Privacy Policy

This "Privacy and Data Protection Policy" aims to publicise the conditions governing the collection and processing of personal data by IGEX ESTUDIOS S.L, making every effort to safeguard the fundamental rights, honour and freedoms of the persons whose personal data are processed, complying with the regulations and laws in force governing the protection of personal data according to the European Union and the Spanish Member State and, specifically, those set out in the "Processing Activities" section of this Privacy Policy.

Therefore, this Privacy and Data Protection Policy informs users of the Website https://igex.es of all the details of interest regarding how these processes are carried out, for what purposes, which other entities may have access to their data and what the rights of users are.

"Personal data"

Any information about an identified or identifiable natural person ("Website user"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

"Processing"

Any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Restriction of processing"

The marking of stored personal data with the aim of limiting their processing in the future.

"Profiling"

Any form of automated processing of personal data consisting of using personal data to evaluate certain personal aspects of a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

"Pseudonymisation"

The processing of personal data in such a way that they can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

"Filing system"

Any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.

"Controller" or "data controller"

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

"Processor"

A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

"Recipient"

A natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

"Third party"

A natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

"Consent of the data subject"

Any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

"Personal data breach"

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

"Genetic data"

Personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question.

"Biometric data"

Personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.

"Data concerning health"

Personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.

"Main establishment"

a) as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment; b) as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities take place in the context of the activities of an establishment of the processor to the extent that the processor is subject to specific obligations under this Regulation.

"Representative"

A natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27 of the GDPR, represents the controller or processor with regard to their respective obligations under this Regulation.

"Enterprise"

A natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity.

"Supervisory authority"

An independent public authority established by a Member State pursuant to Article 51 of the GDPR. In Spain, it is the Spanish Data Protection Agency.

"Cross-border processing"

a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

"Information society service"

Any information society service, that is to say, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services.

The Data Controller is the natural or legal person, public or private, or administrative body, which alone or jointly with others determines the purposes and means of the processing of personal data; in the event that the purposes and means of processing are determined by European Union or Spanish Member State law.

In the aspects set out in this Privacy and Data Protection Policy, the identity and contact details of the Data Controllers are:

This Privacy and Data Protection Policy is developed based on the following data protection regulations and laws:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Hereinafter GDPR.
• Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights. Hereinafter LOPD/GDD.
• Law 34/2002 of 11 July on Information Society Services and Electronic Commerce. Hereinafter LSSICE.

Personal data collected and processed through this website will be processed in accordance with the following principles:

Principle of lawfulness, fairness and transparency

All processing of personal data carried out through this Website will be lawful and fair, making it absolutely clear to the user when their personal data is being collected, used, consulted or processed. Information regarding the processing carried out will be transmitted in advance, in an easily accessible and easy to understand manner, in simple and clear language.

Principle of purpose limitation

All data will be collected for specified, explicit and legitimate purposes and will not be further processed in a way incompatible with those purposes.

Principle of data minimisation

The data collected will be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Principle of accuracy

Data will be accurate and, if necessary, updated, taking all reasonable steps to ensure that personal data that are inaccurate with respect to the purposes for which they are processed are erased or rectified without delay.

Principle of storage limitation

Data will be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

Principle of integrity and confidentiality

Data will be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss or damage, using appropriate technical or organisational measures.

Principle of accountability

The entity owning the Website will be responsible for compliance with the principles set out in this section and be able to demonstrate it.

Below are the data processing activities carried out through the Website, specifying each of the following sections:

• Activity: Name of the data processing activity
• Purposes: Each of the uses and processing carried out with the data collected
• Legal basis: The legal basis that legitimises the processing of data
• Data processed: Type of data processed
• Origin: Where the data come from
• Retention: Period during which data are kept
• Recipients: Third parties to whom data are disclosed
• International transfers: Cross-border transfers of data outside the European Union

All fields marked with an asterisk (*) in the forms on the Website must be completed, otherwise the omission of any of them could make it impossible to provide the services or information requested.

