Privacy Policy

1.1 Data Controller
The following information is provided to explain the personal data protection commitments of SOSA INGREDIENTS, SLU, with Tax Identification Number (CIF) B08932188, whose registered office is located at Colonia Galobart s/n, 08270 Navarcles, Barcelona. Registered in the Mercantile Registry of Barcelona, Volume 23,945, Folio 77, Page 61,693, General Section, Entry 6, which acts as the Data Controller for the processing of personal data as described in this document and which has been designated as “Data Controller” or “we”.

1.2 Our data protection policy
You can contact us by e-mail at the following address: rgpd@sosa.cat, by post at the following address: Colonia Galobart s/n, 08270 Navarcles, Barcelona, or by telephone at 938 666 111.

2. The personal data we process
As part of the processing of personal data, the Controller collects and processes the following data:

  • Data submitted via form: Name, surname, email, telephone, address.
  • Information submitted along with the resume.
  • Statistics on the opening and clicking of e-mails sent by the Data Controller and statistics on website activity (pages viewed, products viewed, etc.).

3. The purposes and legal bases of our processing of personal data

3.1 The purposes of our processing
The processing we carry out has the following purposes:

  • Web site content management;
  • Management of marketing and other communications with customers and prospects;
  • Customer relationship and complaint management;
  • Audience analysis;
  • Internal information system: Processing of personal data for the purpose of managing the internal information system or ethics channel, investigating the facts and proposing solutions, preventing regulatory non-compliance and correcting those already detected, as well as contributing to the efficiency of the Organization’s operation with the continuous improvement of internal processes for the management and control of illegal conduct or conduct contrary to the ethical culture of the Organization.

3.2 The legal bases for our processing
We only process personal data if at least one of the following conditions is met:

  • Your consent has been obtained;
  • We or a third party have a legitimate interest in the intended processing;
  • The processing is necessary for the performance of a contract with you;
  • We have a legal or regulatory obligation to carry out the intended processing.

3.3. The legitimate interests being pursued

  • Internal information system: The purpose of the processing is legitimized by a legal obligation: Law 2/2023, of February 20, regulating the protection of persons who report regulatory infringements and the fight against corruption.
  • The legitimate interests pursued by the Data Controller may be aimed at enabling the continuation of business activities, improving the consumer experience, fostering consumer loyalty or understanding consumer expectations.

4. The recipients of your data
The personal data we currently or subsequently collect is intended for our use as Data Controller. We will ensure that only authorized persons have access to such data. Our subcontractors and service providers may receive such data for the performance of the services we entrust to them. Your personal data may be shared or pooled among all parent or associated companies and subsidiaries of the Data Controller. They may be communicated to these entities for the purposes described in this notice, in accordance with applicable regulatory requirements and in a manner that ensures the protection of your data and civil liberties.

5. Transfer of your data

Within the framework of the proposed services, we may transfer your personal data to recipients located in the following countries:

  • FRANCE – VALRHONA SAS – 315 allée du bergeron 26600 MERCUROL VEAUNES CEDEX.

Each of these transfers is subject to appropriate legal safeguards. Some of the countries mentioned are covered by adequacy decisions of the European Commission, which means that they offer your personal data a level of protection equivalent to that prevailing in the European Union.

  • For the management and delivery of orders, we may communicate your data (including name, address, telephone, and email) to transport companies in order to facilitate the shipment and provide tracking information.
  • We inform you that Sosa Ingredients SLU uses the MAILJET tool for the management of commercial communications, and therefore international transfers are made to the USA. Sosa Ingredients SLU has adequate guarantees to carry out said transfer, by virtue of the requirements established by the General Data Protection Regulation.

6. Period for which we retain your data
The period or periods for which we retain your data are proportionate to the purposes for which we have collected it. Our retention policy is organized as follows:

  • Prospecting: 3 years from your last contact or, if applicable, from the end of our business relationship, extended by any period of legal limitation.
  • Relationship with the customer: For contracts entered into, applicable data is retained for the entire period of our business relationship extended by any period of legal limitation.
  • Contracts with a value greater than €120: 10 years** (mandatory legal requirement) from the conclusion of the contract.
  • In the event of exercising the rights of access, rectification, erasure or restriction of processing, the data that identifies the interested party and allows the processing of the rights exercised: 1 year from receipt of the request.
  • In the event of exercising the right to object to the processing, the data that identifies the interested party and allows the processing of the right exercised: 6 years from the receipt of the request.
  • The data will be retained as long as necessary to fulfill the purpose for which it was collected. In any case, three months after the data is entered, it will be deleted from the reporting system, unless the purpose of retention is to provide evidence of the functioning of the legal entity’s crime prevention model. After the aforementioned period, the data may continue to be processed by the body responsible for investigating the reported incidents, but will not be stored in the internal reporting system itself.

