Strapping consumables, machinery and technical service. International delivery.

dev@biosabau.com
Request a quote

Legal

Privacy Policy

Last updated

Summary

  • We process the personal data you or your company send us, the results of our export-control and sanctions screening, and the technical data needed to deliver and protect this website.
  • We use it to answer your requests, prepare quotations, perform contracts and carry out the export-control and sanctions checks the law requires.
  • We do not use analytics or tracking tools, we do not build profiles, we take no automated decisions about you and we do not send marketing.
  • You can object at any time to processing based on our legitimate interests, and exercise your other rights, by writing to dev@biosabau.com, as explained in Your right to object and Your rights.

This policy is issued under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Spanish Organic Law 3/2018 of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (“LOPDGDD”).

Controller

  • Controller: the company that operates this website under the name Sumitec
  • Contact for data protection matters: dev@biosabau.com

The Legal Notice identifies the operator of this website.

If the company that operates Sumitec changes, we will update this policy before the new company processes personal data as a controller, identifying it together with any representative in the European Union that it must designate under Article 27 GDPR, and we will tell you if data we hold about you is to be passed to it.

Data we process

Data you send us

The website has no forms and no user accounts. We receive personal data from you only when you write to dev@biosabau.com, for example with the “Request a quote” button, which opens a pre-filled message in your e-mail program. Depending on what you send, we process:

  • identification and contact data: name, job title, company, e-mail address and, if you provide them, phone number and postal address;
  • the content of your request: the products or services concerned, quantities, delivery terms and place, required dates, technical information and any attachments;
  • the information needed for export-control and sanctions checks: the identity of your company and, where sanctions law requires it, of those who own or control it, as well as the end user, end use and destination of the goods;
  • if an order follows, the data needed to perform the contract, invoice it and collect payment.

Please send only what your request needs, and do not send special categories of data, such as health data. If you send us data about other people, for example colleagues, make sure you are entitled to share it.

Data we receive from others

We may receive data about you from the company you work for or that deals with us, for example when it names you as a contact person, consignee or end user, or as one of its owners for sanctions checks. To screen the parties to a transaction, we compare their names with official sanctions lists and, where needed, consult public registers.

Data processed when you visit the website

Each time your browser requests a page, it sends technical data such as your IP address, the date and time, the page requested, your browser and operating system, and the page you came from. Our hosting and content delivery provider processes this data to deliver the website and to protect it against attacks and abuse. We do not use it to identify visitors, we do not combine it with other data and we do not use it for analytics.

The website sets no cookies and stores nothing in your browser; see the Cookie Policy.

We process personal data only for the following purposes, each listed with its legal basis under Article 6(1) GDPR.

  • Answering your requests and preparing quotations. If you act for yourself, as a sole proprietor or self-employed professional, the basis is taking steps at your request before entering into a contract (Article 6(1)(b)). If you write on behalf of a company, it is our legitimate interest in answering business requests and maintaining relations with that company (Article 6(1)(f) GDPR and Article 19 LOPDGDD).
  • Performing contracts. Delivering goods, providing technical service, invoicing and collecting payment: the performance of the contract (Article 6(1)(b)) or, for the contact persons of a corporate customer, our legitimate interest in performing the contract with their company (Article 6(1)(f)).
  • Export-control and sanctions checks. Screening customers, end users, other parties and destinations before quoting and before shipping: compliance with the export-control and sanctions laws that apply to us (Article 6(1)(c)) and, where a check goes beyond what a law strictly requires, our legitimate interest in not dealing with sanctioned parties and not supplying prohibited end uses (Article 6(1)(f)).
  • Accounting, tax and customs records. Compliance with legal obligations (Article 6(1)(c)).
  • Handling reports of concerns sent as described on the Compliance page: our legitimate interest in detecting and correcting misconduct (Article 6(1)(f)) or, where the law requires us to have a reporting channel, compliance with that obligation (Article 6(1)(c)).
  • Delivering and protecting the website. Our legitimate interest in keeping the website available and secure (Article 6(1)(f)).
  • Legal claims. Our legitimate interest in establishing, exercising or defending legal claims (Article 6(1)(f)).

Where we rely on our legitimate interests, you can ask us at dev@biosabau.com for information on how we have balanced them against your interests, rights and freedoms.

