Data Controller:
At ASPERIS SECURITY, S.L we are committed to the security and privacy of personal information and to the quality of the protection of the personal data of those of our clients who provide us with data, so that such data is not used improperly.
Details of the controller of the file
ASPERIS SECURITY S.L
NIF: B56462948
Address: Av. Diagonal, 449, 4º, 08036 Barcelona
Commercial Registry: registered at the Commercial Registry of Barcelona, volume 48982, folio 75, sheet B 603397
Telephone: +34 936 096 292
Email: [email protected]
Exercise of rights: [email protected]
Purposes of the processing
We inform you that the data you provide to us by any means (website, email, or any other document) will be incorporated into a file owned by ASPERIS SECURITY, S.L.
At ASPERIS SECURITY, S.L we process the information provided to us by data subjects for the purpose of:
- Handling any type of application, suggestion or request regarding our professional services submitted to us by data subjects. Legal basis: taking of steps at the request of the data subject prior to entering into a contract.
- Managing the sending of the information that they request from us. Legal basis: taking of steps at the request of the data subject prior to entering into a contract.
- Carrying out commercial follow-up of the requests received, including the sending of proposals. Legal basis: legitimate interest.
- Carrying out the dark web exposure analysis that they request from us. Legal basis: legitimate interest.
- Maintaining the relationship with the client for invoicing and collection of payment. Legal basis: performance of the contract and compliance with legal obligations.
- Sending our clients communications about the service and satisfaction surveys. Legal basis: performance of the contract and legitimate interest.
- Providing our clients with offers of products and services similar to those they have contracted, as well as forthcoming events or relevant news. Legal basis: legitimate interest and article 21.2 of the LSSI.
- Keeping you informed about our services, news, events and security alerts, if you give us your consent. Legal basis: consent.
- Assessing the interest of contacts on the basis of their activity on our website, if you accept analytics cookies. Legal basis: legitimate interest.
- Managing collaboration proposals and the relationship with our partners. Legal basis: taking of steps at the request of the data subject prior to entering into a contract, and legitimate interest.
If you do not give us your consent to receive commercial communications, we will not be able to inform you about our news and events, but this will not affect the handling of your request.
ASPERIS SECURITY, S.L undertakes to comply with its obligation concerning the secrecy of personal data and with its obligation to protect it, and to adopt the technical and organisational measures necessary to maintain the level of security required in view of the personal data processed. It is likewise provided with the precise mechanisms within its reach in order to prevent, as far as possible, unauthorised access, unlawful removal and modification and the loss of data, always taking into account the state of the art and in accordance with the legislation in force.
What data do we process?
The type of information we collect will depend on the services you use. In general terms, we will obtain the following information:
- Identification and contact data: first name, surname, email address, company and telephone number, which you provide to us through forms, meeting bookings, chat or email, as well as the content of your messages.
- Domain to be analysed, if you request a dark web exposure analysis from us.
- Browsing data: pages you visit on our website, only if you accept analytics cookies.
- Technical data: this is the data obtained through Cookies, and it is the information about the devices you use to access the website. You can find more information in our Cookie Policy.
- Invoicing data, in the case of clients.
- We do not process specially protected data.
- We do not process data of persons under 14 years of age.
The fields marked as mandatory in our forms are necessary to handle your request. If you do not provide them, we will not be able to process it.
Legal basis
The legal bases for processing personal data and for handling the request for information or the enquiry about our professional services, laid down in Article 6.1 GDPR, are the following:
- The consent of the data subjects.
- Compliance with a legal obligation applicable to the data controller.
- Performance of a contract or of a contractual relationship, including the taking of steps at the request of the data subject prior to entering into a contract.
- The legitimate interest of the data controller.
The legal basis applicable to each purpose is indicated in the section Purposes of the processing.
The commercial follow-up of a request that you have submitted to us is based on our legitimate interest in following up on what you have asked of us, and it is maintained for a maximum of 24 months without activity on your part, or until you tell us that you are not interested.
The sending to our clients of commercial communications about products or services similar to those they have contracted is based on our legitimate interest and on article 21.2 of Law 34/2002 on Information Society Services and Electronic Commerce (LSSI). You may object to it at the time of contracting and in every communication you receive.
The basis for sending commercial communications to non-client users is the consent that has been requested, which may be revoked at any time. The withdrawal of that consent will not in any case affect the performance of the contract, but the processing of data carried out for that purpose beforehand will not lose its lawfulness by reason of the consent having been revoked.
You may object at any time to receiving commercial communications, without needing to give a reason, through the unsubscribe link included in our mailings, by replying to any of our emails or by writing to [email protected]. Our newsletter, alert, event and news mailings also include a link to your preferences centre, where you can unsubscribe from each type of mailing separately.
Dark web exposure analysis
If you request this analysis from us, we review sources where information leaked by third parties is already circulating in relation to the domain you give us. Before sharing any results, we verify that you represent the organisation that owns the domain.
The analysis may detect data of other people in your organisation, such as email addresses affected by leaks. For that reason, the report shows only counts and types of exposure, with the addresses masked, and never includes passwords or credentials in plain text. The results are deleted after 30 days.
Disclosure of data
No personal data will be disclosed to third parties, except in those cases in which it is necessary by legal provision established to that effect.
