Privacy Policy

General Information

This Privacy Policy applies to all personal data that you, as a user (understood as any natural person who accesses the website), provide to Arteche when you access https://www.arteche.com/es, hereinafter the "Website."

The purpose of this Privacy Policy is to inform you about how we process your personal data as a user, as well as to explain the rights you have under the applicable data protection legislation in force at any given time.

Who is responsible?

The entity responsible for processing the personal data collected through the Website is Arteche, with tax identification number A48898548 and registered office at Derio Bidea 28 Mungia, Bizkaia 48100, Spain.

You can contact the Data Protection Officer at the email address rgpd@arteche.com to make any inquiries or request information you need about the processing of users' personal data. The personal data we collect will be treated confidentially and will be incorporated into our Record of Processing Activities.

What do we ask your data for?

Purpose	Description	Data
Newsletter sign-up	Manage the newsletter subscription, including the sending of personalized information about other products and services through those means (SMS, email, etc.) authorized in the registration form. You can unsubscribe from the newsletter at any time.	Name and/or surnames, Email, Professional title, Company.
Artificial Intelligence Functions	To offer automated functions that help you navigate the web, resolve doubts, or guide you through certain processes using artificial intelligence tools. To improve the services we offer you based on your interactions, allowing responses, recommendations, and other results to be more useful and aligned with your profile and activity on the web.	Name and/or surnames, Email, Telephone, Postal address, Professional title, Company.
For marketing purposes	To carry out promotional actions for our products or services, according to the consent expressed by the user and the information provided at the time of its collection. To personalize the services we offer you and to be able to make recommendations based on your interaction with us on the web and the analysis of your user profile (for example, based on your purchase and browsing history). To show you advertising on the Internet that you can see when you browse websites and apps, for example, on social networks. The advertising you see may be displayed randomly, but on other occasions it is advertising that may be related to your purchase history, preferences, and browsing.	Name and/or surnames, Email, Telephone, Postal address, Professional title, Billing address, Company.
Contact with the user	Attend to inquiries made through the contact form, complaints, or other customer service channels	Name and/or surnames, Email, Telephone, Postal address, Professional title, Company.
Development, execution, and fulfillment of the service provision or sales contract that has been contracted through the website.	With the objective of: Contacting the user in relation to the contracted products or services; Managing the payment methods used through the website; To carry out billing and the preparation of purchase receipts made through the website; Management of shipments and returns, as well as user support during the development of the contract.	Name and/or surnames, Email, Telephone, Postal address, Professional title, Password, Billing address, Debit/credit card number, Company.
Budget request form	To be able to attend to the request for a personalized budget according to the user's needs.	Name and/or surnames, Email, Telephone, Postal address, Professional title, Company.
Manage the registration or sign-up on the website	To register a user, enroll them, identify them, and be able to grant them access to the functionalities that correspond to them on the website.	Name and/or surnames, Email, Telephone, Postal address, Professional title, Password, Company.
Receive and manage resumes	Manage the personnel selection process	Name and/or surnames, Email, Telephone, Professional title.

Additionally, during your navigation on the Website, we may collect certain personal data through cookies or other similar technologies, as provided in our Cookie Policy.

What is our legal basis for data processing?

Our legal basis for processing personal data is as follows:

Consent: if you have given your express consent at the time of entering personal data by checking the corresponding box.
The performance of a contract: if there is a contractual relationship between you and Arteche, or if the processing of personal data is necessary for the development of the commercial relationship.
Compliance with a legal obligation: in those cases where Arteche has a legal obligation applicable to us as data controllers.
Legitimate interest: in those cases where there is a legitimate interest of our own or of third parties related to the operation of the Website or the provision of services to the user, provided that the fundamental rights and freedoms of users do not prevail over the legitimate interest.

How long will we keep your data?

The personal data we collect through the Website will be processed and kept for the time necessary to carry out the purpose for which it was collected.

More specifically, the data we collect for the development and execution of a contract with you will be kept as long as the contractual relationship remains in force, but the personal data we collect based on legitimate interest or with your consent will only be kept for the time necessary to fulfill that purpose.

Once the strictly necessary period for the execution of the purposes described above has elapsed, we will keep the personal data for an additional period, which will last until all actions that could arise from our liability derived from each of the processing activities have expired.

