Privacy Policy

This Privacy Policy explains how Mecalux S.A. and its affiliated companies (collectively referred to as “MECALUX”) collect, process, and protect personal data received through this website, as well as through other channels, including telephone, email, or postal mail.

 

1. Scope of the Privacy Policy

This Privacy Policy applies to personal data provided by our customers (potential and current), suppliers, individuals requesting information, shareholders, job candidates, and, in general, any third parties when necessary for our activities, provided that there is a legitimate basis for processing their data.

 

2. Data Controller

The Data Controller responsible for the processing of your personal data is the relevant company within the Mecalux Group that collects and processes your personal data. The contact details for each Mecalux Group entity acting as a data controller are as follows:

MECALUX, S.A.
Tax identification number (NIF): A-08244998
Address: C/Silici 1-5
08940 Cornellà de Llobregat, Barcelona
Spain
Tel.: +34 932 61 69 01

MECALUX SERVIS, S.A.
Tax identification number (NIF): A-78423522
Address: Julio Palacios, 14
Pol. Ind. Ntra. Sra. Butarque
28914 Leganés, Madrid
Spain
Tel.: +34 916 88 83 33

MECALUX LEVANTE, S.A.
Tax identification number (NIF): A-46373296
Address: Avda. Alquería de Moret 11
Pol. Ind. Alquería de Moret
46210 Picanya, Valencia
Spain
Tel.: +34 961 59 03 02

MECALUX SOFTWARE SOLUTIONS, S.A.
Tax identification number (NIF): A-35557859
Address: C/Silici 1-5
08940 Cornellà de Llobregat, Barcelona
Spain
Tel.: +34 985 19 54 02

MECALUX IT SERVICES, S.L.
Tax identification number (NIF): B-66797184
Address: C/Silici 1-5
08940 Cornellà de Llobregat, Barcelona
Spain
Tel.: +34 932 61 69 00

 

3. Information about the categories of personal data processed by MECALUX

MECALUX processes personal data from different groups, including clients, potential clients, visitors, suppliers, shareholders, and job candidates.

For clients and potential clients, MECALUX collects personal identification data such as name, address, phone number, email, and username when clients or potential clients request information, purchase products, or register as users. Additional data may be collected as necessary to maintain commercial or contractual relationships. MECALUX also collects IP addresses from all website users (automatically sent by browsers when accessing the web) and other data related to website use as explained in the Cookie Policy.

MECALUX also processes clients' commercial information and financial or economic data, including call recordings where indicated, when necessary to manage and maintain contractual relationships with MECALUX.

For visitors, MECALUX processes identification data (such as name, surname, identification number, and company or authority affiliation) for individuals visiting MECALUX facilities. Image and video data are also processed via video cameras or closed-circuit television (CCTV).

For suppliers, MECALUX processes identification and organizational data of individuals providing services or collaborating with MECALUX, along with the necessary financial data to manage the contractual relationship. Labor and access-related data may be processed as required by MECALUX security protocols.

For shareholders, MECALUX processes identification, contact, and financial data necessary to manage shareholder rights, obligations and related communications.

For job candidates, MECALUX processes identification, contact, educational and professional data, including education, academic record, work experience, and membership in professional associations. Psychometric evaluations may be processed if required during the recruitment process. Reference checks will only be conducted with candidate’s explicit consent.

 

4. Purpose of processing your personal data

The personal data provided to MECALUX is processed for specific purposes based on the data subject’s category, as outlined below.

For clients or potential clients, personal data is processed to:

  • Respond to requests for information and coordinate visits;
  • Manage commercial relationships, including billing, product delivery, and services;
  • Communicate via email;
  • Send commercial communications via mail and email about MECALUX’s products, services, offers, and promotions (based on consent or legitimate interest when applicable);
  • Conduct surveys regarding MECALUX products and services to improve customer service quality;
  • Provide online support for maintenance services, technical assistance, or information requests;
  • Fulfill legal obligations, including fraud prevention.

For visitors, personal data is processed to ensure the security of MECALUX facilities, assets, and individuals during visits.

For suppliers, personal data is processed to register suppliers, evaluate services, manage payments, and handle contractual relationships with MECALUX.

For shareholders, data is processed to administer dividends, manage shareholders right, and fulfil obligations associated with shareholder status.

For job applicants, personal data is processed to:

  • Conduct personnel selection processes;
  • Inform candidates of job openings within MECALUX;
  • Request references from previous employers (with explicit consent);
  • Conduct psychometric tests (if applicable);
  • Execute employment contracts, if the candidate is hired.

 

5. Legal basis for processing your data

MECALUX will only process personal data only when there is a valid legal basis.

MECALUX processes data from potential clients, potential clients, and suppliers for the execution of contracts to which they are parties or for the application of pre-contractual measures, such as processing orders, providing agreed-upon services, and sending the requested information for the execution of the respective purchase or service contract.

MECALUX processes data for commercial communications about products, services, offers, and promotions when consent has been provided. In cases of existing commercial relationships, MECALUX may also rely on legitimate interest as the legal basis for these communications.

Similarly, MECALUX processes data for surveys and customer service improvements to gather feedback on products or services and to improve customer experience, based on MECALUX’s legitimate interest.

MECALUX processes data from job candidates for recruitment purposes, relying on pre-contractual measures with the intent of entering into an employment contract. When necessary, MECALUX will obtain the candidate’s consent, as required by applicable law. If the data does not originate from the data subject, MECALUX processes it through the legitimate transfer from third parties’ sources, such as recruitment firms or public sources.

