Privacy policy

This policy describes how the owner of this website (hereinafter, “the Controller”) processes the personal data of its visitors, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

1. Data controller

The data controller is the company identified at the top of this page. For any data protection matter you can write to the email address shown there.

2. What data we process and where it comes from

This website is informational: it has no user registration or private area. The only data entered directly by the user is that of the distributor form. The data we may process is:

• Browsing data. When you visit the site, the server hosting it automatically logs technical data such as your IP address, the date and time of access, the pages visited, the browser and the operating system. These logs are used solely for security and to keep the service running.
• Usage and audience measurement data. If you accept analytics cookies, Google Analytics collects data about your use of the site (pages viewed, visit duration, device, browser, language, approximate location at city or region level, traffic source and cookie identifiers). Google Analytics 4 does not log or store IP addresses. See the cookie policy for details.
• Data you provide when contacting us. If you email us, we will process the data you include in your message (name, email address, company and the content of your enquiry).
• Distributor form data. If you request information about distributing GlopPaper, we process the data you enter in the form (company, full name, email address, phone, country and message). The form is sent by email to the address shown at the top of this page; the data is not stored on the website.

Purchases are made in the GlopPaper online shop, which has its own privacy policy.

3. Purposes and legal basis

Purpose	Data	Legal basis
Keeping the website running and secure, and detecting or preventing misuse	Browsing data (server logs)	Legitimate interest of the Controller in keeping its systems secure (Art. 6(1)(f) GDPR)
Measuring the audience and use of the site in order to improve its contents	Usage data collected by Google Analytics	Consent, given through the cookie banner (Art. 6(1)(a) GDPR). You may withdraw it at any time
Handling the enquiries you send us by email and the distributor information requests sent through the form	Contact details, form data and message content	Consent given by contacting us or by submitting the form and accepting this policy (Art. 6(1)(a) GDPR) and, where applicable, steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR)

We do not make automated decisions or build profiles with legal effects on you from this data.

4. Retention period

• Server logs: for the time strictly necessary for security purposes, generally no longer than twelve months, unless they must be kept to investigate an incident.
• Google Analytics data: data linked to cookie identifiers is kept in Google Analytics for a maximum of fourteen months; after that only aggregated reports that do not identify any user are retained.
• Enquiries and distributor requests: for as long as it takes to handle the enquiry or request and, afterwards, for the limitation periods of any legal liability that may arise.

5. Recipients of the data

We do not disclose personal data to third parties, except where required by law. The following providers, acting as processors under contract, do have access to it because we need them to provide the service:

• Web hosting provider, which hosts the site and its access logs and sends the email containing the distributor form data.
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which provides the Google Analytics service, only if you accept analytics cookies.

International transfers

Google Analytics may involve the processing of data on Google LLC servers in the United States. This transfer is covered by the European Commission’s adequacy decision on the EU-US Data Privacy Framework, to which Google LLC is certified, and by the standard contractual clauses approved by the European Commission. More information is available in Google’s privacy policy and on the page How Google uses information from sites or apps that use our services.

6. Your rights

You may exercise the following rights at any time:

• Access: find out whether we process your data and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed.
• Objection: object to processing based on legitimate interest.
• Restriction: ask us to restrict processing in the cases provided for in the GDPR.
• Portability: receive your data in a structured, commonly used format.
• Withdrawal of consent: without affecting the lawfulness of processing carried out beforehand. Analytics cookies can be refused or disabled as explained in the cookie policy.

To exercise them, write to the email address shown at the top of this page, stating the right you wish to exercise and attaching, if needed to identify you, a copy of your identity document. We will reply within one month, which may be extended in the cases provided for in the GDPR.

If you believe we have not handled your rights correctly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es, or with the supervisory authority of your own country.

7. Minors

This website is not aimed at children under fourteen. If you become aware that a minor has provided us with personal data, please write to us so that we can delete it.

8. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration, taking into account the state of the art, the nature of the data and the risks of the processing. The website is served exclusively over an encrypted connection (HTTPS).

9. Changes to this policy

We may update this policy to adapt it to legislative changes or to new features of the website. The version in force is the one published on this page, with the update date shown at the top.