Privacy policy

The controller of personal data collected through this website and our business communications is [PENDING: legal name] (“MGG Carpintería”), a company established in Spain, tax ID (NIF) [PENDING: tax ID (NIF)], with its registered address at [PENDING: registered address].

For any privacy question you can reach us at [PENDING: contact email] or on [PENDING: phone]. Given the nature of our activity we are not required to appoint a Data Protection Officer (DPO); all requests are handled at the address above.

This policy is written in line with Regulation (EU) 2016/679 (GDPR), Spain’s Organic Law 3/2018 (LOPDGDD) and, where it applies, the Swiss Federal Act on Data Protection (nFADP).

Data you give us through our contact or partnership forms: name, company, role, email, phone, country or city, project type and the content of your message.

Files you choose to upload, such as drawings, sketches, photos or technical specifications. Please avoid including third parties’ personal data that isn’t needed to assess the project.

Professional contact details from public sources (see section 4), when we research potential partners such as architecture practices, interior designers, shopfitters and retailers: name, role, company, business email and phone, company website and field of activity.

Link attribution data: if we sent you an email and you click the link in it, we record that this specific link was visited, when, and which pages were viewed during that visit (see section 5).

Website analytics (pages viewed, language, device type, traffic source), only if you have accepted analytics in the cookie banner.

We do not ask for special categories of data (health, beliefs, etc.) and kindly ask you not to send any.

To answer your enquiry, prepare quotes, review drawings and manage the relationship before a contract. Legal basis: steps taken at your request prior to entering into a contract and, where applicable, performance of the contract (Art. 6(1)(b) GDPR).

To identify and contact professionals who may be interested in our bespoke joinery services (B2B prospecting), and to understand interest in our emails through personalised links. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in introducing our business to companies and professionals in the trade. We have balanced this interest against your rights: we only use business contact details published by the company or professional themselves, our message relates to your professional activity, volumes are small, and you can object at any time with a single reply or from the email itself.

To keep the website secure, prevent abuse and form spam, and keep necessary technical logs. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

To send marketing communications to private individuals — and generally wherever the law requires consent — and to run website analytics. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time without affecting processing carried out before withdrawal.

To meet legal obligations such as tax and accounting requirements or requests from authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

Every electronic commercial message clearly identifies MGG Carpintería as the sender and includes a simple, free way to stop receiving them, as required by Article 21 of Spain’s LSSI-CE.

If you did not give us your details directly, they come from publicly available sources: your company’s or studio’s website, professional and trade directories, professional bodies or associations, and professional profiles published by you or your company.

In line with Article 14 GDPR, our first message to you explains who we are, where we obtained your details, why we are contacting you and how to exercise your rights, with a link to this policy. If no contact takes place, the data is deleted within the periods set out in section 8.

Some of our emails contain a unique, opaque link: a random reference that does not contain your name or email address. If you click it, we can associate that visit with the contact the link was sent to and see which pages interested you, so we can follow up with more relevant information.

We do not use open-tracking pixels or any other technique to find out whether you opened or read an email. Nothing is recorded unless you choose to click the link.

If you’d rather we didn’t make this association, you can object by writing to [PENDING: contact email] or using the unsubscribe link in the email; we will then stop emailing you and stop linking visits to your contact. You can also simply visit our website by typing its address instead of using the link.

We do not sell or rent your data. We use service providers acting as processors under contracts that meet Article 28 GDPR, in the following categories:

web hosting and cloud infrastructure; database; email sending and receiving; an artificial-intelligence provider that helps us classify and summarise public information about companies during business research; and Google Search Console, from which we only receive aggregated search data that does not identify individuals.

When we work with other professionals on a specific project (for example hauliers or installers), we only share what is strictly necessary and with your knowledge. We may also disclose data to public authorities where the law requires it.

Some providers may process data outside the European Economic Area. Where that happens, the transfer relies on a European Commission adequacy decision (including, where applicable, the EU–US Data Privacy Framework for certified companies) or on the Commission’s Standard Contractual Clauses, together with any supplementary measures needed.

Switzerland benefits from a European Commission adequacy decision, so exchanging data with our Swiss clients and partners does not require additional safeguards. For people in Switzerland, we also apply the principles of the nFADP.

Our retention periods are configurable and reviewed regularly. As a rule:

Enquiries, quotes and uploaded files: for as long as the relationship or project assessment lasts, and then for the applicable legal limitation periods (for example, six years for commercial and accounting records under Spanish law, plus tax periods).

Prospect contacts that are not verified or that never lead to a conversation: deleted after 180 days at the latest.

If you ask us not to contact you again, we keep only a minimal hashed value of your email or domain on a suppression list, solely so that we can honour your choice.

Analytics data: as stated in the cookie policy. Consent-based processing: until you withdraw consent.

You can at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given. In particular, you may object at any time to processing based on legitimate interest and to the use of your data for business prospecting.

To do so, email [PENDING: contact email] stating which right you wish to exercise. If we have reasonable doubts about your identity we may ask for information to verify it. We will reply within one month, extendable where the law allows.

If you are not satisfied with our response, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es). Residents of France may also contact the CNIL (www.cnil.fr), residents of Portugal the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), residents of Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it), and residents of Switzerland the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

To organise our prospecting we may give companies an internal fit score (for example by sector or project type) with the help of automated tools. This score is only used to prioritise our work and is always reviewed by a person before any contact is made.

We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), restricted access to the admin area, need-to-know access to data, backups and providers offering sufficient guarantees.

No system is infallible; should a breach affecting your data occur, we would act as the GDPR requires, including notifying the authority and, where appropriate, the people affected.

We may update this policy to reflect changes in our activity or in the law. The current version is always published on this page. This text is provided for information and does not constitute legal advice.