Privacy Policy

1. Object

The purpose of this Privacy Policy is to inform individuals (hereinafter, users or interested parties) who visit our website (hereinafter, website, website or the web), how we collect, process and protect the personal data that you decide to provide us by any means (forms, emails, telephone, contracts, etc.) and after reading it, freely decide whether you want us to process them. Additionally, it will serve to expand the information that we have previously provided to interested parties, in the informative clauses provided in the processes of collecting their personal data.

Likewise, this policy aims to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and the free circulation of these data (hereinafter GDPR) and Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights (hereinafter, LOPDGDD).

2. Who is responsible for the processing of your personal data?

 

Identity – Entity:	VALRESA COATINGS, S.A.
Tax ID:	A46030169
Postal Address:	Avda. dels Gremis, s/n. 46190, Riba-roja del Túria (Valencia) Spain.
Telephone:	(+34) 961669560
Email:	[email protected]
Corporate Purpose:	Manufacture and marketing of paints and varnishes
Website:	https://nitorlack.com/
Registration Details:	Commercial Registry of VALENCIA Volume 3226, Book 540, Folio 88, Section 8, Sheet V 7601

3. What personal data will we process and how do we obtain them?

For the development of our business activity, it is essential to process personal data whose collection can be carried out by digital means, (e.g. email, web forms or questionnaires), by completing documents on paper (e.g. contracts or forms) or through face-to-face or telephone conversations and in any of these cases the data will be processed in a fair, lawful and transparent manner.

The categories of data that our entity will process about interested parties are:

• Identification data: name and surnames.
• Contact details: telephone, email, postal address.
• Commercial data: budgets, purchase conditions, management and history of services and/or purchases, result of contacts (telephone, email, messaging and other communication channels).
• Access data: access codes to “my account” for online customers.
• Accounting data: control of income and expenses, billing information.
• Banking data: bank accounts and cards.
• Transaction of goods and services: transfers and direct debits, amounts and concepts.
• Navigation data: analysis of time spent on our website, pages visited, demographic data (e.g. age, sex, language).

Our entity will not collect data of a special category (e.g. health data, ethnic origin, political opinions or religious beliefs), but in the event that it is necessary to process them, it will inform you and request your prior and express consent.

Consequently, the data requested will be adequate, relevant, limited to what is strictly essential and necessary, processed only by the personnel and/or collaborators authorized by our entity, who will have signed a commitment of confidentiality and agree to comply with the necessary security standards that guarantee the confidentiality, integrity and availability of the data processed and other requirements legally established in the GDPR. Therefore, they will be processed within the law.

The data to be processed is provided by the interested party or their legal representative, although it may be the case that we delegate some functions to certain collaborators and they are in charge of collecting your data, but they will always be processed with your prior and express consent.

In the event that an interested party does not provide the data that we request or incomplete or incorrect data is provided, it will not be possible to fulfill and maintain the relationship with them.

The categories of data that we may process about a person will depend on the relationship they have with our entity, as shown below:

Clients:

Identification, contact, commercial, accounting, banking, transaction of goods and services, financial and access data will be processed, and may be collected only if you provide them to us.

Information applicants:

Whether the information requested is by telephone or in writing (e.g. email or web forms) we will request and process your identification, contact and commercial data.

Suppliers:

Identification, contact, commercial, accounting, banking, transaction of goods and services and financial data will be processed. These data may be processed during all stages of the commercial relationship.

Social network users:

We are present in different social networks and we may process identification, contact, commercial data and other data that the user enables to be viewed or shared with other members of the social network, including curriculum data (e.g. LinkedIn). For more information, see our Social Media Policy.

Claimants:

Identification, contact and personal information of your own or of third parties that you want to make known to us related to the claim you send us will be processed.

Web users:

When visiting our website and only if the user expressly authorizes it, analytical data (e.g. visit time or pages viewed) and even demographic data (e.g. sex, age, country or language) may be collected. For more information, visit our Cookies Policy.

More information for interested parties:

The legally established information in the corresponding informative clauses included in the different means of data collection will be made available to interested parties, so that you freely and expressly decide if you want the requested personal data to be processed by our entity.

All categories and types of personal data processed will be duly identified in the corresponding processing activities owned by our entity.

4. For what purposes will your data be processed?

In general, the processing of personal data carried out by our entity aims to fulfill and maintain the relationship with different groups of people, such as clients or suppliers. Also with other people who contact us proactively through our web forms, by telephone or in person, by email or post, as would be the case of job applicants or information applicants, users of our website/blog or social networks and interested parties in general.

Depending on said relationship, the processing of your data is for different purposes and that, by way of illustration and not limitation, we detail below:

Clients:

Your personal data will be processed to identify you, fulfill and maintain the pre-contractual and contractual relationship, including sending commercial communications by different means, responding to queries, carrying out quality controls and commercial statistics, for the provision of our services and/or sale and delivery of goods, for accounting and billing management, the transaction of goods and services, the management of collections, management of incidents, claims and exercise of rights, as well as for other purposes to which we are obliged to comply with said relationship, the laws to which we are subject and to comply with our legitimate interests.

