Privacy policy

1.- PURPOSE OF THE PRIVACY POLICY

The purpose of this “Privacy and Data Protection Policy” is to inform users about the conditions governing the collection and processing of personal data by MAINCER S.L., making every effort to safeguard fundamental rights, honor, and freedoms of individuals whose personal data is processed, in compliance with current regulations and laws governing Personal Data Protection according to the European Union and the Spanish Member State, specifically as outlined in the “Processing Activities” section of this Privacy Policy.

Therefore, in this Privacy and Data Protection Policy, users of the Website https://www.maincer.com are informed of all relevant details regarding how these processes are carried out, for what purposes, which other entities may have access to their data, and what rights users have.

2.- DEFINITIONS

“Personal data”: Any information about an identified or identifiable natural person (“the Website user”); an identifiable natural person is one whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more elements specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

“Processing”: Any operation or set of operations performed on personal data or sets of personal data, whether by automated or non-automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of enabling access, alignment or combination, restriction, erasure, or destruction.

“Restriction of processing”: The marking of stored personal data with the aim of limiting its processing in the future.

“Profiling”: Any form of automated processing of personal data consisting of using personal data to evaluate certain personal aspects of a natural person, in particular to analyze or predict aspects relating to that person’s professional performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

“Pseudonymization”: The processing of personal data in such a way that they can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures ensuring that the personal data are not attributed to an identified or identifiable natural person.

“Filing system”: Any structured set of personal data that is accessible according to specific criteria, whether centralized, decentralized, or distributed functionally or geographically.

“Controller” or “data controller”: The natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

“Processor” or “data processor”: The natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.

“Recipient”: The natural or legal person, public authority, agency, or other body to whom personal data is disclosed, whether or not it is a third party. However, public authorities that may receive personal data in the framework of a particular investigation in accordance with Union or Member State law shall not be considered recipients; the processing of such data by those public authorities shall comply with the applicable data protection rules for the purposes of processing.

“Third party”: A natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

“Consent of the data subject”: Any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

“Personal data breach”: Any security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed.

“Genetic data”: Personal data relating to the inherited or acquired genetic characteristics of a natural person that provide unique information about that person’s physiology or health, obtained in particular from the analysis of a biological sample from that person.

“Biometric data”: Personal data obtained from a specific technical processing operation relating to the physical, physiological, or behavioral characteristics of a natural person that allow or confirm the unique identification of that person, such as facial images or fingerprint data.

“Health data”: Personal data related to the physical or mental health of a natural person, including the provision of healthcare services, which reveal information about that person’s health status.

“Main establishment”:
a) In the case of a controller with establishments in more than one Member State, the place of its central administration in the Union, unless decisions on the purposes and means of processing are taken in another establishment of the controller in the Union and that establishment has the power to implement such decisions, in which case the establishment that made such decisions shall be considered the main establishment.
b) In the case of a processor with establishments in more than one Member State, the place of its central administration in the Union or, if it has no central administration, the processor’s establishment in the Union where the main processing activities take place in the context of the activities of an establishment of the processor, insofar as the processor is subject to specific obligations under this Regulation.

“Representative”: A natural or legal person established in the Union who has been designated in writing by the controller or processor in accordance with Article 27 of the GDPR to represent the controller or processor concerning their respective obligations under this Regulation.

“Undertaking”: A natural or legal person engaged in an economic activity, regardless of its legal form, including partnerships or associations that regularly carry out an economic activity.

“Supervisory authority”: The independent public authority established by a Member State under Article 51 of the GDPR. In Spain, this is the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

“Cross-border processing”:
a) The processing of personal data carried out in the context of the activities of establishments in more than one Member State of a controller or a processor in the Union, if the controller or processor is established in more than one Member State, or
b) The processing of personal data carried out in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

“Information society service”: Any service of the information society, that is, any service normally provided for remuneration, at a distance, by electronic means, and at the individual request of a recipient of services.

3.- IDENTITY OF THE DATA CONTROLLER 

The Data Controller is the natural or legal person, public or private entity, or administrative body that alone or jointly with others determines the purposes and means of the processing of personal data.

