In accordance with the current regulations on the protection of personal data, we provide you with the following information:

1. INFORMATION FOR THE DATA SUBJECT AND/OR USER

This Privacy Policy aims to inform you, in detail, about how the personal data you, as a data subject and/or user, provide (or have provided) will be processed, regardless of the means used, such as the website, email, telephone, in person, or through online or paper forms.

This policy applies to data collected and processed by the following companies within the MRC Group, each of which acts as the Data Controller for the data it collects:

MRC has adopted all necessary technical and organisational measures to ensure the confidentiality, integrity, availability, and resilience of the personal data it processes.

Responsibility of the User / Data Subject

By providing your data, you, as the data subject and/or user (hereinafter, the Data Subject), confirm that you are over 18 years of age and that the information you provide to any of the above-mentioned companies is true, accurate, complete, and up to date.

You are responsible for the accuracy of the information supplied and for keeping it current so that it reflects your actual situation. You will be held liable for any false or inaccurate information provided and for any direct or indirect damages that may result from such information.

2. DATA PROTECTION CONTACT DETAILS

Requests and enquiries relating to the management of personal data will be handled by MRC Soluciones Integrales, S.L., whose contact details are as follows:

Identity: MRC Soluciones Integrales, S.L.
Tax ID (CIF): B71261564
Registered address: P.I. Las Serna (Ciudad Agroalimentaria), Calle C, Nave 6.26 – 31500 Tudela (Navarra), Spain
Telephone: +34 948 824 706
Email: mrc@mrcsoluciones.es

3. PURPOSES, DATA RETENTION PERIODS AND LEGAL BASIS FOR PROCESSING

The personal data you provide, as well as any you may provide in the future to any MRC company, will be processed in accordance with current data-protection legislation. The following information explains the purposes of each type of processing carried out by MRC:

Contact / Enquiries

Purpose: To respond to and follow up on queries, requests for information, suggestions or complaints, and to maintain contact with individuals who have expressed interest in the company, its products or its services.
Retention: Data will be kept for the time necessary to process and respond to the enquiry.
Legal basis: Article 6(1)(f) GDPR – the Controller’s legitimate interest in responding to communications and requests received.

Pro-forma Invoices / Quotations

Purpose: To prepare and deliver pro-forma invoices and/or quotations requested by data subjects and to follow them up by telephone, electronically or in person.
Retention: Data will be kept while there is a mutual interest, or until the data subject requests its erasure.
Legal basis:

• Article 6(1)(b) GDPR – processing necessary for the application of pre-contractual measures at the data subject’s request.
• Article 6(1)(f) GDPR – the Controller’s legitimate interest in preparing and monitoring requested quotations.
  
  

Clients

Purpose: To manage clients; maintain contractual and/or commercial relationships; handle the contracting of products and/or services; and manage the company’s administrative (billing, payments, etc.), accounting and tax obligations, as well as any related legal duties.

Also, to maintain contact with individuals providing services on behalf of a legal entity (company, organisation, etc.), as well as with sole traders and self-employed professionals, in order to establish or maintain business-to-business (B2B) relationships.

Retention: Data will be kept for as long as the contractual and/or commercial relationship exists and deletion is not requested. When the relationship ends, data will be retained for the statutory limitation periods set out in tax, commercial and other applicable legislation.
Legal basis:

• Article 6(1)(b) GDPR – performance and maintenance of contractual or commercial relationships and compliance with related legal obligations.
• Article 6(1)(f) GDPR and Article 19 LOPDGDD – the Controller’s legitimate interest in maintaining B2B relationships with legal entities, sole traders and professionals.

Suppliers

Purpose: To manage suppliers; maintain contractual and/or commercial relationships; and handle administrative (billing, payments, etc.), accounting and tax obligations, as well as the legal obligations derived therefrom.

Also, to maintain contact with individuals providing services on behalf of a legal entity (company, organisation, etc.), or with sole traders and professionals, to establish or maintain business-to-business (B2B) relationships.

Retention: Data will be kept while the contractual and/or commercial relationship exists and deletion is not requested, and subsequently for the statutory limitation periods.
Legal basis:

• Article 6(1)(b) GDPR – performance and maintenance of contractual or commercial relationships and compliance with legal obligations.
• Article 6(1)(f) GDPR and Article 19 LOPDGDD – the Controller’s legitimate interest in maintaining B2B contacts.
  

Submission of CVs

Purpose: To file and record documentation and CVs voluntarily submitted by candidates for future recruitment processes.
Retention: CVs will be retained for a maximum of one year, or until the data subject requests erasure. After that period, if you wish to continue participating in selection processes, please send us your CV again.
Legal basis: Article 6(1)(a) GDPR – consent given by the data subject when submitting their CV, representing a clear affirmative action.

Video Surveillance

Purpose: Temporary storage of images captured by CCTV cameras for the purpose of safeguarding the security of people, property, facilities and goods.
Retention: Images will be retained for a maximum of 30 days, except where it is necessary to keep them to prove acts that threaten the safety of persons, property or facilities, or where they are required by courts or law-enforcement authorities.
Legal basis: Article 6(1)(e) GDPR – processing necessary for the performance of a task carried out in the public interest, namely the protection of people, property and facilities.
Data disclosure: Data will not be shared with third parties except with law-enforcement authorities, courts or tribunals, or where legally required.