7. Your Rights

7.1 Exercising your rights
You can exercise your rights by e-mail sent to the following address: rgpd@sosa.cat or by post to the following address: Colonia Galobart s/n, 08270 Navarcles, Barcelona.
To do so, you must provide your last name, first name and the address where you wish to receive the reply.
In principle, you may exercise all of your rights free of charge, but you may be required to pay a reasonable fee that reflects the administrative cost of providing you with copies of the data you request.
Regarding the right to information, the Data Controller is not obliged to respond if you request information that it already possesses.
The Data Controller will inform you if he/she is unable to respond.
The aforementioned rights are not absolute and are subject to various conditions based on:

  • The law applicable locally to the protection of personal data or privacy; and
  • Local legal and regulatory requirements more generally.
  • The personal data collected may be communicated to the public administration with competence in the matter and to third parties when necessary for the adoption of disciplinary measures or for the processing of judicial proceedings that may be appropriate.

The Data Controller stresses that failure to provide or modify your data may have consequences for the processing of certain aspects of the execution of our contractual relationship and that your request in exercise of your rights will be kept for 6 years in the case of your right to object and 1 year in the case of your other rights.

All the rights you benefit from are detailed below.

7.2 Your right to information
You acknowledge that this notice informs you about the purposes, the applicable legal framework and the interest of the collection of your personal data, and about the recipients or categories of recipients with whom your personal data is shared, as well as about the possibility of transfer of your data to a third country or international organization. In addition to that information and in order to ensure fair and transparent processing of your data, you confirm that you have received additional information concerning:

  • The period of conservation of your personal data;
  • The rights you have and how to exercise them.

If we decide to process your data for a purpose other than the one originally stated, we will provide you with full information about that other purpose.

7.3 Your right to access and rectify your data
By exercising this right, you may obtain confirmation that your personal data are (or are not) being processed and, if they are, you may have access to them and to the information relating to them:

  • The purposes of processing;
  • The categories of personal data in question;
  • Recipients or categories of recipients, in particular recipients in third countries;
  • Where possible, the period foreseen for the storage of your personal data or, if not possible, the criteria used to determine that period;
  • The existence of the right to request from the Data Controller the rectification or erasure of your personal data, or the restriction of the processing of your personal data, or to object to such processing;
  • The right to file a complaint with a supervisory authority;
  • Where your personal data is not collected directly from you, any available information as to its source;
  • The existence of an automated decision-making process, including profiling and, at least in that case, meaningful information about the logic involved, as well as the relevance and expected consequences of that process for the persons concerned.

You may request that your personal information be corrected or supplemented if it is inaccurate, incomplete, misleading or outdated.

7.4 Your right to have your data deleted
You may request deletion of your personal data if:

  • The personal data is no longer necessary in relation to the purposes for which it was collected or processed;
  • Withdraws consent;
  • You object to the processing and there are no legitimate grounds to do so;
  • Personal data has been processed in non-compliance with applicable legal and regulatory requirements;
  • Personal data was collected when you were a minor.

However, the exercise of this right is not possible if the retention of your personal data reflects a legal or regulatory requirement or is necessary for the establishment, exercise or defense of legal claims.

7.5 Your right to restrict the processing of your data
You may request the restriction of the processing of your personal data in accordance with the applicable legal and regulatory provisions.

7.6 Your right to object to the processing of your data (unsubscription)
You have the right to object to the processing of your personal data, unless such processing is justified by legitimate and compelling reasons on the part of the Data Controller. If we contact you directly, this right may be exercised by any means, which may include, in particular, clicking on the unsubscribe link at the bottom of the message sent.

7.7 Your right to data portability
You have the right to portability of your personal data. The right applies to the following data:

  • Only your personal data, i.e. excluding anonymous data or data that does not concern you;
  • Personal data reported or associated with your use of goods and services;
  • Personal data that does not prejudice the rights and freedoms of third parties (such as data protected by trade secret).

The right is limited to processing based on your consent or a contract and to personal data that you have personally generated. It does not extend to derived or inferred data that is personal data created by the Controller.

7.8 Your right to withdraw your consent
Where processing is based on your consent, you may withdraw your consent at any time, in which case we will no longer process your personal data, but any previous processing to which you have consented will not be affected.

7.9 Your right to file a complaint
You have the right to file a complaint with a supervisory authority without prejudice to your other rights of administrative or legal recourse.

7.10 Automated individual decisions
right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her

7.11 Limitation
right to suspend the processing of the user’s personal data in certain circumstances

In any case, you can request the protection of the Spanish Data Protection Agency through its website: https://www.aepd.es/es.

Products
Products
938 666 094 sosa@sosa.cat