Privacy Policy

SANTOS understand that it is essential to maintain a transparent relationship with you, which is why we are showing you our Privacy Policy. We want to keep you duly informed of how we collect and securely process any data that you provide.

Your data will be processed in accordance with current legislation, specifically, with the provisions of Regulation (EU) 2016/679 of 27 April 2016 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. It will also be processed pursuant to Organic Law 3/2018 of 5 December on the protection of personal data and the guarantee of digital rights.

We would appreciate it if you could carefully read through our Privacy Policy to provide you with the necessary information to understand how we use the data you provide us with.

1 Who is the controller?

If you or someone authorised by you has provided us with your data, we hereby inform you that SANTOS (the companies that operate commercially under this brand) are the controller. This data will be processed in accordance with the provisions in the current regulations on the protection of personal data.

There may be other controllers involved in the processing we carry out; in those cases, we will always inform you of the controller and their identification details.

We at SANTOS are committed to complying with the duty of secrecy, keeping personal data confidential and safe. To this end, we have taken the necessary measures to prevent its alteration, loss, unauthorised processing or access in accordance with the provisions of the Regulation.

SANTOS is made up of:

SANTOS COCINA Y BAÑO, S.L.U. with tax ID code (CIF): ESB15383896
SANTOS EQUIPAMIENTO DE INTERIORES, S.L.U. with tax ID code (CIF): ESB15515232

2 Where do we provide information?

SANTOS provide information through the website www.santos.es in the Privacy Policy section. More information in “Legal Notice”.

3 What personal data do we process?

The personal data we process includes:

Any data you voluntarily provide us with
Data arising from the communications you maintain with us
Your browsing information for online services (IP address or information from cookies or similar devices (please see our Cookies Policy on the website)
Any information from publicly available sources, which we lawfully have access to
Data arising from the contractual or pre-contractual relationship you maintain with us, including your image; in such cases, you will always be informed of the possibility of capturing your image
Data that third parties provide us with about you, with a lawful basis for it or after obtaining your consent to it
Third-party data you provide us with, with the consent of the third party in question

You can find more information in the list of processing activities section in this Privacy Policy.

4 How do we process data?

At SANTOS, we always process your personal data strictly in compliance with current legislation. We would also like you to know that we have the appropriate technical and organisational means to ensure an optimal level of security. Through them, we can guarantee that only authorised individuals will have access to it, that we will keep it intact – preventing any deliberate or accidental loss – and that we have strengthened our data processing systems and services.

Nevertheless, due to the fact that SANTOS cannot guarantee the absolute impregnability of the Internet nor the complete absence of hackers or others that fraudulently access personal data, we undertake to notify you without any undue delay of any personal data breach that may pose a high risk to the rights and freedoms of natural persons. Pursuant to the provisions of Article 4 of the GDPR, a personal data breach is understood to be any security breach that leads to the accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or the unauthorised disclosure of or access to such data.

The technical operations, arrangements and procedures that we carry out in an automated or non-automated way and that enable the collection, storage, modification, transfer and other actions on personal data are considered to be personal data processing activities.

We also hereby inform you that the data is jointly processed by the companies in the group listed in Item 1 of this Privacy Policy.

5 What is the lawful basis for processing?

The lawful basis for the processing of personal data is the contractual or pre-contractual relationship, the employment relationship or any other lawful basis necessary for the processing of data, such as explicit consent from the data subject.

6 How do we manage electronic communications?

In accordance with the provisions of Law 34/2002 of 11 July on information society services and electronic commerce and Directive 2002/58/EC, we hereby inform you that you may receive commercial communications and information through this electronic communications system (e-mails, automated reply messages from forms and other communications systems) once you have given us your consent or when there are commercial communications about products or services that are similar to those that have been previously provided by the controller.

In case you do not wish to receive any communications or information of this nature, you can notify us of this through the same means by writing “OPT OUT OF COMMERCIAL COMMUNICATIONS” in the subject line so your personal data is removed from our database. Your request will be dealt with within one month from the date it was sent. If we do not receive a reply from you expressly stating otherwise, we will take this to mean that you agree to and authorise our company to continue sending you the aforementioned communications.