In order to carry out the purposes described above, it is necessary to give access to your personal data to other service providers, who will act as our data processors, such as:

Other companies of the group

We have entered into an agreement with the companies acting as data processors that regulates the management and processing of users' personal data, as well as the adequacy of the security measures adopted.

In cases where we need to make transfers to third parties with headquarters or servers outside the European Union or the European Economic Area (Iceland, Norway, or Liechtenstein), and such country does not offer a level of personal data protection equivalent to that of the European Union, we will transfer your personal data always respecting the adequate guarantees and maintaining security standards, in accordance with applicable regulations.

When such transfers are made from the EU/EEA to a third country for which the European Commission has not issued an Adequacy Decision, or we do not have Binding Corporate Rules, we will comply with the provisions established by the European Commission for these cases to provide you with adequate guarantees, and where appropriate, we will subscribe the Standard Contractual Clauses and even implement additional protective measures when necessary.

If you want more information about the transfer of personal data we make to countries outside the EU/EEA, you can contact us through the following email address: marketing@arteche.com

What are your rights?

You can exercise the following rights at any time and free of charge:

Access: to know what data we keep and what we do with it.
Rectification: to inform us of any inaccurate data.
Deletion: to have your personal data deleted, as far as possible.
Objection: to stop us from processing your personal data for any of the purposes mentioned above, provided there is no legal obligation preventing it.
Portability: to have your personal data transferred to a third party, as far as possible.
Restriction: to suspend your data when you contest its accuracy, or want us to keep it to exercise some action.
Not to be subject to decisions based solely on the automated processing of your data.

You can exercise any of these rights free of charge by accessing here.

If we do not properly respect these rights as controllers, we inform you that you can file a complaint with the data protection supervisory authority at Agencia Española de Protección de Datos (AEPD), C/Jorge Juan, 6, 28001 Madrid or at the email address internacional@aepd.es, as well as with the data protection supervisory authority of your country of habitual residence, workplace, or where the alleged infringement occurred.

Confidentiality and security measures

At Arteche, as data controllers, we commit to respecting the confidentiality of users' personal data and to using it according to the purposes for which it was collected.

We have adopted all appropriate technical and organizational security measures according to the nature of the data being processed and as required by data protection regulations.

At https://www.arteche.com/es we use Google Consent Mode v2 to transmit consents to the different purposes. More information here

Processing under the EU General Data Protection Regulation

This section applies to you and provides you with more information if one of our companies located in the European Economic Area processes your personal data.

Data Controller
The company providing you with this privacy notice, or identified as the operator of the corresponding website, application, or service, is the data controller of your personal data under the General Data Protection Regulation.

Business Partner Personal Data in Customer Relationship Management Systems
During our business relationship with you, we may share business partner contact information with affiliated companies and partners. We and these affiliated companies and partners are joint controllers for the proper protection of your personal data (Article 26 of the GDPR).

To enable you to effectively exercise your data subject rights in the context of this joint controllership, we have entered into an agreement with these Arteche companies that grants you the right to exercise your rights centrally against Arteche.

To exercise your rights or request a copy of the joint controller agreement, you may contact: rgpd@arteche.com.

Legal Basis for Processing
The GDPR requires us to inform you about the legal basis for processing your personal data. This basis is one or more of the following:

Performance of a contract: processing is necessary to exercise our rights and fulfill our obligations under any contract concluded with you (Art. 6.1.b GDPR).
Compliance with legal obligations: processing is necessary to comply with an applicable legal obligation (Art. 6.1.c GDPR).
Legitimate interest: processing is necessary for the purposes of the legitimate interests we pursue, mainly the efficient management of your use of the services and our business relationship (Art. 6.1.f GDPR). For more information: rgpd@arteche.com.
Consent: in some cases, we may request your consent for the use of your personal data (Art. 6.1.a GDPR).

Below is the legal basis applicable to each purpose described in this Privacy Policy:

Management of Registration, Contact, Quotes, and Contract Execution
Manage registration or sign-up on the website, verify your identity, and provide you access to the corresponding functionalities. Legal basis: Performance of a contract (Art. 6.1.b) · Legitimate interest (Art. 6.1.f).
Respond to inquiries made through the contact form or other customer service channels. Legal basis: Performance of a contract (Art. 6.1.b) · Legitimate interest (Art. 6.1.f).
Manage personalized quote requests. Legal basis: Performance of a contract (Art. 6.1.b) · Legitimate interest (Art. 6.1.f).
Develop, execute, and fulfill the service provision or sales contract, including payment management, invoicing, shipping, and returns. Legal basis: Performance of a contract (Art. 6.1.b) · Compliance with legal obligations (Art. 6.1.c).

