Privacy policy

Last updated: September 28, 2026

In accordance with the principles of lawfulness, fairness, and transparency, and in compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), and Law 34/2002 on Information Society Services and Electronic Commerce (LSSI), we hereby provide you with this Privacy Policy.

1. Data Controller

Fact	Details
Responsible Party	Valpatek Technology Group, S.L.
Tax ID Number	B88492186
Registered Office	C/ Sector Oficios, 32, 28760 Tres Cantos (Madrid), Spain
Email	dpo@valpatek.com
Phone	+34 919 310 990
Data Protection Officer	dpo@valpatek.com

2. Data We Process and Its Sources

Depending on your relationship with us, we process the following categories of data:

• Identifying and professional contact information: first and last name, job title, company or organization, email address, and phone number.
• Business and contractual information: products and services purchased, quotes, orders, and support issues.
• Billing Information: tax and bank information required for billing and collection or payment.
• Browsing data and, in the case of email communications, data regarding message opens and link clicks.
• For candidates, resume information.

The data is provided by the data subject or by the company or organization where the data subject works, within the framework of the business or professional relationship. It may also be provided by manufacturers with whom Valpatek has distribution or collaboration agreements, in accordance with the terms set forth in those agreements.

Valpatek does not process special categories of data as part of its own business activities, nor does it collect data from minors.

3. Purposes of Data Processing

Depending on the category of data subject in question, we process the information you provide to us for the following purposes:

Data Subjects	Purposes of Data Processing
Prospective customers	To manage potential business and/or professional relationships, send requested information and/or respond to inquiries, and provide offers for our services and/or products that may be of interest to you.
Customers	Manage the business and/or professional relationship, including installation, maintenance, technical support, and billing for the contracted products and services, as well as communication with the designated contacts at the client company or organization.
	Send information and offers regarding products and services similar to those purchased (new products, maintenance, equipment or supplies replacement) and track the open and click-through rates for those communications.
Suppliers	Manage the business and/or professional relationship and maintain contact with the supplier’s representatives.
Candidates	Manage the recruitment process.
Web Users	Manage the analysis of your browsing data.
All interested parties	Ensure the security of information systems in accordance with the National Security Framework and comply with applicable legal obligations.

4. Legal Basis for Data Processing

The legal basis for the processing of your personal data, depending on the category of data subject in question, may be:

Interested Parties	Standing
Potential customers	Art. 6.1.b GDPR: implementation, at the data subject’s request, of precontractual measures (quotes, order forms, service offers).
	Art. 6.1.f GDPR: legitimate interest (to send the requested information and respond to inquiries).
	Art. 6.1.a of the GDPR: consent of the data subject (to provide information about our services and/or products).
Customers	Art. 6.1.b GDPR: performance of a contract to which the data subject is a party.
	Art. 6.1.c of the GDPR: compliance with legal obligations (tax, accounting, and commercial).
	Art. 6.1.f of the GDPR and Art. 19 of the LOPDGDD: legitimate interest in maintaining contact with individuals who provide services to the client company or organization.
	Art. 6.1.f of the GDPR and Art. 21.2 of the LSSI: legitimate interest in sending communications about products and services similar to those contracted; the data subject may object at any time.
Suppliers	Art. 6.1.b GDPR: performance of a contract to which the data subject is a party.
	Art. 6.1.c of the GDPR: compliance with legal obligations.
	Art. 6.1.f of the GDPR and Art. 19 of the LOPDGDD: legitimate interest in maintaining contact with the supplier’s points of contact.
Candidates	Art. 6.1.a GDPR: consent of the data subject.
Web Users	Art. 6.1.a GDPR: consent of the data subject.
All interested parties	Art. 6.1.c and 6.1.f of the GDPR: compliance with legal obligations and legitimate interest in ensuring information security.

The information we request from you is appropriate, relevant, and strictly necessary, and you are under no obligation to provide it to us; however, failure to do so may affect the purpose of the service or make it impossible to provide it.

5. Retention Periods

Your data will be retained for the minimum time necessary to properly provide the service offered, as well as to fulfill any obligations that may arise from the service and any other legal requirements.

6. Recipients of the data

Valpatek Technology Group, S.L. will not disclose your data to any third party, unless expressly stated otherwise. Certain data, pursuant to applicable regulations or the contractual relationship you have with Valpatek, may be disclosed to:

• Banks and financial institutions, for the purpose of billing for contracted services and/or purchased products.
• Government agencies with jurisdiction over the sectors in which Valpatek operates, when required by applicable regulations.
• Manufacturers of the equipment and solutions we have contracted, when necessary to manage warranties, licenses, or technical support.

Valpatek also works with vendors that process data on its behalf as data processors, with whom it has entered into the contracts required by Article 28 of the GDPR, in the following categories: email, office automation, and cloud storage services; business management and CRM software; email communication platforms; web hosting; and tax, accounting, and labor consulting services.