If you receive such communications by these means, we would like you to know that the messages are exclusively intended for the recipient and may contain privileged or confidential information. If you are not the intended recipient, we hereby inform you that any unauthorised use, disclosure and/or copying is strictly forbidden by current legislation.

7 How long will we store your data?

The personal data on natural persons which SANTOS have collected through any means will be kept provided the data subject does not request its erasure. Likewise, it will be kept for as long as the relationship that gave rise to the data processing activity remains, while abiding by the statutory retention periods at all times. At the end of this period, the personal data will be removed from all SANTOS systems.

8 Will your data be disclosed to third parties?

Personal data will not be assigned, transmitted or transferred, except for the cases already mentioned above, which are not a consequence of any legal obligation. If we are requested by the public authorities or the regional institutions to do so within the scope of the functions expressly attributed to them by law, your data will be transmitted.

If it is necessary to assign, transmit or transfer your personal data outside of the cases mentioned above, you will be notified of this beforehand so that you may, where applicable, grant your consent.

In order for us to get everything organised as well as run smooth operations and procedures that ensure good management, it may be necessary for SANTOS to engage the services of advisers, professionals or other service providers to process data according to our instructions.

Such processing by third parties will be regulated by a contract in writing or in any other form admissible by law which can prove that it has been entered into as well as its content. It will expressly state that the processor will process the data in accordance with our instructions, not use it for any purpose other than the one that appears in the contract and not disclose it to other parties, not even for its storage.

9 What rights do you have?

The data processing regulations grant you the following rights:

Right of access: It is the User’s right to obtain confirmation about whether or not SANTOS is processing their personal data. Where that is the case, they can obtain information about their specific personal data and the processing activities that SANTOS have carried out, as well as any available information on the source of such data and the recipients to whom the data has been disclosed or will be disclosed.
Right to rectification: It is the User’s right to rectify any personal data that is inaccurate or – taking into account the purposes of processing – incomplete.
Right to erasure (“right to be forgotten”): It is the User’s right, unless otherwise provided by law, to obtain the erasure of their personal data when it is no longer necessary for the purposes for which it was collected or otherwise processed; the data subject withdraws their consent for processing and there is no other lawful basis for it; the data subject objects to the processing and there is no other lawful basis to continue with it; the personal data has been unlawfully processed; the personal data must be erased to comply with a legal obligation; or the personal data was obtained in relation to a direct offer of information society services to a minor under the age of 14. Aside from erasing the data, the Controller, taking into account the available technology and the cost of its implementation, must take reasonable measures to inform the controllers that are processing personal data of the data subject’s request to erase any link to such personal data.
Right to restrict processing: It is the User’s right to restrict the processing of their personal data. The User has the right to obtain the restriction of processing when they contest the accuracy of their personal data; the data has been unlawfully processed; the Controller no longer needs the personal data but the User needs it to file a claim; and when they have objected to the processing of their data.
Right to data portability: In case processing is done by automated means, the User will have the right to receive their personal data from the Controller in a structured, commonly used and machine-readable format, as well as request its transmission directly to another controller. Whenever it is technically feasible, the Controller will directly transfer such data to another controller.
Right to object: It is the User’s right to not have their personal data processed or for SANTOS to stop processing it.
Right not to be subject to a decision based solely on automated processing, including profiling: It is the User’s right to not be subject to automated individual decision-making, including profiling, unless otherwise provided for by current legislation.

If you want more information on the processing of your data, rectify any data that is inaccurate, object to and/or restrict any type of processing that you do not consider necessary, or request processing to stop when the data is no longer necessary, you may post a letter to SANTOS at: Rúa do Restollal, 32, Planta 1ª – 15702 – Santiago de Compostela (A Coruña); Deseiro, s/n | Sergude – 15881 – Boqueixón (A Coruña); or send an e-mail to lopd@santos.es.

This communication must contain the following information: The User’s name and surname(s), the request they want to make, the address and supporting documentation.
Rights may only be exercised by the Users themselves. Nevertheless, they may be exercised by an individual who is authorised to be the legal representative of the User. In this case, documentation proving such representation of the data subject must be provided.

We would also like to inform you that you may withdraw the consent given without this affecting the lawfulness of any processing that has already been done by sending your request to the same address provided in the paragraph above. In this case, you must attach a copy of your national identity card or passport to your request.