You must provide truthful information, so that the information provided is always up-to-date and error-free, you must notify the Data Controller as soon as possible of any changes and rectifications to your personal data that occur by email to: gerente@igex-estudios.com.

Likewise, by clicking the "Accept" button (or equivalent) incorporated in the aforementioned forms, you declare that the information and data you have provided are accurate and truthful, and that you understand and accept this Privacy Policy.

In compliance with the provisions of Article 8 of the GDPR and Article 7 of the LOPD/GDD, only persons over 14 years of age may give their consent for the processing of their personal data lawfully by IGEX ESTUDIOS S.L.

Therefore, minors under 14 years of age may not use the services available through the Website without the prior authorisation of their parents, guardians or legal representatives, who will be solely responsible for all acts performed through the Website by minors under their care, including the completion of electronic forms with the personal data of such minors and, where applicable, the checking of the accompanying boxes.

The Data Controller adopts the necessary organisational and technical measures to guarantee the security and privacy of your data, to prevent its alteration, loss, processing or unauthorised access, depending on the state of technology, the nature of the stored data and the risks to which they are exposed.

Among others, the following measures stand out:

• Guarantee the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
• Restore availability and access to personal data quickly in the event of a physical or technical incident.
• Regularly verify, assess and evaluate the effectiveness of the technical and organisational measures implemented to ensure the security of processing.
• Pseudonymise and encrypt personal data, in the case of sensitive data.

Furthermore, the Data Controller has decided to manage information systems according to the following principles:

Principle of regulatory compliance

All information systems will comply with applicable regulatory and sectoral legal regulations affecting information security, especially those related to the protection of personal data, security of systems, data, communications and electronic services.

Principle of risk management

Risks will be minimised to acceptable levels and a balance will be sought between security controls and the nature of the information. Security objectives must be established, reviewed and consistent with information security aspects.

Principle of awareness and training

Training, awareness and consciousness-raising programmes will be organised for all users with access to information, in the field of information security.

Principle of proportionality

The implementation of controls to mitigate asset security risks will be carried out seeking a balance between security measures, the nature of the information and risk.

Principle of accountability

All members of the Data Controller will be responsible for their conduct regarding information security, complying with established rules and controls.

Principle of continuous improvement

The degree of effectiveness of the security controls implemented in the organisation will be reviewed on a recurring basis to increase the capacity to adapt to the constant evolution of risk and the technological environment.

Current data protection regulations give the user a series of rights regarding the use made of their data. All of these rights are personal and non-transferable, i.e. they can only be exercised by the data owner, after verification of their identity.

Below are the rights of the users of the Website:

Right of access

The right of the Website user to obtain confirmation from the Data Controller as to whether or not their personal data are being processed and, if so, to obtain information about their specific personal data and the processing that the Data Controller has carried out or is carrying out, as well as, among other things, information available on the origin of such data and the recipients of communications made or planned.

Right of rectification

The right of the Website user to have their personal data corrected if they are inaccurate or, taking into account the purposes of the processing, incomplete.

Right of erasure

Often called the "right to be forgotten", it is the right of the Website user, unless current legislation provides otherwise, to obtain the erasure of their personal data when they are no longer necessary for the purposes for which they were collected or processed; the User has withdrawn their consent to the processing and there is no other legal basis for it; the User objects to the processing and there is no other legitimate reason to continue it; the personal data have been processed unlawfully; the personal data have been obtained as a result of a direct offer of information society services to a minor under 14 years of age. In addition to erasing the data, the Data Controller, taking into account the available technology and the cost of its application, shall take reasonable steps to inform other possible controllers who are processing the personal data of the data subject's request to erase any links to those personal data.

Right to restriction of processing

The right of the Website user to restrict the processing of their personal data. The Website user has the right to obtain restriction of processing where they contest the accuracy of their personal data; the processing is unlawful; the Data Controller no longer needs the personal data, but the User needs it to make claims; and where the Website user has objected to processing.