We do not use personal data for purposes that are incompatible with these. Providing your data is voluntary, but without the data a request needs we cannot answer it, and without the data required for compliance checks we cannot supply goods or services.

How long we keep data

  • Requests that do not lead to an order: for as long as needed to answer them and to follow up on the quotation.
  • Customers and orders: for as long as the business relationship lasts.
  • Afterwards: we keep the data blocked, as provided for in Article 32 LOPDGDD. Access to it is restricted, and it is kept only to meet legal obligations, such as accounting, tax and export-control record keeping, and for as long as legal claims can be brought. We then delete it.
  • Reports of concerns: only for as long as needed to assess and investigate them, unless they are needed as evidence or the law requires us to keep them longer.
  • Technical data processed by our hosting provider: only for as long as the provider needs it to deliver and protect the website.

Who receives data

We do not sell personal data and we do not share it for marketing. Within our organization, only the people who need the data for the purposes above can access it. We disclose it outside our organization only where necessary:

  • Service providers acting on our behalf. Cloudflare hosts and delivers the website, and our e-mail service provider hosts the mailbox that receives your messages. They act as processors: they process the data only on our instructions and under the data processing terms required by Article 28 GDPR.
  • Carriers, freight forwarders and customs agents, when needed to deliver an order, and banks, to process payments.
  • Manufacturers and suppliers of the goods, when needed to deliver an order, handle a warranty claim, repair a machine or supply spare parts.
  • Public authorities and courts, such as tax, customs and export-control authorities, when the law requires it or when we apply for an export license.
  • Professional advisers, such as lawyers and auditors, who are bound by a duty of confidentiality.

International transfers

Some of our providers, including Cloudflare, may process data outside the European Economic Area, in particular in the United States. Where this happens, the transfer is covered, where applicable, by an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for providers certified under it, or by standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR).

When we deliver goods or provide services outside the European Economic Area, we share the data needed to do so with carriers, forwarders, customs agents and authorities in the countries concerned, where this is necessary for the conclusion or performance of the contract (Article 49(1) GDPR).

You can ask us for more information on these safeguards, or for a copy of them, at dev@biosabau.com.

Your right to object

You can object at any time, on grounds relating to your particular situation, to the processing of your personal data that relies on our legitimate interests (Article 6(1)(f) GDPR). Purposes and legal bases lists the purposes that rely on them. To object, write to dev@biosabau.com. We will then stop that processing, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims (Article 21(1) GDPR).

Your rights

You have the following rights over your personal data:

  • Access: to know whether we process your data and to obtain a copy of it.
  • Rectification: to have inaccurate or incomplete data corrected.
  • Erasure: to have your data deleted when it is no longer needed, or in the other cases provided for by law.
  • Restriction: to have the processing restricted in the cases provided for by law, for example while we check the accuracy of your data.
  • Portability: to receive the data you have given us in a structured, commonly used and machine-readable format, and to have it sent to another controller, where the processing is carried out by automated means to perform a contract.
  • Objection: to object to processing that relies on our legitimate interests, as explained in Your right to object.

To exercise them, write to dev@biosabau.com and tell us which right you want to exercise. If we have reasonable doubts about your identity, we may ask for the information needed to confirm it. Exercising your rights is free of charge. We will reply without undue delay and in any event within one month. Where the GDPR allows that period to be extended, we will tell you within the first month and explain why.

Complaints

If you believe that we have not handled your data lawfully, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), through its website at aepd.es, or with the supervisory authority of the EU member state where you live or work or where the alleged infringement took place. We would appreciate the chance to address your concern first, so please consider contacting us beforehand.

Automated decisions, profiling and marketing

We do not take decisions based solely on automated processing, we do not create profiles, and we do not use analytics, advertising or tracking tools. We do not send newsletters or marketing communications. If that ever changes, we will ask for your consent beforehand where the law requires it.

Security

We apply technical and organizational measures appropriate to the risk to protect personal data against loss, misuse and unauthorized access or disclosure. The website is served over encrypted connections (HTTPS) and loads no content from third parties.

Changes to this policy

We may update this policy, for example when the company that operates Sumitec changes, or when the law changes. The date at the top of this page shows the last update. If a change significantly affects how we process data we already hold, we will inform the people concerned.