Regarding the aspects outlined in this Privacy and Data Protection Policy, the identity and contact details of the Data Controllers are:

MAINCER S.L. (B12219507)

Address: C/Asturias, Nº4, Pol. Ind. El Colador. 12200, Onda (Castellón), Spain

Prodima Proyectos Diseño y Maquinaria S.L. (B12436127)

Address: C/Islas Canarias, Nº3. 12200, Onda (Castellón), Spain

4.- APPLICABLE LAWS AND REGULATIONS

This Privacy and Data Protection Policy is developed based on the following regulations and data protection laws:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, concerning the protection of natural persons regarding the processing of personal data and the free movement of such data. Hereinafter GDPR.
• Organic Law 3/2018 of December 5, on Personal Data Protection and Guarantee of Digital Rights. Hereinafter LOPD/GDD.
• Law 34/2002 of July 11, on Information Society Services and Electronic Commerce. Hereinafter LSSICE.

5.- PRINCIPLES APPLICABLE TO PERSONAL DATA PROCESSING

The personal data collected and processed through this website will be processed according to the following principles:

• Lawfulness, fairness, and transparency principle: All personal data processing carried out through this Website will be lawful and fair, with total clarity for the user when their personal data is being collected, used, consulted, or processed. The information regarding the processing will be provided in advance, easily accessible, and easy to understand, in a simple and clear language. 
• Purpose limitation principle: All data will be collected for specified, explicit, and legitimate purposes, and will not be processed later in a way incompatible with the purposes for which they were collected.
• Data minimization principle: The data collected will be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
• Accuracy principle: The data will be accurate and, where necessary, kept up to date, taking all reasonable measures to ensure that inaccurate data is erased or corrected without delay with respect to the purposes for which it is processed.
• Storage limitation principle: The data will be kept in a form that allows identification of the data subjects for no longer than necessary for the purposes of the personal data processing.
• Integrity and confidentiality principle: The data will be processed in a way that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss or damage, through the implementation of appropriate technical and organizational measures.
• Accountability principle: The owner of the Website will be responsible for complying with the principles outlined in this section and will be able to demonstrate this.

6.- DATA PROCESSING ACTIVITIES

The following outlines the data processing activities carried out through the Website, specifying each of the following sections:

• Activity: Name of the data processing activity
• Purposes: Each of the uses and processes carried out with the collected data
• Legal basis: The legal basis that legitimizes the data processing
• Data processed: Types of data processed
• Source: Where the data is obtained from
• Storage: The period during which the data is kept
• Recipients: Persons or third-party entities to whom the data is provided
• International transfers: Cross-border transfers of data outside the European Union

6.1 MAIN DATA PROCESSING ACTIVITIES

These are the data processing activities whose purposes are necessary and essential for the provision of services.

6.2 OPTIONAL DATA PROCESSING ACTIVITIES (if the user has marked their acceptance)

These are the personal data processing activities whose purposes are not essential for the provision of the service and are carried out only if the user has selected YES in the consent for these activities.

7.- NECESSARY AND UPDATED INFORMATION

All fields marked with an asterisk (*) in the forms on the Website must be completed, and failing to complete any of them may result in the inability to provide the requested services or information.

You must provide truthful information so that the data provided is always up-to-date and free of errors. Any changes and corrections to your personal data must be communicated to the Data Controller as soon as possible via email at: comercial@maincer.es.

Furthermore, by clicking on the “I Accept” button (or equivalent) incorporated in the mentioned forms, you declare that the information and data you have provided are accurate and truthful, and that you understand and accept this Privacy Policy.

8.- MINOR’S DATA

In compliance with Article 8 of the GDPR and Article 7 of the LOPD/GDD, only those over 14 years of age may give consent for the processing of their personal data legally by MAINCER S.L.

Therefore, minors under 14 years of age may not use the services available through the Website without prior authorization from their parents, guardians, or legal representatives, who will be solely responsible for all actions carried out on the Website by minors under their care, including filling out online forms with the minor’s personal data and marking the associated checkboxes, if applicable.

9.- TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

The Data Controller takes the necessary organizational and technical measures to ensure the security and privacy of your data, prevent its alteration, loss, unauthorized processing, or access, depending on the state of technology, the nature of the stored data, and the risks they are exposed to.

Among others, the following measures stand out:

• Ensure the confidentiality, integrity, availability, and permanent resilience of the processing systems and services.
• Restore the availability and access to personal data quickly in case of a physical or technical incident.
• Regularly verify, evaluate, and assess the effectiveness of the technical and organizational measures implemented to ensure the security of processing.
• Pseudonymize and encrypt personal data if it involves sensitive data.