Right to data portability

In cases where processing is carried out by automated means, the Website user will have the right to receive from the Data Controller their personal data in a structured, commonly used and machine-readable format and to transmit them to another controller. Where technically possible, the Data Controller will transmit the data directly to that other controller.

Right to object

The right of the User that the processing of their personal data should not be carried out or should cease by the Data Controller.

Right not to be subject to automated decision-making and/or profiling

The right of the Website user not to be subject to a decision based solely on automated processing of their personal data, including profiling, unless current legislation provides otherwise.

Right to withdraw consent

The right of the Website user to withdraw, at any time, the consent given for the processing of their data.

The Website user may exercise any of the aforementioned rights by addressing the Data Controller and prior identification of the User using the following contact information:

Controller: IGEX ESTUDIOS S.LAddress: Río Alagón, 1 – 12006 – Castelló de la Plana, SpainPhone: 692 036 348E-mail: gerente@igex-estudios.comWebsite: https://igex.es

The user is informed of their right to lodge a complaint with the Spanish Data Protection Agency if they consider that a breach of data protection legislation has occurred in the processing of their personal data.

Contact details of the supervisory authority:

Spanish Data Protection AgencyEmail: info@aepd.esPhone: 912663517Website: https://www.aepd.esAddress: C/. Jorge Juan, 6. 28001, Madrid (Madrid), Spain

The Website includes a conversational virtual assistant ("LuzIA - iGEX Assistant") based on artificial intelligence, whose purpose is to answer general questions from visitors about the company and its services. In accordance with Article 50 of Regulation (EU) 2024/1689 on Artificial Intelligence, users are expressly informed that they are interacting with an automated system and not with a natural person.

The messages the user types into the chat are sent, through the Data Controller's servers, to the technology provider Google (Gemini API service, Google LLC / Google Ireland Limited), which acts as data processor for the sole purpose of generating the automatic reply. This communication may involve an international transfer of data to the United States, covered by the standard contractual clauses and the adequacy framework applicable to the provider.

The visible conversation history is stored in the user's own browser and can be deleted at any time from the chat itself. Independently of this, the Data Controller keeps an internal record of the queries and replies of the assistant on its servers, for the purpose of monitoring the quality and correctness of the replies generated by the artificial intelligence, detecting errors and improving the service. The legal basis for this processing is the legitimate interest of the Data Controller (Article 6(1)(f) GDPR) in ensuring the proper operation and human oversight of the system. This record does NOT include the user's IP address, which is replaced by a pseudonymised session identifier, and is automatically deleted after 30 days. In addition, before storage an automatic filter masks any obvious personal data the user may have typed (email addresses, telephone numbers, supply point codes, national ID numbers or bank accounts).

The assistant does not request personal data within the conversation, and users are expressly advised not to include personal data (name, telephone number, email, supply data, etc.) in their queries, as these would be captured in the record described in the previous paragraph.

Separately, the assistant may offer the user a specific form to request that an iGEX technician contacts them. Completing that form is voluntary, requires the user's express consent through prior acceptance of this Privacy Policy, and the data provided (full name, job title, company, email address and telephone number) are processed for the sole purpose of handling that commercial request, subject to the "Website Enquiries" processing activity described in section 6 of this Policy. The preceding conversation with the assistant is stored alongside those data so that the request can be handled with the appropriate context.

The assistant's replies are generated automatically by artificial intelligence, are for information purposes only and may contain errors; they do not constitute technical, legal or contractual advice, nor do they create any obligation for iGEX. No decision producing legal or similarly significant effects for the user is taken solely on an automated basis from these conversations.

The user of the Website must have read and agree with the data protection conditions contained in this Privacy Policy, and must also accept the processing of their personal data so that the Data Controller can proceed with it in the manner, terms and purposes indicated.

The Data Controller reserves the right to modify this Privacy Policy, at its own discretion, or as a result of a legislative, jurisprudential or doctrinal change by the Spanish Data Protection Agency. Changes or updates to this Privacy Policy that affect the purposes, retention periods, transfers of data to third parties, international data transfers, as well as any rights of the Website User, will be explicitly communicated to the user.