Privacy Policy

Information for the User

Who is responsible for processing your personal data?

Gras Arquitectura, S.L. is the Data Controller responsible for handling your personal information. This processing is conducted in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Spain’s Organic Law 3/2018 of 5 December (LOPDGDD).

What types of data do we collect and process?

We only request the minimum data necessary, depending on the form or method used to collect your information, to fulfil the stated purposes in each context.

Why do we process your personal data and under what legal basis?

Your personal data is processed confidentially in accordance with the purpose outlined in each of the forms on our website, including:

  • Contact Form: Responding to queries or requests (legitimate interest, Art. 6.1.f GDPR).
    Sending promotional content (user consent, Art. 6.1.a GDPR).
    Conducting statistical analysis and market research (legitimate interest, Art. 6.1.f GDPR).

  • Newsletter Form: Delivering newsletters, updates, offers, and promotions (user consent, Art. 6.1.a GDPR).

  • Quote Request Form: Sending commercial estimates (contractual necessity, Art. 6.1.b GDPR).
    Sending promotional content (user consent, Art. 6.1.a GDPR).

  • CV Submission Form: Participation in recruitment processes (user consent, Art. 6.1.a GDPR).

  • Testimonial Form: Moderating and publishing user experiences or opinions (user consent, Art. 6.1.a GDPR).

  • Comments Form: Moderating and publishing comments on blog posts (user consent, Art. 6.1.a GDPR).

  • Ethics Channel / Whistleblower Form: Handling internal reports and investigations (legal obligation, Art. 6.1.c GDPR).

  • User Registration Form: Managing user accounts and access to digital services (user consent, Art. 6.1.a GDPR).

  • Appointment Form: Scheduling meetings with the practice (legitimate interest, Art. 6.1.f GDPR).

  • Social Media Form: Managing interactions and communication on social platforms (user consent, Art. 6.1.a GDPR).

  • Instant Messaging Form: Scheduling appointments and sending communications (legitimate interest and user consent, Art. 6.1.f and 6.1.a GDPR).
    Managing service provision and online purchases (contractual necessity, Art. 6.1.b GDPR).

  • Video Surveillance Form: Security and access control (legitimate interest, Art. 6.1.f GDPR).

  • Image and Recording Form: Managing photographic or video material for media use (user consent, Art. 6.1.a GDPR).

  • Clients and Suppliers Form: Commercial relations management (legitimate interest, Art. 6.1.f GDPR).

  • Advertising Exclusion Form: Managing users’ choices to opt-out of promotional materials (legal obligation, Art. 6.1.c GDPR).

  • Commercial Advertising Form: Marketing and commercial prospecting (legitimate interest, Art. 6.1.f GDPR).

  • Rights Exercise Form: Responding to requests to exercise GDPR rights (legal obligation, Art. 6.1.c GDPR).

  • Website/App/Platform Users Form: Managing access to corporate digital platforms (legitimate interest, Art. 6.1.f GDPR).

  • Training and Events Form: Managing access to training, workshops, or events (legitimate interest, Art. 6.1.f GDPR).

  • Legal Representatives and Contacts Form: Managing professional contact data (user consent, Art. 6.1.a GDPR).

How Long Do We Keep Your Data?

Your data will be retained only for the time necessary to fulfil the purpose for which it was collected, or for the legally required retention period. Once no longer required, it will be securely deleted or anonymised.

Who Has Access to Your Data?

Your data will not be disclosed to third parties unless necessary for service delivery and bound by confidentiality agreements. Gras Arquitectura, S.L. ensures that all service providers comply with data protection regulations.

Third-Party Data Provided by the User

If you provide data on third parties, you must ensure you have informed them and obtained their consent beforehand. You are fully responsible for the accuracy of the information and the consequences of non-compliance.

International Data Transfers

In compliance with GDPR Article 44, international data transfers are only permitted when sufficient guarantees are provided. If necessary, Gras Arquitectura, S.L. may use service providers with infrastructure outside the EU. For an updated list, contact info@gras-arquitectos.com.

Your Rights

As a data subject, you have the following rights:

  • Withdraw your consent at any time.

  • Access, rectify, erase or transfer your data.

  • Restrict or object to the processing of your data.

  • File a complaint with the Spanish Data Protection Authority (www.aepd.es).

To exercise your rights:

Mandatory or Optional Information

By completing the relevant fields marked with an asterisk (*), you explicitly and freely accept the necessity of providing your data. All other fields are optional. Non-provision of required data may impair service quality.

Security Measures

Gras Arquitectura, S.L. has implemented the necessary technical and organisational measures to ensure personal data is processed lawfully, fairly, and transparently, safeguarding the rights and freedoms of users as outlined in Article 5 of the GDPR.

Validity

This Privacy Policy is effective as of 22/04/2025.

Gras Arquitectura, S.L. reserves the right to modify this policy in response to legal, technical, or operational developments. Any changes affecting user rights will be duly communicated.