfer your data; to limit or object to its processing; and to not be subject to decisions based solely on automated processing of your data, by contacting our data protection email: chema.armendariz@gmail.com
International Transfers outside the European Union:
No international transfers are planned. If international transfers were to take place, they would be carried out in compliance with the data protection regulations of both countries.
Automated Individual Decisions:
We do not carry out profiling. No decisions are made automatically using technological means. If we conduct surveys, consultancy, or forecasts, these are done solely through human intervention, without profiling.
Web Forms, Contact Points, Website:
We may process your IP address, operating system, browser, duration of your visit, and other data anonymously.
Inquiries are managed through forms to respond to requests and services requested. These inquiries will be handled electronically. We work with servers located within the European area.
Advertising:
We will only send you advertising with your prior authorization, which can be provided via the corresponding checkbox established for this purpose.
Minors:
Requests for services and/or product purchases are not allowed for minors on this website; such requests must be made by their parents and/or legal guardians.
What are your rights?
The rights of the USER are:
• Right of access: When the data subject wishes to consult the personal and/or legal data being processed about them.
• Right of rectification: To correct inaccurate data. Documentation supporting the rectification must be provided, and the correction should be made within 10 days. If not corrected, the intervention of the Spanish Data Protection Agency (AEPD) must be invoked.
• Right to restriction of processing: Data may only be processed with your consent. This applies if the accuracy of the data is in doubt, if you do not want the data deleted, if the data is no longer necessary but cannot be deleted for legal reasons, or if there are pending objections to processing. The period for response is 10 days; if not respected, AEPD intervention must be sought.
• Right to object: The data subject may object to the processing of their data or request its cessation. If the person provides legitimate and justified reasons, the matter must be resolved within 10 days. Objections may also be made to the processing of data for commercial prospecting where consent is not required, especially if the purpose is automated processing. If unresolved, AEPD intervention must be invoked.
• Right to data portability: The right to transfer data from one controller to another. If portability is not technically or mechanically possible, it does not apply. It also does not apply if it affects the rights and freedoms of others, or if processing is of public interest and based on current legislation.
• Right to erasure and the right to be forgotten:
• Data deletion: Documentation supporting the deletion must be provided. The request should be processed within 10 days; otherwise, AEPD intervention must be invoked. If the data must be retained due to legal obligations, the user must be informed of the planned deletion date, with follow-up when the date arrives.
• Right to be forgotten: Applies when data is no longer necessary for the purpose it was collected, when consent is withdrawn, when the data subject objects to processing, when data has been processed unlawfully, or when deletion is required to comply with a legal obligation under EU law. This is particularly relevant for digital contexts (websites, search engines, outdated or inaccurate information, or data that may cause harm to the individual).
• Right not to be subject to automated individual decisions.
How to exercise your rights:
ARCO-POL rights (Access, Rectification, Cancellation, Opposition, Portability, Limitation) are provided free of charge by the data controller to the requester.
To exercise these rights, you must submit the request to the company, acknowledging receipt, and prove your identity with a National ID (DNI), passport, NIE, or equivalent. Provide an address for notification of the response, date, and sign the request. Include any documents supporting the request. If acting through a representative, proof of representation must be provided.
To contact us and exercise your rights, you must authenticate yourself and submit the legal documentation we provide. We have thirty (30) days to respond, unless the request is complex.
Both parties—the CONTROLLER and the data subject—must be identified with all required information; if necessary, a copy of the ID must be provided.
You can exercise your rights to access, rectify, delete, port, restrict, or object to the processing of your data, as well as to not be subject to automated decisions, via our data protection email: chema.armendariz@gmail.com
How to exercise your rights:
• You have the right to file a complaint with the supervisory authority (www.aepd.es) if you believe that data processing does not comply with current regulations.
Contact information to exercise your rights:
Bitter Lemon Media. E-mail: chema.armendariz@gmail.com
Public forms to exercise your rights from the AEPD (you may also request our forms): Acceso
These forms are also available at our office. The service is free unless a demonstrably complex request justifies fees.
If you feel your request has not been properly addressed:
If we do not respond to your request to exercise your rights, you may contact the Spanish Data Protection Agency:
• Electronic headquarters: www.agpd.es
• Postal address: Agencia Española de Protección de Datos C/ Jorge Juan, 6 28001-Madrid
• By phone:
Telf. 901 100 099
Telf. 91 266 35 17
2. MANDATORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED BY THE USER
Users, by checking the corresponding boxes and entering data in fields marked with an asterisk (*) in the contact form or in download forms, expressly and freely consent that their data is necessary to process their request by the service provider, while inclusion of data in the remaining fields is voluntary. The USER guarantees that the personal and/or legal data provided to the CONTROLLER is accurate and is responsible for communicating any modifications.
The CONTROLLER informs that all data requested through the website is mandatory, as it is necessary to provide optimal service to the USER. If all required data is not provided, service cannot be guaranteed.
3. SECURITY MEASURES
In accordance with the applicable personal and/or legal data protection regulations, the CONTROLLER complies with all provisions of the GDPR and LOPDGDD regarding the processing of personal and/or legal data under its responsibility, and explicitly follows the principles described in Article 5 of the GDPR, ensuring that data is processed lawfully, fairly, and transparently, and is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.
The CONTROLLER guarantees that appropriate technical and organizational policies have been implemented to apply the security measures established by the GDPR and LOPDGDD, in order to protect the rights and freedoms of USERS and to provide adequate information so they can exercise these rights.
For more information on privacy guarantees, you can contact the CONTROLLER through Bitter Lemon Media. E-mail: chema.armendariz@gmail.com
4. PHISHING AND FRAUDULENT EMAILS
If you receive an email that you believe is fraudulent and claims to be from our company, please notify us at chema.armendariz@gmail.com so we can be informed of the phishing attempt or unsolicited email.
We will never send emails requesting personal and/or legal data, bank account details, or payments without compliance with data protection and current Spanish laws. Do not respond to such emails, do not click links, and do not download any attachments. We will never commit fraud. Contact us if you receive any attempt at fraud or phishing.