Privacy Policy
The purpose of this “Privacy and Data Protection Policy” is to inform users of the conditions governing the collection and processing of personal data by Jabones Beltrán, making every effort to safeguard the fundamental rights, honour and freedoms of the persons whose personal data are processed, in compliance with the current regulations and laws governing the protection of personal data in the European Union and the Spanish Member State and, specifically, those stated in the “Processing Activities” section of this Privacy Policy.
Therefore, this Privacy and Data Protection Policy informs users of the Website http://jabonesbeltran.com of all details of interest to them regarding how these processes are carried out, the purposes for which they are carried out, which other entities may have access to their data and what the users’ rights are.
«Personal data»: Any information relating to an identified or identifiable natural person (“the Website user”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
«Processing»: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
«Restriction of processing»: The marking of stored personal data with the aim of limiting their processing in the future.
«Profiling»: Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
«Pseudonymisation»: The processing of personal data in such a manner that the data can no longer be attributed to a data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures intended to ensure that the personal data are not attributed to an identified or identifiable natural person.
«Filing system»: Any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.
«Controller» or «data controller»: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
«Processor» or «data processor»: The natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
«Recipient»: The natural or legal person, public authority, agency or other body to which personal data are disclosed, whether a third party or not. However, public authorities that may receive personal data in the framework of a specific inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by such public authorities shall comply with the applicable data protection rules according to the purposes of the processing.
«Third party»: A natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons authorised to process personal data under the direct authority of the controller or processor.
«Consent of the data subject»: Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
«Personal data breach»: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
«Genetic data»: Personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or health of that natural person, obtained in particular from the analysis of a biological sample from the natural person in question.
«Biometric data»: Personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.
«Data concerning health»: Personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.
«Main establishment»: a) As regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless decisions on the purposes and means of processing are taken in another establishment of the controller in the Union and that latter establishment has the power to have such decisions implemented, in which case the establishment that has taken such decisions shall be considered the main establishment; b) as regards a processor with establishments in more than one Member State, the place of its central administration in the Union or, if it has no central administration in the Union, the establishment of the processor in the Union where the main processing activities take place in the context of the activities of an establishment of the processor to the extent that the processor is subject to specific obligations under this Regulation.
«Representative»: A natural or legal person established in the Union who, having been designated by the controller or processor in writing pursuant to Article 27 of the GDPR, represents the controller or processor with regard to their respective obligations under this Regulation.
«Enterprise»: A natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity.
«Supervisory authority»: An independent public authority established by a Member State pursuant to Article 51 of the GDPR. In Spain, this is the Spanish Data Protection Agency.
«Cross-border processing»: a) Processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.
«Information society service»: Any information society service, that is, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services.
The Data Controller is the natural or legal person, whether public or private, or administrative body, which alone or jointly with others determines the purposes and means of the processing of personal data, in cases where the purposes and means of processing are determined by European Union law or by the law of the Spanish Member State.
For the aspects set out in this Data Protection Policy, the identity and contact details of the Data Controller are:
Beltrán Hermanos S.L. – CIF B12008769
Ramonet Industrial Estate S/N. 12550, Almazora (Castellón), Spain
- Email: jabones@jabonesbeltran.com
- Telephone: 964 53 08 54
This Privacy and Data Protection Policy has been developed on the basis of the following data protection regulations and laws:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Hereinafter, GDPR.
- Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights. Hereinafter, LOPD/GDD.
- Law 34/2002 of 11 July on Information Society Services and Electronic Commerce. Hereinafter, LSSICE.
The personal data collected and processed through this Website shall be processed in accordance with the following principles:
- Principle of lawfulness, fairness and transparency: All processing of personal data carried out through this Website shall be lawful and fair, making it entirely clear to the user when personal data concerning him or her are being collected, used, consulted or processed. Information relating to the processing carried out shall be provided in advance, in an easily accessible and easy-to-understand manner, using clear and plain language.
- Principle of purpose limitation: All data shall be collected for specified, explicit and legitimate purposes and shall not be further processed in a manner incompatible with the purposes for which they were collected.
- Principle of data minimisation: The data collected shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
- Principle of accuracy: The data shall be accurate and, where necessary, kept up to date, with every reasonable step taken to ensure that personal data that are inaccurate in relation to the purposes for which they are processed are erased or rectified without delay.
- Principle of storage limitation: The data shall be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes of processing the personal data.
- Principle of integrity and confidentiality: The data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss or damage, by applying appropriate technical and organisational measures.
- Principle of accountability: The entity that owns the Website shall be responsible for compliance with the principles set out in this section and shall be able to demonstrate such compliance.