If you believe there is an issue or breach of the current regulations with regard to how your personal data is being processed, you have to the right to effective judicial protection and to file a claim with a competent supervisory authority, specifically in the State where you reside or work or where the alleged breach took place. For Spain, the competent supervisory authority is the Spanish Data Protection Agency (https://www.aepd.es/) – C/ Jorge Juan, 6 28001 – Madrid – FAX: +34 914483680 – TEL.: +34 901 100 099 – E-mail: ciudadano@agpd.es.

10 What is the purpose and the lawful basis for the processing of data and how long will the data be kept?

The purposes of the data processing activities carried out by some or all of the Controllers listed above are as follows:

SANTOS COCINA Y BAÑO, S.L.U. – SANTOS EQUIPAMIENTO DE INTERIORES, S.L.U.

PROCESSING ACTIVITY	PURPOSE OF THE PROCESSING	LAWFUL BASIS	RETENTION PERIOD	CONTROLLER
Labour management	Management of staff to formalise employment contracts, keep files under control and manage payroll	Contractual relationship5 years from the end of the contract	5 years from the end of the contract	All
Tax and accounting management	Processing necessary for compliance with tax and accounting obligations	Contractual relationship Legal obligation of the controller Overriding legitimate interest of the controller or third parties	5 years from the end of the contract The time necessary to comply with legal obligations	All
Contract management	Processing of data in order to maintain communications with data subjects	Contractual relationship Overriding legitimate interest of the controller or third parties Explicit consent from the data subject	5 years from the end of the contract Until request for erasure and/or objection by the data subject Until it is no longer used	All
Occupational health and safety	Compliance with current legislation on occupational health and safety and health surveillance	Contractual relationship Legal obligation of the controller	Until the end of the contractual relationship The period legally established by the specific regulations	All
Video surveillance	Capturing of images through video surveillance system and/or alarm system with image capture, to protect the company’s assets	Overriding legitimate interest of the controller or third parties	1 month	All
Job candidate management	Staff recruitment and hiring through the management of CVs, face-to-face interviews and assessment tests	Vital interests of the data subject or other individuals Explicit consent from the data subject	Maximum of 1 year	All
Communication of information and notifications	Dissemination of activities and notification of relevant information related to the company’s activities	Overriding legitimate interest of the controller or third parties Explicit consent from the data subject	Until request for erasure and/or objection by the data subject	All
Multimedia management	Processing of images and/or videos for dissemination in the media and social media and promotion of activities	Explicit consent from the data subject	Until request for erasure and/or objection by the data subject Until it is no longer used	All
Customer management	Processing of data necessary for the maintenance of the business/contractual relationship with customers, billing, after-sales service, the sending of offers and advertising and building loyalty.	Contractual relationship Commercial relationship	5 years from the end of the contract The period legally established by specific regulations	All
Sending of advertising	Sending of commercial information, notifications about actions and events or interest, deals and information on products and services to customers and potential customers.	Explicit consent from the data subject	Until request for erasure and/or objection by the data subject Until it is no longer used	All
Monitoring work	Tracking employee attendance at work (holidays, absences, time tracking)	Contractual relationship Legal obligation of the controller Overriding legitimate interest of the controller or third parties	Until the end of the contractual relationship	All
Supplier management	Analysis, evaluation, hiring, order management and supplier payment management	Contractual relationship	5 years from the end of the contract The period legally established by specific regulations	All
Warranty management	Warranty management for the products sold for compliance with Royal Legislative Decree 1/2007	Legal obligation of the controller	The time necessary to comply with legal obligations	All

11 Agreement to and changes to this Privacy Policy

Users are required to read and agree to the terms and conditions on the protection of personal data contained in this Privacy Policy, as well as agree to the processing of their personal data so the Controller can carry it out in the manner, within the timeframe and for the purposes specified. Using the Website implies your agreement to its Privacy Policy.

SANTOS reserve the right to amend our Privacy Policy based on our own criteria or due to legislative, case law or procedural changes by the Spanish Data Protection Agency. The User will not be explicitly notified of any changes or updates to this Privacy Policy. Users are advised to check this page from time to time to be aware of the latest changes or updates.

This Privacy Policy was updated to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and Organic Law 3/2018 of 5 December on the protection of personal data and the guarantee of digital rights.

This Privacy Policy document was revised on: 20/02/25