In any case, the data subject has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

 

6. Recipients to Whom Your Data May Be Communicated

Personal data collected by MECALUX may be communicated to other companies within the MECALUX Group, MECALUX's commercial partners within the European Union, and, in exceptional cases, to other countries when strictly necessary. Such communication will only occur to respond to information requests, manage your commercial relationship, and provide technical support or information. Appropriate technical and organizational measures will be implemented to ensure an equivalent level of protection as required by applicable regulations. Further details of the companies in the Group are available.

Additionally, personal data may be disclosed to:

  • Competent public administration bodies as required by the applicable regulations.
  • Law enforcement agencies, as provided by applicable legislation.
  • Certain banks and financial institutions to facilitate the collection of fees associated with MECALUX’s products and services.

 

7. MECALUX S.A. as Data Processor for the MECALUX Group

MECALUX S.A., as the parent company of the MECALUX Group, serves as the owner of the servers and applications where personal data of clients, suppliers, and other contacts are hosted and managed by its subsidiary companies. In these capacity, MECALUX S.A. acts as the Data Processor on behalf of the MECALUX Group companies and commits to:

  • Processing personal data solely for storage purposes and providing access to users and their respective subsidiary companies.
  • Implementing appropriate security measures to safeguard personal data.
  • Ensuring that personal data is not disclosed to third parties, unless where expressly authorized by the data subject, required by applicable law, or necessary for compliance with the obligations of its subsidiary companies.
  • Maintaining confidentiality of the personal data to which it has access.

In cases where a data subject exercises their data protection rights with MECALUX, MECALUX S.A. will forward the request to the relevant subsidiary company to ensure a prompt response.

MECALUX S.A. will notify each Data Controller (i.e., the relevant subsidiary) of any personal data security breach at the earliest opportunity. However, notification will not be necessary if the breach does not pose a likely risk to the rights and freedoms of individuals.

 

8. Retention period of personal data

Personal data collected for product and services inquiries will be retained for the duration necessary to fulfil the request.

Personal data collected for technical assistance and maintenance services will be retained for the period required to process requests, manage commercial relationships, provide services, and fulfil legal obligations.

Personal data collected for managing commercial relationships with MECALUX will be retained for the duration of the relationship or for the time required to comply with applicable accounting and tax regulations.

Personal data collected for surveys and customer feedback regarding MECALUX products and services will be retained for the period necessary to measure and analyze satisfaction.

When consent is provided, personal data collected for advertising and promotional purposes will be retained until the individual opts out or exercises the right of data deletion.

For job candidates, personal data collected for recruitment purposes will be retained until the relevant position is filled or until the job candidate exercises the right to data deletion. MECALUX may contact candidates about future job opportunities within a one-year period, after which the data will be deleted if no deletion request is received. For hired candidates, data will be retained for the duration of the employment relationship and the legally required period thereafter.

 

9. Security of your data

Certain services or features offered through MECALUX’s websites may require the creation of an account and a password. It is the responsibility of each account holder to maintain the confidentiality of their password. MECALUX assumes that any access to an account using the associated password is authorized by the account holder. MECALUX is not responsible for unauthorized access or any resulting damages due to compromised passwords. If unauthorized use of a security issue is suspected, individuals should immediately change their password and inform MECALUX. MECALUX has implemented appropriated technical and organizational measures to protect the privacy and security of personal data. These measures include safeguards against unauthorized access, misuse, and data breaches, in compliance with applicable data protection laws.

 

10. Third-party services

MECALUX engages third-party services to embed content and provide additional features, such as video embedding, for promotional purposes based on legitimate interest.

YouTube

MECALUX embeds videos from YouTube, a service provided by Google Ireland Limited, a company established in Ireland, governed by the laws of that country, with registration number 368047, and located at Gordon House, Barrow Street, Dublin 4, Ireland.

The videos are embedded in "extended data protection mode".

Individuals should be aware that YouTube may use cookies to collect information about visitors to its website. YouTube utilizes this information to compile video statistics, prevent fraud, and improve usability, among other purposes.

Each time a MECALUX's website is accessed, a connection with Google’s DoubleClick network is established, regardless of whether the embedded video is playing. Starting the video may lead to additional data processing over which MECALUX has no control or responsibility.

More details about YouTube's services and its Privacy Policy can be found at YouTube's Terms https://www.youtube.com/t/terms, and Google's Privacy Policy at Google Privacy Policy https://policies.google.com/privacy?hl=en.

 

11. Your personal data protection rights and how to exercise them

Data subjects have the right to confirmation as to whether personal data is being processed, and, if so, to access personal data, correct inaccurate data, or request its deletion when it is no longer necessary. Data subjects also have the right to object to the processing of personal data when processing is based on a legitimate interest, and to request the transfer of your data, if applicable. In certain circumstances, data subjects may request the limitation of data processing.

To exercise these rights, or for any questions related to this Privacy Policy, data subjects may send a letter to MECALUX S.A., Calle Silici 1-5, 08940 Cornellà de Llobregat, Barcelona, Spain, addressed to the Legal & Compliance Department, along with a copy of your identification document, Alternatively, iniquities may be sent via email data.protection@mecalux.com with the subject line "Data Protection”.

For further concerns about data protection practices or file a complaint, data subjects may contact the relevant Data Protection Authority.

 

12. Severability

If any provision of this Privacy Policy is found to be wholly or partially null, invalid, illegal, or unenforceable in any jurisdiction, the validity, legality, and enforceability of the remaining provisions will remain unaffected. In such cases, the affected provision will cease to be effective within the jurisdiction concerned and only to the extent of the part that has been declared null, invalid, illegal, or unenforceable. Relevant applicable legislation in the respective jurisdiction will apply in place of the ineffective provision.

 

13. Effectiveness and modifications of the Privacy Policy

This Privacy Policy is effective as of the publication date indicated below. MECALUX reserves the right to modify this Privacy Policy at any time. Each new version will be published on this website.

 

Last updated: 13/11/2024