On the other hand, the Data Controller has decided to manage the information systems according to the following principles:

• Compliance principle: All information systems will comply with applicable legal and regulatory standards affecting information security, especially those related to personal data protection, system security, data, communications, and electronic services.
• Risk management principle: Risks will be minimized to acceptable levels, and a balance between security controls and the nature of the information will be sought. Security objectives must be established, reviewed, and consistent with information security aspects.
• Awareness and training principle: Training programs, awareness campaigns, and sensitization efforts will be implemented for all users with access to information on information security.
• Proportionality principle: The implementation of controls to mitigate security risks to assets will be carried out by seeking a balance between security measures, the nature of the information, and the risks.
• Responsibility principle: All members of the Data Controller will be responsible for their conduct regarding information security, complying with the established rules and controls.
• Continuous improvement principle: The effectiveness of the security controls implemented within the organization will be regularly reviewed to increase the ability to adapt to the constant evolution of risks and the technological environment.

10.- RIGHTS OF THE DATA SUBJECT

Current data protection regulations safeguard the user’s rights regarding the use of their data. Each of these rights is personal and non-transferable, meaning that they can only be exercised by the data subject, after verifying their identity.

Below are the rights of the Website users:

• Right of access: This is the right of the Website user to obtain confirmation of whether or not the Data Controller is processing their personal data and, if so, to obtain information about their specific personal data and the processing carried out or to be carried out by the Data Controller, including, among other things, information available about the origin of the data and the recipients of communications made or planned.
• Right of rectification: This is the right of the Website user to have their personal data modified if it is inaccurate or, considering the purpose of the processing, incomplete.
• Right to erasure: Commonly known as the “right to be forgotten,” this is the Website user’s right, provided that current legislation does not state otherwise, to obtain the deletion of their personal data when the data is no longer necessary for the purposes for which it was collected or processed; when the user has withdrawn their consent to the processing and there is no other legal basis for it; when the user objects to the processing and there is no other legitimate reason to continue it; when the personal data has been processed unlawfully; or when the personal data has been obtained as a result of a direct offer of information society services to a child under the age of 14. In addition to deleting the data, the Data Controller, considering the available technology and implementation cost, will take reasonable steps to inform other possible controllers processing the personal data of the data subject’s request to delete any links to such personal data.
• Right to restriction of processing: The Website user has the right to limit the processing of their personal data. The user is entitled to obtain processing restrictions when they contest the accuracy of their personal data; when the processing is unlawful; when the Data Controller no longer needs the personal data but the user requires it to make claims; or when the Website user has objected to the processing.
• Right to data portability: When the processing is carried out by automated means, the Website user has the right to receive their personal data from the Data Controller in a structured, commonly used, and machine-readable format, and to transmit it to another data controller. When technically possible, the Data Controller will transmit the data directly to the other Controller.
• Right to object: The Website user has the right to object to the processing of their personal data or to have the processing of their data stopped by the Data Controller.
• Right not to be subject to automated decisions and/or profiling: The Website user has the right not to be subject to an individualized decision based solely on the automated processing of their personal data, including profiling, except when otherwise provided by current legislation.
• Right to withdraw consent: The Website user has the right to withdraw, at any time, the consent given for the processing of their data.

The Website user can exercise any of the aforementioned rights by contacting the Data Controller and identifying themselves using the following contact information:

• Data Controller: MAINCER S.L.
• Address: C/Asturias, Nº4, Pol. Ind. El Colador. 12200, Onda (Castellón), Spain
• Phone: 964 771 530
• E-mail: comercial@maincer.es
• Website: https://www.maincer.com

11.- RIGHT TO LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY

The user is informed of their right to file a complaint with the Spanish Data Protection Agency if they believe that there has been a breach of data protection legislation concerning the processing of their personal data.

Contact information for the supervisory authority:

Spanish Data Protection Agency
Email: info@aepd.es
Phone: 912663517
Website: https://www.aepd.es
Adress: C/. Jorge Juan, 6. 28001, Madrid (Madrid), España

12.- ACCEPTANCE AND CHANGES IN THE PRIVACY POLICY

It is necessary for the Website user to have read and agreed to the data protection conditions contained in this Privacy Policy, as well as accept the processing of their personal data so that the Data Controller can proceed with it in the manner, timelines, and purposes specified.

The Data Controller reserves the right to modify this Privacy Policy at its discretion or due to legislative, jurisprudential, or doctrinal changes by the Spanish Data Protection Agency. Any changes or updates to this Privacy Policy affecting purposes, retention periods, data transfers to third parties, international data transfers, or any other user rights will be explicitly communicated to the user.

Version of February 7, 2025