4. DATA DISCLOSURE

As a general rule, personal data will not be disclosed to third parties unless required by law or necessary for service provision or to maintain and develop contractual relationships, such as (without limitation):

• Public administrations, courts and tribunals, to comply with legal obligations and address any liabilities arising from applicable legislation.
• Financial institutions for the management of payments and collections.
• Payment service providers (e.g. Mastercard, VISA, PayPal, etc.).
• Transport companies for the delivery and/or collection of products.
• Service providers engaged by the Controller, who will act as Data Processors.

Although not considered a disclosure, certain external service providers acting as Data Processors may access your information to perform specific tasks or services on our behalf. These processors act under our instructions, may not use the data for other purposes, and are bound by strict confidentiality obligations.

International Data Transfers

MRC does not plan to transfer your data to countries outside the European Economic Area (EEA).
If such transfers were ever required, they would only take place to recipients located in countries, territories or sectors declared to provide an adequate level of protection by the European Commission; or under the EU-US Data Privacy Framework; or subject to appropriate safeguards in accordance with Article 46(2) of Regulation (EU) 2016/679.

5. RIGHTS OF DATA SUBJECTS

Any individual has the right to obtain confirmation as to whether the Controller is processing personal data concerning them, as well as the right to withdraw, at any time, any consent previously given for a specific purpose, without affecting the lawfulness of processing based on consent before its withdrawal.

Data-protection legislation grants you the following rights:

• Access, rectification, erasure, restriction, objection, and data portability.
• The right not to be subject to automated decisions, including profiling, where applicable.

Characteristics of these rights

• Exercising your rights is free of charge, except for manifestly unfounded or excessive requests (e.g. repetitive), in which case the Controller may charge a fee proportionate to administrative costs or refuse to act.
• You may exercise your rights personally or through a legal or authorised representative.
• We must respond to your request within one month. This period may be extended by a further two months where necessary due to complexity or number of requests.
• We are obliged to inform you of the means to exercise your rights, which must be easily accessible. If a request is made electronically, the response will be provided by the same means where possible.
• If the Controller does not act on your request, you will be informed within one month of the reasons for not doing so and of your right to lodge a complaint with a Supervisory Authority.

How to exercise these rights

You may exercise your rights by writing to the postal or email address of the Data Controller, quoting “EXERCISE OF DATA-PROTECTION RIGHTS”, and including:

• A clear statement of your request,
• An address for correspondence,
• The date and your signature.

If you wish, we can provide you with forms to facilitate the exercise of your rights — simply indicate which right you wish to exercise.

If you believe that your rights have not been fully respected, you may file a complaint with the Spanish Data Protection Agency (AEPD) at:
C/ Jorge Juan 6, 28001 Madrid.

6. SOCIAL NETWORKS

MRC uses social networks as another channel of communication. Information collected through posts or messages may contain personal data that is publicly available online.

Each social network has its own privacy policy explaining how it uses and shares your information; we recommend reviewing these policies before using such platforms to ensure you agree with how your data is handled.

Processing of data relating to followers or users interacting with MRC’s official social-media pages will be governed both by this Privacy Policy and by the respective networks’ own privacy policies.

The Controller may process your data to:

• Properly manage its presence on the relevant social network;
• Send private and individual messages through the network’s channels;
• Inform you about activities, products and/or services of the Controller or third parties related to our business; and
• Carry out any other processing permitted under the networks’ regulations.

7. COOKIES

In general, when browsing the internet you can choose to accept or reject cookies through your browser settings.

This website may use cookies and similar technologies such as local shared objects, flash cookies or pixels, small files that websites may install on the user’s device (computer, tablet, smartphone, etc.).

Cookies serve various functions: storing browsing preferences, collecting statistical information, enabling certain technical features, and recording information about the user’s browsing habits or device.

Cookies are useful because they allow web pages to operate more efficiently and adapt to user preferences (e.g. language, currency). They also help website owners improve their services and optimise advertising based on aggregated statistics and user behaviour.

Certain cookies require the user’s informed consent before installation, such as analytical, advertising or affiliate cookies. Technical cookies or those necessary for the operation of the website or for providing services expressly requested by the user are exempt.

You can configure your browser to be alerted when cookies are received and to block their installation.
Please consult your browser’s instructions for more details.
For further information, please refer to our Cookie Policy.

8. MANDATORY OR OPTIONAL INFORMATION PROVIDED BY THE DATA SUBJECT

By ticking the relevant boxes and completing fields marked as mandatory in various forms, you expressly and freely consent to the processing of your data by the Controller for the purpose of handling your request. Providing information in optional fields is voluntary.

If you do not provide the required data, we may be unable to process your request, contract or enquiry.

You guarantee that the personal data provided is accurate and undertake to notify us of any changes.

9. SECURITY MEASURES

MRC is committed to protecting your personal information by implementing reliable and effective physical, organisational and technological measures, controls and procedures designed to maintain the integrity and security of your data and ensure its confidentiality.

All staff with access to personal data have been trained and made aware of their obligations regarding data processing.

Our supplier contracts include confidentiality clauses requiring them to maintain secrecy regarding any personal data they may access, and to implement appropriate technical and organisational measures to ensure the confidentiality, integrity, availability and resilience of processing systems and services.

These security measures are reviewed regularly to ensure their effectiveness and suitability.

However, absolute security cannot be guaranteed, and no system is entirely impenetrable. Should any information under our control be compromised as a result of a security breach, we will take appropriate steps to investigate the incident, notify the Supervisory Authority, and inform affected individuals where necessary so that they can take suitable protective measures.