Information applicants:

We will process your personal data to respond to your requests for general information, to identify you, to send information about the goods and/or services of your interest, including in our response (verbal, written or digital) the commercial information related to the request.

Suppliers and collaborators:

Your personal data will be processed for the purpose of maintaining the commercial relationship, whether for requesting quotes, for the purchase of goods or contracting services, to identify you, for accounting management, to carry out transactions of goods and services, as well as for other purposes necessary to comply with said relationship, our legal obligations and legitimate interests.

Social network users:

We will process your personal data to maintain the relationship as users of the same social network, to identify you, to contact you, share news and other personal data that you allow to be viewed or shared with other members of the social network. For more information, see our Social Media Policy.

Claimants:

Personal data will be processed to identify you, manage your claim and contact you about its status, in addition to complying with our legal obligations and legitimate interests.

Web users:

Data may also be processed for different purposes (e.g. analysis of visits) by accepting the installation of cookies when visiting our website. For more information, visit our Cookies Policy.

More information for interested parties:

The legally established information in the corresponding informative clauses included in the different means of data collection (e.g. forms, locutions, contracts, etc.) and in others that we will make available to you (e.g. badges, invoices, legal notices, etc.) will be made available to interested parties, so that you freely and expressly decide if you want the requested personal data to be processed by our entity.

In the event that you do not provide the data that we request or incomplete or incorrect data is provided, it will not be possible to process your request for information or relate to you.

The data will not be processed subsequently or for purposes other than those accepted by the interested parties.

The purposes that motivate the processing of personal data will be duly identified in the corresponding processing activities owned by our entity.

 

5. Why do we process your data (legitimation)?

The processing of your personal data by our entity is carried out with one or more of the following legitimating bases:

1. When you offer us your express, free, informed and unequivocal consent, after being informed at the time of collecting your data and in a more extensive way with this privacy policy, which after reading it and being in accordance, you can voluntarily authorize us to process your data for one or several purposes, by checking the boxes provided for this purpose in our web forms.
2. For the execution of a contract in which you are a party or have requested pre-contractual measures.
3. When the processing is necessary for compliance with a legal obligation applicable to our entity.
4. When the processing is necessary for the satisfaction of legitimate interests pursued by our entity or by a third party, provided that such interests do not prevail over the interests or fundamental rights and freedoms of the interested party. In this regard, we inform that our entity has carried out an analysis weighing our legitimate interests with the rights and freedoms of the interested party, always respecting their fundamental rights.

In the event that the user is under 14 years of age, it will be necessary to have the consent of the parents, guardians or legal representative to process their data. The user is solely responsible for the veracity of the data sent to us.

6. Data retention

The personal data provided will be kept while we maintain the relationship with you and for the time necessary to fulfill the purpose for which your data has been collected.

Once said relationship has ended, we will keep them blocked in those cases where it is necessary to keep them until the expiration of responsibilities for the exclusive purposes of claims or legal actions, as well as to comply with our legal obligations, for example:

Interested	Sectoral scope	Legal basis	Conservation period
· Clients· Suppliers	Accounting	Art. 30.1 R.D. Commercial Code	· 6 years from the last entry
· Clients· Suppliers	Tax	Art. 66 General Tax Law 58/2003	· General term: 4 years· In case of losses during the year: 10 years · Invoices: 5 years

7. Profiling

We do not create profiles or make automated decisions using your personal data, but in the event of doing so, you will be informed and prior authorization will be requested.

Similarly, you have the right to oppose this type of processing at any time by writing to our entity at [email protected].

 

8. Data transfer

As a general rule, our entity does not transfer personal data to third parties without prior consent, although it will be necessary to do so in the following cases:

If you are a client or supplier, your personal data may be transferred to third-party entities due to legal obligation (e.g. Tax Agency), or in those cases and entities necessary to provide our services (e.g. transport companies for the delivery of your orders).

Likewise, your personal data as a client or supplier may be processed by certain suppliers to whom we delegate some of our obligations (e.g. accounting advisors) and all of them have committed, through a data processor contract, to comply with the same security measures implemented by our entity, as well as to submit to the duty of secrecy and confidentiality on the personal data processed, among other obligations regarding the protection of personal data.

If you are an information applicant or user of our website, your data will not be transferred to third-party entities, unless we are legally obliged to do so.

In general terms, we may transfer your personal data to Judges, Courts, the Public Prosecutor’s Office and/or the competent Public Administrations in the event of possible claims when we are obliged to do so.

 

9. International data transfer

In the event of transfers to third-party entities located in countries outside the European Economic Area, we will inform you and request your prior and express consent.

 

10. Security measures

Our entity has implemented all the necessary technical and organizational measures to protect the personal data processed, preventing its loss, theft or unauthorized use.

These measures have been created based on the type of data processed and the purposes that motivate said processing. These are periodically verified in our internal controls for compliance with personal data protection regulations and through external audits.