7. International Transfers

Valpatek may transfer data internationally via its website as a result of users’ acceptance of cookies. Google LLC and Google Ireland Limited transfer data to the United States based on the user’s consent upon accepting cookies.

By accepting cookies from these entities, the user consents to the transfer of any personal data that may be collected through the loading and reading of cookies to the United States, a country where a level of protection comparable to that in Europe is provided only by companies included on the EU-U.S. Data Privacy List. If U.S. companies are not participants in the DPF, it will be understood that they do not guarantee a level of protection comparable to that in Europe.

If the user does not consent to this international data transfer to the United States, they must reject these cookies; however, the features or services provided by them will not be available. You can find information about any transfers to third countries made by the third parties identified in the cookie policy in their respective policies.

In addition, Valpatek may carry out international transfers resulting from the use of technology services provided by vendors such as Microsoft Ireland Operations Ltd., WhatsApp Ireland Limited, and the email communication platform. These transfers are carried out with adequate safeguards: adequacy decisions by the European Commission, including the Data Privacy Framework, or standard contractual clauses approved by the Commission.

8. Marketing Communications and Unsubscribe

All commercial communications that Valpatek sends via email include a link to unsubscribe easily and free of charge. You can also request to unsubscribe by writing to dpo@valpatek.com.

The cancellation will take effect immediately and will not affect the contractual relationship or the communications necessary for the provision of the service, such as support, maintenance, or billing notifications.

9. Rights of Data Subjects

The data protection rights that data subjects may exercise, where applicable, are:

Law	What It Is
Access	Find out what personal data the data controller processes.
Correction	To correct personal data processed by the data controller when such data is inaccurate, incorrect, or incomplete.
Objection	Request that the data controller not process your personal data for certain specific purposes, including the sending of marketing communications.
Deletion	Request that the data controller delete your personal data.
Restriction	Request that the data controller restrict the processing of your personal data.
Portability	When processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable, and interoperable format, and to transmit that data to another data controller.
Not to be subject to automated individual decision-making	You have the right not to be subject to a decision based solely on the automated processing of your data, including profiling, that produces legal effects concerning you or similarly significantly affects you.
Complaint to the Competent Authority	File a complaint with the Spanish Data Protection Agency (AEPD) if you believe your personal data has been processed in violation of the regulations.

Data subjects may exercise their rights by sending a written request to the registered office of Valpatek Technology Group, S.L., located at C/ Sector Oficios, 32, 28760 Tres Cantos (Madrid), Spain, or to the email address provided for this purpose: dpo@valpatek.com. The request must specify the right being exercised. We will respond within one month at the latest.

Templates for exercising each of these rights, as well as additional information on how to exercise them, are available on the official website of the Spanish Data Protection Agency: www.aepd.es.

10. Withdrawal of Consent

You have the option and the right to withdraw the consent you have given for any specific purpose, without this affecting the lawfulness of the processing based on the consent given prior to its withdrawal.

11. Complaint Filed with the Supervisory Authority

If any data subject believes that their personal data is not being processed properly by Valpatek Technology Group, S.L., or that requests to exercise their rights have not been addressed satisfactorily, they may file a complaint with the appropriate data protection authority, which in Spain is the Spanish Data Protection Agency (AEPD). For more information, visit their website: www.aepd.es.

12. Valpatek as the data controller

When Valpatek provides services to its clients—such as the installation, maintenance, or support of queue management systems, digital signage, or IT systems—it may access personal data for which the client is responsible.

In such cases, Valpatek acts as a data processor and processes the data solely in accordance with the client’s instructions and the data processing agreement entered into with the client. This policy does not govern such processing, which is governed by that agreement and the client’s privacy policy.

13. Security and Updating Your Information

In order to safeguard the security of your personal data, we would like to inform you that Valpatek Technology Group, S.L. has adopted all necessary technical and organizational measures to ensure the security of the personal data provided, and holds certification under the National Security Scheme (Royal Decree 311/2022) at the MEDIUM level. All of this is intended to prevent the alteration, loss, and/or unauthorized processing or access to your data, as required by law, although absolute security does not exist.

It is important that you notify us whenever your personal information changes so that we can keep it up to date.

14. Confidentiality

Valpatek Technology Group, S.L. hereby informs you that your personal data will be handled with the utmost care and confidentiality by all personnel involved in any phase of the processing. We will not transfer or disclose your personal data to any third party, except in cases provided for by law or unless you have expressly authorized us to do so.

15. Updates to This Policy

Valpatek may update this policy to reflect changes in regulations or in its data processing practices. The current version will always be available at https://valpatek.com/politica-privacidad/. When changes are significant, they will be communicated to the data subjects.