For marketing and newsletter purposes * Carry out promotional actions, personalize services, and display advertising related to the user's profile, according to the expressed consent. Legal basis: Consent, if given voluntarily (art. 6.1.a) · Legitimate interest (art. 6.1.f). * Manage newsletter subscription and send information about products and services. Legal basis: Consent, if given voluntarily (art. 6.1.a) · Legitimate interest (art. 6.1.f).

Artificial Intelligence Functions * Offer automated navigation, query resolution, and guidance functions through artificial intelligence tools. Legal basis: Contract performance (art. 6.1.b) · Legitimate interest (art. 6.1.f). * Improve services based on user interactions so that responses and recommendations are more useful and aligned with their profile. Legal basis: Legitimate interest (art. 6.1.f).

Management of resumes and selection processes * Manage the personnel selection process based on the received resumes. Legal basis: Consent, if given voluntarily (art. 6.1.a) · Legitimate interest (art. 6.1.f).

International data transfers In the event that we transfer your personal data outside the European Economic Area, we ensure that your data is protected consistently with the GDPR. To this end, we adopt the following measures:

We only share your personal data with affiliated companies outside the European Economic Area if they have applied our Binding Corporate Rules (BCR) for the protection of personal data.
We transfer personal data to external recipients outside the European Economic Area only if the recipient has (i) signed the EU Standard Contractual Clauses with us, or (ii) implemented Binding Corporate Rules in their organization. For more information: rgpd@arteche.com.

Your competent data protection authority If you have any questions or requests related to data privacy, we recommend that you contact our Data Protection Officer at rgpd@arteche.com. Additionally, you always have the right to contact the competent supervisory authority, which in Spain is the Spanish Data Protection Agency (AEPD), located at C/Jorge Juan, 6, 28001 Madrid, or the data protection authority of your country of habitual residence, workplace, or where the alleged infringement occurred, as indicated in the section What are your rights? of the Privacy Policy.

Processing under the General Data Protection Law of Brazil

This section applies to you and provides you with more information if the processing by one of our companies (i) takes place in Brazilian territory, (ii) relates to data of individuals located in Brazilian territory, (iii) includes personal data collected in Brazilian territory, or (iv) aims at offering or supplying goods or services to individuals located in Brazilian territory. In these cases, the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados (LGPD)) applies to the processing of your personal data, and the following additions or deviations apply to sections 2, 5, 6, and 9 of this Data Privacy Policy:

Retention periods

As permitted under Article 16 of the LGPD, we may retain your personal data to comply with legal or regulatory obligations (such as retention obligations under tax or commercial law), during the legal statute of limitations period, or for the normal exercise of rights in judicial, administrative, or arbitration proceedings.

Your rights

In addition to the rights mentioned in this data privacy notice, you have the right under the LGPD to:

If you understand that your data is not processed in accordance with the applicable data protection law or is processed excessively, request that we anonymize, block, or delete unnecessary or excessive personal data; or
Request information about the public or private entities with which we have shared your personal data;
Be informed about the possibility of not giving your consent to process your data and the consequences of not giving consent in case we request your consent to process your data;
Revoke your consent at any time for us to process your personal data if we have requested your consent to process your data.

Legal basis for processing

The Brazilian General Data Protection Law requires us to provide you with information about the legal basis for processing your personal data.

The legal basis for our processing is:

Article 7 V of the LGPD (“Performance of a contract”);
Article 7 II of the LGPD (“Compliance with Legal Obligations”);
Articles 10 I and II of the LGPD (“Legitimate interest”);
Article 7 I of the LGPD (“Consent”).

International Transfers

Following the requirements of the LGPD defined in Article 33 of the Brazilian General Data Protection Law, in the event that we transfer your personal data outside Brazilian territory, we ensure that your data is protected consistently with the Brazilian General Data Protection Law, we will comply with the applicable law and the decisions imposed by the corresponding authority.

Your competent contact for data protection

If this section applies, you can also contact our Brazilian Data Protection Organization at rgpd@arteche.com

Processing According to Canadian Privacy Laws

Each Arteche company based in Canada (“Arteche entity in Canada”) maintains its personal data on secure servers accessible by authorized employees, representatives, or agents who need access for the purposes described in this privacy notice.