 

11. Your Rights

You, as the owner of your personal data and acting in your own name or through your legal representative (e.g. people under 14 years of age) may contact our entity at any time and request to exercise your rights regarding the protection of personal data.

We explain what these rights are:

Right of Access:

You have the right to know and request from us at any time the following information:

• If we are processing your personal data or not.
• The purposes of the processing, as well as the categories of personal data being processed.
• The origin of your data, in case you did not provide them to us.
• The recipients or categories of recipients to whom your personal data have been communicated, or will be communicated, including, where appropriate, recipients in third countries or international organizations.
• Information about the appropriate guarantees relating to the transfer of your data to a third country or an international organization, where applicable.
• The expected conservation period, or if not possible, the criteria to determine this period.
• If there are automated decisions, including profiling, significant information about the logic applied, as well as the importance and expected consequences of said processing.
• Copy of your personal data that is being processed.

Right of Rectification:

Request the rectification of your personal data when they are inaccurate, as well as to complete them when they are incomplete.

Right of Opposition:

You can oppose the processing of your data when they are incorrect or their processing is no longer necessary.

In the event that you act as an accused or person affected by a complaint within the framework of Law 2/2023, you may not exercise your right of opposition, since it is presumed (unless proven otherwise) that there are reasons that legitimize the processing of your personal data, in accordance with the provisions of article 31.4 of the Law.

Right of Suppression:

Request that your data be deleted, for any of these reasons:

• Your data is no longer necessary for the purposes for which they were collected or processed.
• You have not given consent for the processing of your data.
• When you have exercised the right of opposition.
• When the data has been processed unlawfully.
• When the data must be deleted to comply with a legal obligation.

 

Right to Limitation of treatment:

You may request to exercise this right when any or several of these assumptions occur:

• When you dispute the accuracy of your data, during a period that allows the controller to verify their accuracy.
• When the processing is unlawful and you oppose the deletion of your data and request the limitation of its use instead.
• When the data are no longer needed for the purposes of the processing, but the interested party needs them for the formulation, exercise or defense of claims.
• When you have opposed the processing pursuant to article 21, paragraph 1, while it is verified if the legitimate reasons of the controller prevail over those of the interested party.

 

Right of Portability:

Refers to the right to obtain the data related to you, in a structured format, of common use and mechanical reading, as well as to transmit them to another controller for further processing.

Right not to be subject to automated decisions:

Right not to be the subject of a decision based solely on automated processing, including profiling, that produces legal effects on him or significantly affects him in a similar way.

To exercise any of your rights, you must write to our entity either by mail to the address: Avda. dels Gremis, s/n. 46190, Riba-roja del Túria (Valencia) Spain. or by email to: [email protected], stating the rights you wish to exercise. If you are acting on behalf of another person, you must prove your representation.

If you wish to make any suggestions or queries about the processing of your personal data, you can contact our data protection consultants, indicating the name of our company or the trade name to:

BUSINESS ADAPTER, S.L.

Ronda Guglielmo Marconi, 11, 26, (Parque Tecnológico) 46980 Paterna (Valencia).

Interested party attention form

We inform you that you have the right to file a claim with the Spanish Agency for Data Protection at: C/ Jorge Juan, 6, 28001 Madrid or at www.aepd.es.

12. Commitment to the protection of personal data

Scope

Our commitment to the protection of personal data will be mandatory for all departments and workers of our entity, as well as those third parties acting on our behalf.

Object

We have established action protocols for the processing of your personal data, in accordance with the provisions of European and Spanish regulations on data protection.

Principles

We will process your data with lawfulness, loyalty, transparency, minimization of data, accuracy, limitation of the conservation period, integrity, confidentiality and active responsibility.

Special category of data

Our entity prohibits the processing of personal data that reveals ethnic or racial origin, political opinions, religious or philosophical beliefs, union affiliation, the processing of genetic or biometric data, data relating to health or data relating to sexual orientation, except in legally authorized exceptions and with the prior consent of the interested party.

Rights of interested parties

Our entity will respond to your requests to exercise your rights as quickly and diligently as possible.

Record of Activities, Impact Assessment and Security Measures

Our entity will carry out a record of the processing activities and analyze the purposes of the processing, categories of interested parties and data, recipients, international transfers, conservation periods, etc., to assess the risks of the processing and implement the necessary security measures to guarantee the confidentiality, integrity and availability of personal data.

Likewise, in each processing activity, the need to prepare an Impact Assessment and determine if there is an obligation to appoint a Data Protection Delegate has been analyzed, establishing, if necessary, that the person designated for this position has sufficient knowledge and experience in accordance with current regulations.

Control

We have external help that advises us on this matter, monitoring all publications made by the competent control bodies and other European and Spanish entities related to data protection regulations, in order to comply with these regulations at all times.

13. Update of this Policy

Our entity reserves the right to modify this Policy without prior notice. That is why we recommend consulting it every time you visit our website.

Text updated on May 15, 2025