Privacy policy

This policy explains how Sanzar Group processes the personal data of people who visit this website or contact the company. It complies with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and with Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

• Controller: Agroaerospace S.L. (Sanzar Group)
• Tax ID (NIF): B88360565
• Address: Avenida Gregorio Peces Barba, 1, 28919 Leganés (Madrid), Spain
• Email for privacy matters: info@sanzar-group.com
• Phone: +34 670 27 29 00

Sanzar Group has not appointed a data protection officer, as its activity does not fall under article 37 of the GDPR or article 34 of the LOPDGDD. Privacy questions are handled at the email address above.

2. What data we process, why and on what legal basis

This website requires no registration and does not use cookies. Whatever you send us through the contact form reaches us as an email and is handled like any other enquiry (section 2.3). We only process personal data in the cases described below.

2.1. Browsing the website

• Data: IP address, date and time, page requested, referring page, and browser and device type. These are logged automatically by the servers that deliver the website.
• Purpose: to deliver the pages, keep the service secure, and detect and stop attacks or abuse.
• Legal basis: Sanzar Group’s legitimate interest in providing the service securely (article 6(1)(f) GDPR).
• Retention: up to 30 days. After that, logs are deleted unless they are needed to investigate a specific security incident.

2.2. Usage statistics

• Data: page visited, referring page, country, browser type, operating system and device, and some browsing events, such as changing the language or clicking the email and LinkedIn links.
• How it is collected: with Plausible Analytics, a measurement tool that does not use cookies or store anything on the user’s device. It does not store IP addresses. To count unique visitors, it computes an identifier from the IP address and browser, hashed with a key that changes every day and is then deleted. This data cannot identify anyone or track them from one day to the next or across websites.
• Purpose: to understand which content is of interest and improve the website.
• Legal basis: Sanzar Group’s legitimate interest in knowing how its website is used in aggregate (article 6(1)(f) GDPR), with minimal impact on users’ privacy.
• Retention: statistics are aggregated and anonymous, and are kept for as long as the service is used.

2.3. Enquiries through the contact form, by email or by phone

• Data: whatever you send us: name, email, phone, company, job title, the subject and the content of your message. If you use the form, also the language and the page you write from.
• Purpose: to answer your enquiry and, if you ask, prepare information or a proposal for you.
• Legal basis: your consent when you write to us and, at your request, taking steps prior to entering into a contract (articles 6(1)(a) and 6(1)(b) GDPR). If you write on behalf of a company, the processing of your business contact details is based on legitimate interest (article 6(1)(f) GDPR and article 19 LOPDGDD).
• Retention: as long as needed to handle the enquiry. If it does not lead to a business relationship, up to one year from the last communication.

2.4. Job applications

• Data: whatever is in the CV, cover letter and messages you send us by email or through LinkedIn.
• Purpose: to assess your application for the position you apply for or, for unsolicited applications, for positions that match your profile.
• Legal basis: your consent when you send the application and, at your request, taking steps prior to entering into a contract (articles 6(1)(a) and 6(1)(b) GDPR).
• Retention: until the selection process ends. If you are not selected, we will only keep your CV for future processes with your consent, and for up to one year. Please do not include special categories of data, such as health data, in your CV.

2.5. Clients, partners, suppliers and projects

• Data: identification and business contact details of people representing clients, project partners, suppliers and funding bodies, and the data needed to manage the relationship.
• Purpose: to coordinate, carry out, monitor and document contracts, collaborations and projects, including publicly funded R&D projects, and to meet the obligations they involve.
• Legal basis: performance of the contract or collaboration agreement (article 6(1)(b) GDPR), compliance with legal obligations, such as tax and accounting obligations or those arising from public grants (article 6(1)(c) GDPR), and legitimate interest in keeping in touch with the people who represent those organisations (article 6(1)(f) GDPR and article 19 LOPDGDD).
• Retention: for the duration of the relationship and, afterwards, for the statutory limitation periods and the periods required by tax and commercial law and by the rules of each grant. As a general rule, six years for accounting records, under article 30 of the Spanish Commercial Code.

2.6. Communications about our services

• Data: name, email and company.
• Purpose: to send clients, and people who have asked us for information, communications about Sanzar Group products and services similar to those they were interested in.
• Legal basis: legitimate interest and the existing relationship (article 6(1)(f) GDPR and article 21.2 LSSI) or, where there is no prior relationship, your consent (article 6(1)(a) GDPR).
• Retention: until you ask us to stop. You can do so at any time by replying to any of our messages or writing to info@sanzar-group.com.

2.7. Sanzar Group’s LinkedIn page

If you follow or interact with Sanzar Group’s LinkedIn page, Sanzar Group receives aggregated statistics about page visitors from LinkedIn. For those statistics, Sanzar Group and LinkedIn Ireland Unlimited Company are joint controllers. Your account data is processed by LinkedIn under its own privacy policy. Sanzar Group only uses information shown on your public profile, or sent to it by message, to reply to you.

3. Source of the data

The data in sections 2.3, 2.4 and 2.6 is provided by the data subjects themselves. The data in section 2.5 may come from the organisation the data subject represents. The data in sections 2.1 and 2.2 is generated automatically when browsing.

4. Automated decisions

Sanzar Group does not make decisions based solely on automated processing of your data, and does not profile you.

5. Who receives the data

Sanzar Group does not sell or share personal data with third parties, except where required by law. The following may have access to it:

• Providers that offer services to Sanzar Group and process data only on its behalf and under its instructions, as processors under a contract that complies with article 28 GDPR:
  • website hosting and delivery, and sending the messages from the contact form: Amazon Web Services EMEA SARL, in data centres in the European Union, with a worldwide content delivery network;
  • usage statistics: Plausible Insights OÜ (Estonia), with data hosted in the European Union;
  • email, document storage and cloud office tools;
  • accounting, tax and employment advisers.
• Funding and oversight bodies for R&D projects, such as national or European public bodies, where the grant rules require it for the projects you take part in.
• Public authorities and courts, where there is a legal obligation.

6. International transfers

Some of the providers above belong to groups based outside the European Economic Area, or may process data from outside it. For example, the website’s delivery network serves pages from the location closest to the user. In those cases, the transfer is covered by a European Commission adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or by the standard contractual clauses approved by the Commission (articles 45 and 46 GDPR). You can ask for more information about these safeguards at info@sanzar-group.com.

7. Your rights

You may exercise the following rights over your data at any time:

• access: find out what data of yours we process;
• rectification: correct inaccurate data;
• erasure: ask us to delete it;
• objection: ask us to stop processing it, in particular where processing is based on legitimate interest or is for marketing purposes;
• restriction: ask us to only store it;
• portability: receive it in a structured format or have us send it to another controller, where processing is based on consent or a contract;
• withdraw consent: you can withdraw it at any time, without affecting processing carried out before.

To exercise them, write to info@sanzar-group.com or by post to the address in section 1, stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it. We will reply within one month, which may be extended by two further months for complex requests; in that case we will let you know.

If you believe we have not handled your request properly, or that the processing does not comply with the law, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es).

8. Security

Sanzar Group applies technical and organisational measures appropriate to the risk to protect data, in line with article 32 GDPR. These include encrypted connections (HTTPS) across the website, access to data limited to staff who need it for their work, and a duty of confidentiality for those staff.

9. Minors

This website is aimed at businesses and professionals. It is not intended for children under 14, and Sanzar Group does not knowingly process data of children under that age.

10. Changes to this policy

Sanzar Group may update this policy to reflect legal changes or changes to its processing. The version in force is always the one published on this page, with its last update date. If the change is significant, we will show it clearly on the website.