The data may be communicated to the Spanish Tax Agency (Agencia Estatal de la Administración Tributaria) and to banks or financial institutions for the budgeted payments established in the contract for the product purchased.
In order to provide our services we rely on providers that process data on our behalf, as data processors, with whom we have signed the contracts required by the regulations. This does not constitute a disclosure of data. They are providers of:
- CRM, forms, meeting bookings and email sending.
- Web hosting and email.
Our forms also include a service that protects against automated submissions, which receives the IP address of the person using them. If you accept the corresponding cookies, web analytics and campaign measurement providers, identified in our Cookie Policy, are also involved.
Our main providers host the data in the EU. Some belong to groups based in the US and, where access from outside the European Economic Area may occur, the safeguards of the EU-U.S. Data Privacy Framework or standard contractual clauses apply.
Automated decisions
If you accept analytics cookies, we associate with your request the pages you visit on our website and assign an interest score that helps our team prioritise follow-up. The basis is our legitimate interest. No automated decisions will be taken that produce legal effects or that significantly affect you. You may object to this processing at any time at [email protected].
Data retention period
We will process your personal data for as long as it is necessary for the purpose for which it was collected and, in any event, for as long as the consent remains in force, in accordance with the periods legally established by the applicable legislation. Specifically:
- Requests for information, a call, a meeting or a quotation: while they are being handled.
- Commercial follow-up: up to 24 months without activity on your part, or until you tell us that you are not interested.
- Contact data of those who do not end up contracting: as long as they do not request erasure or object, reviewing periodically whether the data is still necessary.
- Results of the dark web exposure analysis: 30 days.
- Subscriptions to the newsletter, alerts, events and news: until you unsubscribe.
- Client data: during the contractual relationship and, afterwards, for the periods required by tax and commercial regulations.
The data will be kept stored in our database for as long as the relationship with us continues.
Once the contractual relationship has ended, we will not keep your personal data for any purpose for longer than necessary and we will only retain the personal data necessary in relation to that purpose. In addition, we have to keep certain information in accordance with the law or for as long as is reasonably necessary to comply with the applicable legislative requirements, such as resolving disputes, preventing fraud and abuse or enforcing our terms and conditions.
Rights
- Access. You may consult your personal data included in our files.
- Rectification. You may modify your personal data when it is not accurate.
- Erasure. You may request the deletion of your data, and also where, among other grounds, the data is no longer necessary for the purposes for which it was collected.
- Request the portability of your data, or its transmission to another entity.
- Objection. You may request that your personal data not be processed. ASPERIS SECURITY, S.L will cease processing the data, save on compelling legitimate grounds, or for the exercise or defence of possible claims. When you object to receiving commercial communications or to the assessment of your interest, we will stop doing so in all cases.
- Restriction. You may exercise restriction, among other cases, when you have objected to the processing of your personal data, for the satisfaction of a justified legitimate interest, in which case we will retain it solely for the exercise or defence of claims.
- Withdraw consent. You may withdraw at any time the consent you have given, without this affecting the lawfulness of the processing based on the consent prior to its withdrawal.
These rights may be exercised against ASPERIS SECURITY, S.L by sending your request to the email address [email protected]. We will only ask you for additional documentation to verify your identity where there are reasonable doubts about it. We will reply within one month, extendable by two further months in complex cases, informing you of this.
You may also lodge a complaint with the data protection Supervisory Authority.
In the event that your rights have not been respected, you may lodge a complaint by writing to the Spanish Data Protection Agency (AEPD), located at calle Jorge Juan, 6 28001-Madrid, or use the electronic office: https://sedeagpd.gob.es. In both cases, you must attach the relevant documentation.
Accuracy and updating of the data
The user must complete the forms with true, accurate, complete and current data. The user shall not enter data belonging to another person. It shall be presumed that the data has been provided by the owner thereof. The user shall be solely liable for any damage or loss, whether direct or indirect, that may be caused to any person as a result of completing the form with false, inaccurate, incomplete or out-of-date data or data relating to another person.
The user must notify any modification to the data provided in order to keep their data duly updated, following the procedures established by ASPERIS SECURITY, S.L.
Information security
All legally required measures have been taken for the protection of personal data. Likewise, all the technical devices within reach have been adopted in order to prevent the loss, misuse, alteration, access to or theft of the personal data provided by the users of the website. ASPERIS SECURITY, S.L is certified under ISO/IEC 27001 and the Spanish National Security Framework (Esquema Nacional de Seguridad, medium category). The user shall bear in mind, however, that security measures on the Internet are not absolutely inviolable.
Links to other Web sites
ASPERIS SECURITY, S.L offers links to other Web sites that we understand may be of use to users. The terms and conditions of this privacy and confidentiality policy do not apply to the aforementioned links, and therefore their inclusion does not imply any obligation on the part of ASPERIS SECURITY, S.L to access the products or services advertised or sold on them.
Legislation and jurisdiction
This privacy policy is governed by Spanish law.
Users and the company ASPERIS SECURITY, S.L submit all interpretations or disputes that may arise from this privacy policy to the Courts and Tribunals of Barcelona, without prejudice to any rights that the applicable legislation grants to consumers.
In case of discrepancy, the Spanish version prevails.