Residents of Quebec: Please note that your personal data may be communicated outside the province of Quebec (i.e., outside the province or territory and outside Canada).

If you have any questions about how an Arteche entity in Canada processes your personal data, including regarding the use of service providers outside Canada, or if you wish to exercise any of your rights concerning your personal data under the control of an Arteche entity in Canada, you may contact the privacy officer of Arteche in Canada at rgpd@arteche.com.

Processing under the Personal Data Protection Law of the People's Republic of China

This section applies to you and provides you with more information if processing by one of our companies takes place within the borders of the People's Republic of China ("China") or relates to data of persons within the borders of the People's Republic of China.

Processing of sensitive personal information

According to the PIPL, sensitive personal information refers to personal information that, once leaked or illegally used, can easily cause harm to the dignity of natural persons, serious harm to personal or property safety, including information about biometric characteristics, religious beliefs, specially designated status, health, financial accounts, individual location tracking, etc., as well as personal information of minors under 14 years old.

In addition to the payment data mentioned in the section Management of registration, contact, quotes, and contract execution of this Data Privacy Notice, we will, in principle, not process your sensitive personal information. In the event that we process your sensitive personal information, we will notify you of the necessity of processing and the effects on the rights and interests of the person, and obtain your specific consent, if applicable.

Transfer and disclosure of personal data

Following the requirements defined in Article 23 of the PIPL, in addition to the content mentioned in the section "Do we share your data with third parties?", we will, in principle, not transfer or share your personal information with third-party controllers, unless (1) we obtain your specific consent, if applicable, or (2) to comply with legal obligations under local laws and regulations.

International transfer

You acknowledge that your data will be transferred and processed outside the People's Republic of China. We will follow applicable laws and decisions imposed by the competent authority and ensure that your data is protected consistently with the Personal Information Protection Law of the People's Republic of China. If you or the company you work for are business partners, please note that Arteche is a multinational company and, in order to enter into or fulfill the contract/agreement with you or the company you work for, you understand and agree that we may transfer your personal information to foreign affiliated companies.

Legal basis for processing

The PIPL requires that we provide you with information about the legal basis for processing your personal data.

The legal basis for our processing is:

Article 13 (2) of the PIPL ("Performance of the contract");
Article 13 (3) of the PIPL ("Legal duties and responsibilities");
Article 13 (6) of the PIPL ("Processing publicly available data");
Article 13 (1) of the PIPL ("Consent")

Use by children

This offer is not directed at children under fourteen (14) years of age. We will not knowingly collect personal data from children under fourteen (14) years of age without prior parental consent if required by applicable law. We will only use or disclose a child's personal data to the extent permitted by law, to seek parental consent, in accordance with local laws and regulations, or to protect a child.

Processing according to Ecuador's data privacy law

Personal Data Storage Systems

We maintain personal data processing systems in which your information is stored and processed for the purposes described in this privacy notice. These systems may include various applications, databases, and IT infrastructure components that are managed with appropriate technical and organizational security measures. As a data subject, you have the right to know about the existence of these data processing systems and to exercise your rights regarding your personal data.

Accuracy of Personal Data

We rely on the accuracy of the personal data you provide to us. Providing incorrect or inaccurate personal data may affect our ability to serve you effectively and may have various consequences, including:

Inability to properly address your requests or provide the services you have requested
Delays or errors in processing your orders or responding to your inquiries
Difficulty contacting you regarding important updates, service information, or security matters
Possible issues with contract compliance or fulfillment of legal obligations
Limitations on your ability to exercise your rights as a data subject

Processing under the South African Protection of Personal Information Act

Processing under the South African Protection of Personal Information Act
For business partners and users located in South Africa, please note the following:
According to Section 1 of the Protection of Personal Information Act of 2013 (“POPI”), “personal data” or “personal information” includes “information relating to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person.”

The corresponding legal grounds and conditions for the lawful processing of personal data in South Africa are set out in Sections 8 to 25 of the POPI and refer to “Accountability,” “Processing limitation,” “Purpose specification,” “Further processing limitation,” “Information quality,” “Openness,” “Security safeguards,” and “Data subject participation.”

According to Section 69 of the POPI, it is prohibited to process a data subject’s personal information for direct marketing purposes by any form of electronic communication, including ATMs, faxes, SMS, or email, unless the data subject has given consent for the processing or is, subject to other conditions, a current customer of Arteche.

