Privacy policy

1. Controller

The controller of the personal data collected through this website is Albujon Energy SL, Tax ID B57486318, with its registered office at Paseo de la Castellana 259C, Floor 18, 28046 Madrid (Spain), entered in the Madrid Commercial Registry, Volume 45606, Sheet M-801977.

Contact address for data protection matters: organizacionalbujon@gmail.com.

The company is not required to appoint a data protection officer under Article 37 of Reglamento (UE) 2016/679 (hereinafter, “GDPR”) or Article 34 of Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (hereinafter, “LOPDGDD”, the Spanish act on personal data protection and the guarantee of digital rights), and it has not appointed one voluntarily. Enquiries are dealt with at the address given above.

2. Data processed

Only the data that the data subject provides voluntarily is processed. Applying the principle of data minimisation (Art. 5(1)(c) GDPR), the form asks only for what is necessary in order to reply:

• Identification and contact data: name and email address. Both are mandatory, because without them the sender cannot be identified or answered.
• Professional data: company or organisation. This field is optional.
• Content of the message: the information the person chooses to include in the free-text field, including whatever they voluntarily add about their project.
• Confirmation of acceptance of this policy, which is recorded together with the message as evidence of the consent given.

In addition, the hosting and form providers record technical connection data — IP address, date and time of the request, browser type and operating system — in their server logs, in order to maintain the service and protect it against abusive use.

No special categories of data of those referred to in Article 9 GDPR (health, beliefs, trade union membership, ethnic origin or others) are requested. Please do not include them in the message field. Nor is data relating to criminal convictions or offences collected.

3. Purpose of the processing

The data is processed solely in order to:

• Receive, read and deal with the enquiry, request for information or proposal sent.
• Maintain with the data subject any subsequent correspondence needed to resolve it, including requests for clarification.
• Assess, where the enquiry raises it, whether there is a fit for a possible professional relationship, and give a reply even if that reply is negative.
• Keep evidence of the consent and meet any legal requirements that may arise.

The data is not used to send commercial communications, no profiles are built for advertising purposes and it is not fed into prospecting activities. If the company wished in future to use it for a different purpose, it would give prior notice and obtain the corresponding consent.

4. Legal basis for the processing

• Consent of the data subject (Art. 6(1)(a) GDPR), given by expressly ticking the box accompanying the form and voluntarily sending the message. Consent may be withdrawn at any time, without the withdrawal affecting the lawfulness of the processing carried out beforehand.
• Application of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR), where the enquiry consists of a proposal for collaboration or a request to assess a project.
• Compliance with legal obligations (Art. 6(1)(c) GDPR), as regards keeping evidence of the consent and dealing with data subjects' rights.
• Legitimate interest (Art. 6(1)(f) GDPR) in processing the technical connection data strictly necessary to maintain the security and availability of the website against attacks, abuse and automated submissions.

Providing the data marked as mandatory is a requirement for a reply to be possible. Not providing it prevents the enquiry from being handled, with no other consequence.

5. Retention period

The data is kept for as long as necessary to deal with the enquiry and, once it is resolved, for the period during which liabilities may arise from the relationship established, after which it is erased. As a guide:

Once these periods have elapsed, the data is blocked and remains available solely to the competent authorities for the limitation period of the relevant actions, under Article 32 LOPDGDD, and is then erased.

6. Recipients and processors

Albujon Energy does not sell, rent or disclose personal data to third parties. The only third parties with access to it are the service providers needed for the website and the mailbox to work, which process it on behalf of the controller and following its instructions, as processors within the meaning of Article 28 GDPR.

In relation to the contact form, Albujon Energy acts as controller and Web3Creative, the operator of Web3Forms, as processor. The provider publishes a data processing agreement available to its customers, setting out the list of sub-processors and the international transfer mechanism. Albujon Energy intends to adopt that agreement before the form is brought into service; until then, what is described here corresponds to the intended processing and not to a relationship already formalised.

According to the information published by the provider itself, the sub-processors involved in the service are Amazon Web Services (hosting, database, storage and mail delivery), Cloudflare (content delivery network and security of the point where submissions are received) and Hetzner (application infrastructure).

Besides the above, the data may be disclosed to courts and tribunals, law enforcement bodies and public authorities where a legal obligation requires it.

7. International data transfers

The processing described involves transfers of personal data outside the European Economic Area, specifically to India and the United States. This is expressly notified in accordance with Article 13(1)(f) GDPR.

