Privacy Policy

1.1 Responsible for the Treatment
The following information is provided to explain the personal data protection commitments of SOSA INGREDIENTS, SLU. with CIF B08932188, whose registered office is located in Colonia Galobart s/n, 08270 Navarcles, Barcelona. Registered in the Mercantile Registry of Barcelona, Volume 23.945, Folio 77, Page 61.693, General Section, Inscription 6, which acts as Responsible for the processing of personal data as described in this document and has been designated as “Data Controller” or “we”.

1.2 Our data protection policy
You can contact us by e-mail at the following address: rgpd@sosa.cat, by post at the following address: Colonia Galobart s/n, 08270 Navarcles, Barcelona, or by telephone at 938 666 111.

 

2. The personal data we process
As part of the processing of personal data, the Controller collects and processes the following data:

• Data sent by form: Name, surname, email, telephone, address, etc.
• Data sent together with the résumé
• Statistics on the opening and clicking of e-mails sent by the Data Controller and statistics on website activity (pages viewed, products viewed, etc.).

3. The purposes and legal bases of our processing of personal data

3.1 The purposes of our processing
The processing we carry out has the following purposes:

• Web site content management;
• Management of marketing and other communications with customers and prospects;
• Customer relationship and complaint management;
• Audience analysis;

• Internal Information System: Processing of personal data for the purpose of managing the internal information system or ethical channel, investigating the facts and proposing resolution measures, preventing regulatory non-compliance and correcting those already detected, as well as contributing to the effective functioning of the Organization through the continuous improvement of internal processes for the management and control of illegal conduct or conduct contrary to the ethical culture of the Organization.

3.2 The legal bases for our processing
We only process personal data if at least one of the following conditions is met:

• Your consent has been obtained;
• We or a third party have a legitimate interest in the intended processing;
• The processing is necessary for the performance of a contract with you;
• We have a legal or regulatory obligation to carry out the intended processing.

3.3. Los intereses legítimos que se persiguen

• Internal Information System: The purpose of the processing is legitimized by a legal obligation: Law 2/2023, of February 20, regulating the protection of persons who report regulatory infringements and the fight against corruption.
• The legitimate interests pursued by the Data Controller may be aimed at enabling the continuation of business activities, improving the consumer experience, fostering consumer loyalty or understanding consumer expectations.

 

4. The recipients of your data
The personal data we currently or subsequently collect is intended for our use as Data Controller. We will ensure that only authorized persons have access to such data. Our subcontractors and service providers may receive such data for the performance of the services we entrust to them. Your personal data may be shared or pooled among all parent or associated companies and subsidiaries of the Data Controller. They may be communicated to these entities for the purposes described in this notice, in accordance with applicable regulatory requirements and in a manner that ensures the protection of your data and civil liberties.

 

5. Transfer of your data
Within the framework of the proposed services, we may transfer your personal data to recipients located in the following countries:

• FRANCE – VALRHONA SAS – 315 allée du bergeron 26600 MERCUROL VEAUNES CEDEX.

Each of these transfers is subject to appropriate legal safeguards. Some of the countries mentioned are covered by adequacy decisions of the European Commission, which means that they offer your personal data a level of protection equivalent to that prevailing in the European Union.

We inform that Sosa Ingredients SLU makes use of the Mailchimp tool for the management of commercial communications, and therefore international transfers are made to the USA. Sosa Ingredients SLU has  the appropriate guarantees to carry out such transfer, under the requirements established by the General Data Protection Regulation.

 

6. Period for which we retain your data
The period or periods for which we retain your data are proportionate to the purposes for which we have collected it. Our retention policy is organized as follows:

• Prospecting: 3 years from your last contact or, if applicable, from the end of our business relationship, extended by any period of legal limitation.
• Relationship with the customer: For contracts entered into, applicable data is retained for the entire period of our business relationship extended by any period of legal limitation.
• Contracts with a value of more than €120: 10 years** (mandatory legal requirement) from the conclusion of the contract
• In case of exercise of the rights of access, rectification, erasure or restriction of processing, data identifying the data subject and allowing the processing of the rights exercised: 1 year from receipt of the request.
• In case of exercise of the right to object to processing, data identifying the data subject and allowing the processing of the right exercised: 6 years from receipt of the request.
• Data will be retained as long as necessary to fulfill the purpose for which they were collected. In any case, after three months from the introduction of the data, they will be deleted from the reporting system, unless the purpose of retention is to provide evidence of the functioning of the prevention model for the commission of crimes by the legal entity. After the mentioned period, the data may continue to be processed by the body responsible for investigating the reported facts, but will not be retained in the internal reporting information system itself.