To exercise your rights of access, objection, and complaint regarding the processing of personal data, as described in the section "What are your rights?" of this Privacy Policy, the contact details of the South African Information Regulator are as follows:

JD House, 27 Stiemens Street
Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
Complaints: complaints.IR@justice.gov.za
General inquiries: inforeg@justice.gov.za

Processing under the Swiss Data Protection Act

Each data subject has the right to assert their rights before the courts or to file a complaint with the competent data protection authority.

The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

To exercise your rights, as described in the section "What are your rights?" of this Privacy Policy, you can contact us at rgpd@arteche.com.

Processing under the Turkish Personal Data Protection Law, number 6698

This section applies to you and provides more information if one of our companies located in Turkey processes your personal data under the Personal Data Protection Law numbered 6698 (“PDPL”).

Legal Basis for Processing
The PDPL requires us to provide you with information about the legal basis for processing your personal data. Such basis is one or more of the following:
Performance of a contract: processing is necessary to exercise our rights and fulfill our obligations under any contract concluded with you (art. 5.2.c PDPL).
Compliance with legal obligations: processing is necessary to comply with an applicable legal obligation (art. 5.2.ç PDPL).
Legitimate interest: processing is necessary for the purposes of the legitimate interests we pursue (art. 5.2.f PDPL).
Consent: in some cases, we may request your consent for the use of your personal data (art. 5.1 PDPL).

Below is the legal basis applicable to each purpose described in this Privacy Policy:

Management of registration, contact, quotes, and contract execution
Manage registration or sign-up on the website, verify your identity, and provide you access to the corresponding functionalities. Legal basis: Performance of a contract (art. 5.2.c) · Legitimate interest (art. 5.2.f).
Respond to inquiries made through the contact form or other customer service channels. Legal basis: Performance of a contract (art. 5.2.c) · Legitimate interest (art. 5.2.f).
Manage personalized quote requests. Legal basis: Performance of a contract (art. 5.2.c) · Legitimate interest (art. 5.2.f).
Develop, execute, and fulfill the service provision or sales contract, including the management of payments, invoicing, shipments, and returns. Legal basis: Performance of a contract (art. 5.2.c) · Compliance with legal obligations (art. 5.2.ç).
*

For marketing and newsletter purposes
Carry out promotional actions, personalize services, and display advertising related to the user profile, according to the expressed consent. Legal basis: Consent, if voluntarily given (art. 5.1) · Legitimate interest (art. 5.2.f).
Manage newsletter subscription and send information about products and services. Legal basis: Consent, if voluntarily given (art. 5.1) · Legitimate interest (art. 5.2.f).

Artificial Intelligence Functions * Provide automated navigation, query resolution, and guidance functions through artificial intelligence tools. Legal basis: Contract execution (art. 5.2.c) · Legitimate interest (art. 5.2.f). * Improve services based on user interactions so that responses and recommendations are more useful and aligned with their profile. Legal basis: Legitimate interest (art. 5.2.f).

Resume Management and Selection Processes * Manage the personnel selection process based on the resumes received. Legal basis: Consent, if given voluntarily (art. 5.1) · Legitimate interest (art. 5.2.f).

International Data Transfers In the event that we transfer your personal data outside of Turkey, we will ensure that your data is protected consistently with the PDPL. To this end, we transfer personal data to recipients outside of Turkey only if the recipient has signed a standard contract for the transfer of personal data abroad.

Your Rights as a Data Subject In accordance with Article 11 of the PDPL, and in addition to what is indicated in the "What are your rights?" section of this Privacy Policy, you may make the following requests regarding your personal data by contacting us: * To know whether your personal data has been processed or not. * To request information about the processing if your data has been processed. * To know the purpose of the processing and whether the data is used in accordance with that purpose. * To know the third parties, in the country or abroad, to whom your personal data has been transferred. * To request the correction of your data if it has been processed incompletely or inaccurately, and the notification of the corrections to the third parties to whom it has been transferred. * To request the deletion, destruction, or anonymization of your personal data if the reasons for processing have ceased, and the notification of such actions to the third parties to whom it has been transferred. * To object to any outcome that may be detrimental to you through the exclusively automated analysis of your personal data. * To request compensation for damages suffered as a result of the unlawful processing of your personal data.

To exercise any of these rights, you can contact us at rgpd@arteche.com.