The applicable safeguards are as follows:

• For transfers covered by Standard Contractual Clauses, those adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, under Article 46(2)(c) GDPR.
• For transfers to United States entities adhering to the EU-US Data Privacy Framework, the European Commission adequacy decision of 10 July 2023, under Article 45 GDPR.

Data subjects may request further information on these safeguards and obtain a copy of the applicable mechanisms by writing to the address given in section 1. Anyone who prefers their data not to be transferred outside the European Economic Area may contact the company by post at its registered office, instead of using the form.

8. Automated decisions and profiling

No automated decisions are taken, including profiling, that produce legal effects on data subjects or similarly significantly affect them, within the meaning of Article 22 GDPR. Every enquiry received is read and assessed by a person at the company.

The automatic filters the form applies to discard submissions generated by robots do not assess the person or their circumstances: they check only technical indicators of the submission. If a legitimate message is discarded, it may be sent directly to the contact email address.

9. Rights of data subjects

The GDPR and the LOPDGDD grant every data subject the following rights over their personal data:

• Access: to find out whether their data is being processed and, if so, to obtain a copy of it and of the information about its processing.
• Rectification: to correct inaccurate data and complete incomplete data.
• Erasure: to request the deletion of their data where, among other cases, it is no longer necessary for the purpose that gave rise to it.
• Objection: to object to the processing on grounds relating to their particular situation.
• Restriction of processing: to ask for the data to be kept without being processed, in the cases provided for by the rules.
• Portability: to receive their data in a structured, commonly used and machine-readable format, or to ask for it to be transmitted to another controller.
• Withdrawal of consent at any time, without retroactive effect on processing already carried out.

To exercise them, simply send a request to organizacionalbujon@gmail.com or to Albujon Energy SL, Paseo de la Castellana 259C, Floor 18, 28046 Madrid, stating the right being exercised and enclosing a copy of a document proving the identity of the person making the request. Exercising these rights is free of charge.

The request is resolved within one month of its receipt. Where the complexity or the number of requests justifies it, that period may be extended by a further two months, with prior notice to the data subject of the reason for the extension.

10. Complaint to the supervisory authority

If a data subject considers that the processing of their data does not comply with the rules, or that their request to exercise rights has not been properly dealt with, they may lodge a complaint with the Agencia Española de Protección de Datos, the competent supervisory authority in Spain:

• C/ Jorge Juan, 6 — 28001 Madrid
• www.aepd.es

Beforehand, and without this being a requirement for lodging a complaint, they may write to the contact address in section 1 to try to resolve the matter directly with the controller.

11. Children under fourteen

This website is not aimed at minors and its contents are of no specific interest to them. Under Article 7 LOPDGDD, the processing of the data of a child under fourteen is lawful only with the consent of the holder of parental responsibility or guardianship.

Accordingly, children under fourteen must not use the contact form without that consent. If the company were to notice that it had received data from a child of that age without the corresponding authorisation, it will erase it without delay. Any legal representative who becomes aware of such a situation may report it to the address in section 1.

12. Security measures

Albujon Energy has adopted appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Articles 5(1)(f) and 32 GDPR, taking into account the state of the art, the costs of implementation and the nature and scope of the processing. They include:

• Encrypted transmission of all website traffic and of the form submission by means of HTTPS (TLS).
• A strict content security policy and security headers on the server, which limit the execution of external code on the pages.
• Encryption of data at rest in the form provider's infrastructure, according to the technical information it publishes.
• Minimisation of the data requested and restriction of access to those people at the company who have to deal with the enquiry.
• Mechanisms for detecting automated submissions that reduce incoming unsolicited content.
• Periodic review of the measures and of the providers engaged.

No measure removes the risk entirely. Should a personal data breach occur that entails a risk to people's rights and freedoms, it will be notified to the Agencia Española de Protección de Datos and, where appropriate, to those affected, under Articles 33 and 34 GDPR.

13. Changes to this policy

This policy may be amended to adapt it to regulatory changes, to rulings by supervisory authorities or to changes in the services used. The version in force is always the one published at this address, and the date of the last update appears at the top of the page.

Where the change is substantial and affects processing based on consent, the consent of data subjects will be obtained again. It is advisable to review this page before sending any communication through the website.

Further information about the site owner in the legal notice and about storage devices in the cookie policy.

This English version is provided for information only. In the event of any discrepancy, the Spanish version shall prevail.