 

7. Your Rights

7.1 Exercising your rights
You can exercise your rights by e-mail sent to the following address: rgpd@sosa.cat or by post to the following address: Colonia Galobart s/n, 08270 Navarcles, Barcelona.
To do so, you must provide your last name, first name and the address where you wish to receive the reply.
In principle, you may exercise all of your rights free of charge, but you may be required to pay a reasonable fee that reflects the administrative cost of providing you with copies of the data you request.
Regarding the right to information, the Data Controller is not obliged to respond if you request information that it already possesses.
The Data Controller will inform you if he/she is unable to respond.
The aforementioned rights are not absolute and are subject to various conditions based on:

• The law applicable locally to the protection of personal data or privacy; and
• Local legal and regulatory requirements more generally.

• In the recipients of rights, add: The personal data collected may be communicated to the public administration with competence in the matter and to third parties when necessary for the adoption of disciplinary measures or for the processing of judicial procedures that may be applicable.

The Data Controller stresses that failure to provide or modify your data may have consequences for the processing of certain aspects of the execution of our contractual relationship and that your request in exercise of your rights will be kept for 6 years in the case of your right to object and 1 year in the case of your other rights.

All the rights you benefit from are detailed below.

7.2 Your right to information
You acknowledge that this notice informs you about the purposes, the applicable legal framework and the interest of the collection of your personal data, and about the recipients or categories of recipients with whom your personal data is shared, as well as about the possibility of transfer of your data to a third country or international organization. In addition to that information and in order to ensure fair and transparent processing of your data, you confirm that you have received additional information concerning:

• The period of conservation of your personal data;
• The rights you have and how to exercise them.

If we decide to process your data for a purpose other than the one originally stated, we will provide you with full information about that other purpose.

7.3 Your right to access and rectify your data
By exercising this right, you may obtain confirmation that your personal data are (or are not) being processed and, if they are, you may have access to them and to the information relating to them:

• The purposes of processing;
• The categories of personal data in question;
• Recipients or categories of recipients, in particular recipients in third countries;
• Where possible, the period foreseen for the storage of your personal data or, if not possible, the criteria used to determine that period;
• The existence of the right to request from the Data Controller the rectification or erasure of your personal data, or the restriction of the processing of your personal data, or to object to such processing;
• The right to file a complaint with a supervisory authority;
• Where your personal data is not collected directly from you, any available information as to its source;
• The existence of an automated decision-making process, including profiling and, at least in that case, meaningful information about the logic involved, as well as the relevance and expected consequences of that process for the persons concerned.

You may request that your personal information be corrected or supplemented if it is inaccurate, incomplete, misleading or outdated.

7.4 Your right to have your data deleted
You may request deletion of your personal data if:

• The personal data is no longer necessary in relation to the purposes for which it was collected or processed;
• Withdraws consent;
• You object to the processing and there are no legitimate grounds to do so;
• Personal data has been processed in non-compliance with applicable legal and regulatory requirements;
• Personal data was collected when you were a minor.

However, the exercise of this right is not possible if the retention of your personal data reflects a legal or regulatory requirement or is necessary for the establishment, exercise or defense of legal claims.

7.5 Your right to restrict the processing of your data
You may request the restriction of the processing of your personal data in accordance with the applicable legal and regulatory provisions.

7.6 Your right to object to the processing of your data (unsubscription)
You have the right to object to the processing of your personal data, unless such processing is justified by legitimate and compelling reasons on the part of the Data Controller. If we contact you directly, this right may be exercised by any means, which may include, in particular, clicking on the unsubscribe link at the bottom of the message sent.

7.7 Your right to data portability
You have the right to portability of your personal data. The right applies to the following data:

• Only your personal data, i.e. excluding anonymous data or data that does not concern you;
• Personal data reported or associated with your use of goods and services;
• Personal data that does not prejudice the rights and freedoms of third parties (such as data protected by trade secret).

The right is limited to processing based on your consent or a contract and to personal data that you have personally generated. It does not extend to derived or inferred data that is personal data created by the Controller.

7.8 Your right to withdraw your consent
Where processing is based on your consent, you may withdraw your consent at any time, in which case we will no longer process your personal data, but any previous processing to which you have consented will not be affected.

7.9 Your right to file a complaint
You have the right to file a complaint with a supervisory authority without prejudice to your other rights of administrative or legal recourse.

7.10     Automated individual decisions
right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects on him or her or significantly affects him or her in a similar way

7.11     Limitation
right to suspend the processing of the user’s personal data in certain circumstances

 

In any case, you can request the protection of the Spanish Data Protection Agency through its website: https://www.aepd.es/es.