This section applies to you and provides you with more information if one of our companies located in the United Kingdom processes your personal data under the Data Protection Act 2018 and/or the UK GDPR (i.e., Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as incorporated into the law of England and Wales, Scotland, and Northern Ireland pursuant to section 3 of the European Union (Withdrawal) Act 2018).

Data Controller

The company providing you with this privacy notice, or identified as the operator of the relevant website, application, or service, is the data controller of your personal data under the UK GDPR.

During our business relationship with you, we may share the contact information of business partners with Arteche subsidiary companies. These Arteche companies and we are joint controllers of the proper protection of your personal data (Article 26 of the UK GDPR).

To enable you to effectively exercise your data subject rights in the context of this joint controllership, we have signed an agreement with these Arteche companies granting you the right to exercise your rights centrally with Arteche.

To exercise your rights, you may contact us at rgpd@arteche.com.

Legal Basis for Processing

The UK GDPR requires us to provide you with information about the legal basis for processing your personal data. Such basis is one or more of the following:

Performance of a contract: processing is necessary to exercise our rights and fulfill our obligations under any contract entered into with you (Art. 6(1)(b) UK GDPR).
Compliance with legal obligations: processing is necessary to comply with a legal obligation applicable to us (Art. 6(1)(c) UK GDPR).
Legitimate interests: processing is necessary for the purposes of the legitimate interests pursued by us, primarily the efficient management of your use of the services and our business relationship (Art. 6(1)(f) UK GDPR). For more information: rgpd@arteche.com.
Consent: in some cases, we may request your consent for the use of your personal data (art. 6.1.a UK GDPR).

Below is the applicable legal basis for each purpose described in this Privacy Policy:

Management of registration, contact, quotes, and contract execution

Manage registration or sign-up on the website, verify your identity, and grant you access to the corresponding functionalities. Legal basis: Contract performance (art. 6.1.b) · Legitimate interest (art. 6.1.f).
Handle inquiries made through the contact form or other customer service channels. Legal basis: Contract performance (art. 6.1.b) · Legitimate interest (art. 6.1.f).
Manage personalized quote requests. Legal basis: Contract performance (art. 6.1.b) · Legitimate interest (art. 6.1.f).
Develop, execute, and fulfill the service provision or sales contract, including payment management, invoicing, shipping, and returns. Legal basis: Contract performance (art. 6.1.b) · Compliance with legal obligations (art. 6.1.c).

For marketing and newsletter purposes

Carry out promotional actions, personalize services, and display advertising related to the user’s profile, according to the expressed consent. Legal basis: Consent, if voluntarily given (art. 6.1.a) · Legitimate interest (art. 6.1.f).
Manage newsletter subscription and sending information about products and services. Legal basis: Consent, if voluntarily given (art. 6.1.a) · Legitimate interest (art. 6.1.f).

Artificial Intelligence Functions

Offer automated navigation, query resolution, and guidance functions through artificial intelligence tools. Legal basis: Contract performance (art. 6.1.b) · Legitimate interest (art. 6.1.f).
Improve services based on user interactions so that responses and recommendations are more useful and tailored to their profile. Legal basis: Legitimate interest (art. 6.1.f).

Management of resumes and selection processes

Manage the personnel selection process based on the resumes received. Legal basis: Consent, if given voluntarily (art. 6.1.a) · Legitimate interest (art. 6.1.f).

International data transfers

In the event that we transfer your personal data outside the United Kingdom, we ensure that your data is protected consistently with the UK GDPR.

To do this, we transfer personal data to recipients outside the United Kingdom only if the recipient has (i) signed the UK Standard Contractual Clauses with us, or (ii) implemented Binding Corporate Rules in their organization.

For more information about the security measures applied in relation to specific transfers, you can contact us at rgpd@arteche.com.

Your competent data protection authority

If you have any questions or requests related to data privacy, we recommend that you contact our Data Protection Officer at rgpd@arteche.com.

Additionally, you always have the right to contact the competent data protection authority of the United Kingdom, the Information Commissioner's Office (ICO), with your request or complaint, as indicated in the section "What are your rights?" of this Privacy Policy.

More information for U.S. residents.

Do Not Track
At this time, our offerings do not recognize or respond to browser "Do Not Track" signals.
For more information about "Do Not Track," please visit your browser’s support page.