The data processing activities carried out through the Website are detailed below, specifying each of the following sections:
- Activity: Name of the data processing activity
- Purposes: Each of the uses and processing operations carried out with the data collected
- Legal basis: The legal basis that legitimises the processing of the data
- Data processed: Type of data processed
- Source: Where the data are obtained from
- Retention: Period during which the data are retained
- Recipients: Third-party persons or entities to whom the data are provided
- International transfers: Cross-border transfers of data outside the European Union
These are the data processing activities whose purposes are necessary and essential for the provision of the services.
These are personal data processing activities whose purposes are not essential for the provision of the service and which are carried out only if the user has ticked YES in the consent for these activities.
|
Website enquiries |
|
| Legal bases | (Art. 6.1.a GDPR) Consent of the data subject |
| Purposes | Response to enquiries received through the website’s electronic form |
| Data categories / groups | Website contacts (identification data) |
| Source of data | The data subject or his/her legal representative |
| Category of recipients | None envisaged |
| International transfer | None envisaged |
| Retention period | For a period of 1 year from the last confirmation of interest |
| Security measures | Technical and organisational measures have been adopted to ensure, as far as possible:
Access to records is restricted according to security roles, the level of confidentiality of the personal data and permissions. Data retained in printed form are kept in locked files with access restricted to authorised personnel only. Proper disposal of documentation and devices. Periodic reviews and audits of data processing and security. |
|
E-commerce customer management |
|
| Legal bases | Explicit consent of the data subject |
| Purposes | E-commerce |
| Data categories / groups | E-commerce customers (identification data; economic, financial and insurance data; transactions in goods and services) |
| Source of data | The data subject or his/her legal representative |
| Category of recipients | Tax Administration; banks, savings banks and rural savings banks |
| International transfer | None envisaged |
| Retention period | For a period of 5 years from the last confirmation of interest |
|
User management |
|
| Legal bases | Explicit consent of the data subject |
| Purposes | E-commerce |
| Data categories / groups | Registered users (identification data) |
| Source of data | The data subject or his/her legal representative |
| Category of recipients | None envisaged |
| International transfer | None envisaged |
| Retention period | For a period of 5 years from the last confirmation of interest |
|
Recruitment pool |
|
| Legal bases | (Art. 6.1.a GDPR) Consent of the data subject |
| Purposes | Staff recruitment |
| Data categories / groups | Job candidates (identification data; academic and professional data; personal characteristics; social circumstances; employment details) |
| Source of data | The data subject or his/her legal representative |
| Category of recipients | None envisaged |
| International transfer | None envisaged |
| Retention period | For a period of 1 year from the last confirmation of interest |
| Security measures | Technical and organisational measures have been adopted to ensure, as far as possible:
Access to records is restricted according to security roles, the level of confidentiality of the personal data and permissions. Data retained in printed form are kept in locked files with access restricted to authorised personnel only. Proper disposal of documentation and devices. Periodic reviews and audits of data processing and security. |
All fields marked with an asterisk (*) in the Website forms must be completed, meaning that failure to complete any of them may make it impossible to provide the services or information requested.
You must provide truthful information. So that the information provided is always up to date and free from errors, you must notify the Data Controller as soon as possible of any changes and corrections to your personal data by sending an email to: jabones@jabonesbeltran.com.
Likewise, by clicking the “I accept” button (or equivalent) included in the aforementioned forms, you declare that the information and data you have provided in them are accurate and truthful, and that you understand and accept this Privacy Policy.
In compliance with Article 8 of the GDPR and Article 7 of the LOPD/GDD, only persons over 14 years of age may lawfully give their consent for Jabones Beltrán to process their personal data.
Therefore, minors under 14 years of age may not use the services available through the Website without prior authorisation from their parents, guardians or legal representatives, who shall be solely responsible for all acts carried out through the Website by the minors in their care, including the completion of online forms with the personal data of such minors and, where applicable, the ticking of the accompanying boxes.
The Data Controller adopts the necessary organisational and technical measures to guarantee the security and privacy of your data and prevent their alteration, loss, processing or unauthorised access, depending on the state of the art, the nature of the stored data and the risks to which they are exposed.
The following measures, among others, should be highlighted:
- Guarantee the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
- Restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident.
- Verify, evaluate and assess, on a regular basis, the effectiveness of the technical and organisational measures implemented to ensure the security of processing.
- Pseudonymise and encrypt personal data where sensitive data are concerned.