Use by Children
This offering is not directed to children under thirteen (13) years of age.
We will not knowingly collect personal data from children under thirteen without insisting on obtaining prior parental consent if required by applicable law.
We will only use or disclose a child’s personal data to the extent permitted by law, to seek parental consent, in accordance with local laws and regulations, or to protect a child.

State Rights
Depending on the U.S. state in which you reside, you may have special rights regarding your personal data. This section applies to residents of the following states:
California
Colorado
Connecticut
Delaware
Florida
Iowa
Maryland
Minnesota
Montana
Nebraska
New Hampshire
New Jersey
Oregon
Tennessee
Texas
Utah
* Virginia

Categories of Personal Information Collected and Disclosed
Based on the context of your interactions with us, Arteche may have collected and disclosed to third parties for commercial purposes, in the past 12 months, the following categories of personal information:

Personal identifiers such as name, postal address, unique identifier, IP address, email address, phone number, bank account number, credit or debit card number, financial or medical information. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
Characteristics of protected classes under California or federal law, such as age, gender, race, religion, national origin, physical or mental health condition, citizenship, or marital status. Disclosed to: affiliated companies, service providers, professional advisors, and government agencies. Purpose: business or employment relationship management.
Commercial information, including records of personal property, products, or services purchased or considered. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
Internet or other electronic network activity, including browsing history, search history, and interaction with websites or applications. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
Geolocation data, such as device location or location via IP. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
Biometric and physical characteristics, such as audio, electronic, or visual information. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
Professional or employment-related information. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
Educational information. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.

Sources from which we may collect this information include:
Arteche’s websites and mobile applications and those of its affiliated companies.
You or your employer, via phone, postal mail, email, trade shows, or in the context of employment or business opportunities.
Our customers, suppliers, and vendors.
Third parties from whom we acquire contact data, such as LinkedIn.

Exercise of Applicable Rights
To exercise any right you may have under the laws of the state in which you reside (for example, rights of access, deletion, portability, correction, or objection), you may contact us at rgpd@arteche.com.

Requests may be subject to verification of the requester’s identity. Depending on your state’s laws, you may use an authorized agent to exercise your rights on your behalf, who must also verify their own identity and authorization to act on your behalf.

State-Specific Rights
California
California residents have the right to:
Request the deletion of personal data we have collected about them, except where retention is necessary to complete a transaction, detect security incidents, comply with a legal obligation, or other exceptions provided by law.
Request that we inform them about the categories of data collected, sources, purpose of processing, categories of third parties with whom we share the data, and the specific data collected.
Request correction of inaccurate personal data.
Not be discriminated against for exercising any of these rights.
Under California’s “Shine The Light” law, California residents may annually request information about personal data disclosed to third parties for direct marketing purposes. Currently, Arteche does not disclose personal data to third parties for their own direct marketing purposes.

Colorado, Virginia, Utah, Oregon, Montana, Tennessee, Delaware, Iowa, Minnesota, Nebraska, New Hampshire, New Jersey, Connecticut, and Texas
Residents of these states may have the following rights, depending on their state of residence:
Right of access: confirm whether we process your personal data and request access to it.
Right of deletion: request that we delete personal data we have collected about you.
Right of portability: request that we provide your personal data in a portable format.
Right of correction: correct inaccuracies in your personal data.
* Right of objection: object to the use of your data for targeted advertising, sale of personal data, or profiling with significant legal effects.

Florida
In addition to the above rights, Florida residents have the right to object to:
The collection of sensitive data, including precise geolocation data.
The processing of sensitive data.
* The collection of personal data through voice or facial recognition features.

Oregon
Oregon residents additionally have the right to obtain a list of specific third parties, other than natural persons, to whom we have disclosed personal data.

Maryland
Maryland residents additionally have the right to obtain a list of categories of third parties to whom we have disclosed consumer personal data.

Minnesota
Minnesota residents additionally have the right to challenge the outcome of decisions based on profiling, to be informed of the reason for the decision and the actions that could have led to a different outcome, as well as to have the decision reevaluated if it was based on inaccurate data.

Iowa
Iowa residents have the rights of access, deletion, portability, correction, and objection to the sale of their personal data.

Utah
Utah residents have the rights of access, deletion, and portability of their personal data.

Changes to the Privacy Policy

This Privacy Policy was last updated on 21/05/2026. At Arteche we reserve the right to update and modify certain aspects of it to adapt to legislative and jurisprudential developments, so we recommend that you review it periodically.