On the other hand, the Data Controller has decided to manage information systems in accordance with the following principles:
- Principle of regulatory compliance: All information systems shall comply with the applicable legal, regulatory and sector-specific rules that affect information security, especially those related to the protection of personal data, system security, data, communications and electronic services.
- Principle of risk management: Risks shall be minimised to acceptable levels and a balance shall be sought between security controls and the nature of the information. Security objectives must be established, reviewed and consistent with information security aspects.
- Principle of awareness and training: Training, awareness-raising and awareness campaigns shall be organised for all users with access to information in matters of information security.
- Principle of proportionality: The implementation of controls that mitigate security risks to assets shall seek a balance between the security measures, the nature of the information and the risk.
- Principle of responsibility: All members of the Data Controller shall be responsible for their conduct with regard to information security, complying with the established rules and controls.
- Principle of continuous improvement: The degree of effectiveness of the security controls implemented in the organisation shall be reviewed on a recurring basis in order to increase the capacity to adapt to the constant evolution of risk and the technological environment.
Current data protection regulations afford the user a series of rights in relation to the use made of their data. Each and every one of these rights is personal and non-transferable, meaning that they may only be exercised by the data owner, after verification of their identity.
The rights of Website users are detailed below:
- Right of access: This is the Website user’s right to obtain confirmation as to whether or not the Data Controller is processing their personal data and, if so, to obtain information on their specific personal data and on the processing that the Data Controller has carried out or carries out, as well as, among other things, the available information on the source of such data and the recipients of the communications made or planned in relation to them.
- Right to rectification: This is the Website user’s right to have personal data that prove to be inaccurate or, taking into account the purposes of the processing, incomplete, modified.
- Right to erasure: This is usually known as the “right to be forgotten”, and it is the Website user’s right, provided that current legislation does not establish otherwise, to obtain the erasure of their personal data when they are no longer necessary for the purposes for which they were collected or processed; the User has withdrawn their consent to the processing and the processing has no other legal basis; the User objects to the processing and there is no other legitimate ground to continue it; the personal data have been unlawfully processed; or the personal data have been obtained as a result of a direct offer of information society services to a minor under 14 years of age. In addition to erasing the data, the Data Controller, taking into account the available technology and the cost of implementation, shall take reasonable steps to inform other possible controllers that are processing the personal data of the data subject’s request for erasure of any link to those personal data.
- Right to restriction of data: This is the Website User’s right to restrict the processing of their personal data. The Website User has the right to obtain the restriction of processing when they contest the accuracy of their personal data; the processing is unlawful; the Data Controller no longer needs the personal data, but the User needs them for the establishment, exercise or defence of claims; and when the Website User has objected to processing.
- Right to data portability: Where processing is carried out by automated means, the Website User shall have the right to receive from the Data Controller their personal data in a structured, commonly used and machine-readable format, and to transmit them to another controller. Where technically feasible, the Data Controller shall transmit the data directly to that other Controller.
- Right to object: This is the User’s right to have the processing of their personal data not carried out or to have it ceased by the Data Controller.
- Right not to be subject to automated decisions and/or profiling: This is the Website User’s right not to be subject to an individual decision based solely on the automated processing of their personal data, including profiling, unless current legislation establishes otherwise.
- Right to withdraw consent: This is the Website User’s right to withdraw, at any time, the consent given for the processing of their data.
The Website user may exercise any of the rights mentioned above by contacting the Data Controller, after identifying the User, using the following contact details:
- Controller: Beltrán Hermanos S.L.
- Address: Ramonet Industrial Estate S/N. 12550, Almazora (Castellón), Spain
- Telephone: 964 53 08 54
- E-mail: jabones@jabonesbeltran.com
- Website: http://jabonesbeltran.com
The user is informed of their right to lodge a complaint with the Spanish Data Protection Agency if they consider that a breach of data protection law has been committed in relation to the processing of their personal data.
Supervisory authority contact information:
Spanish Data Protection Agency
Email: info@aepd.es
Telephone: 900293183
Website: https://www.aepd.es
Address: C/ Jorge Juan, 6. 28001, Madrid (Madrid), Spain
The Website user must have read and agree with the data protection conditions contained in this Privacy Policy and must accept the processing of their personal data so that the Data Controller may proceed with such processing in the manner, for the periods and for the purposes indicated.
The Data Controller reserves the right to amend this Privacy Policy at its own discretion, or due to a legislative, jurisprudential or doctrinal change by the Spanish Data Protection Agency. Changes or updates made to this Privacy Policy that affect the purposes, retention periods, transfers of data to third parties, international transfers of data, as well as any right of the Website User, shall be explicitly communicated to the user.
Version dated 14 May 2026