Privacy policy

1. Who is the Data Controller?

Data Controller: Antonio Morón de Blas SL (hereinafter Grupo Morón). Tax Identification Number (NIF): B26238634, Postal Address: Polígono Raposal parcela 38-45, 26580 - ARNEDO (La Rioja), SPAIN, Telephone: +34 941 385 560 and Email: protecciondedatos@grupomoron.com.

In accordance with GDPR (EU) 2016/679, we inform you that the personal data you provide through this website will be processed in accordance with the applicable regulations governing the protection of personal data in the European Union and Spain.

At the time data is collected, the voluntary or mandatory nature of the data requested will be indicated. Refusal to provide data classified as mandatory will result in the non-provision of, or inability to access, the service for which such data was requested. Likewise, data may be provided voluntarily in order to enable the products and/or services offered to be provided in a more optimal manner.

We may process identification data, contact details, professional data and any other information that you voluntarily provide through forms or communications maintained with our organisation.

The data provided by the user must be accurate and truthfully reflect the current situation of the data subject. The user entering the data is solely and ultimately responsible for the accuracy of the information provided through our website.

2. For what purposes do we process the personal data you provide?

The main purposes of processing your personal data are as follows:

• We process the data you provide through our website in order to contact you and respond to your request (information sent to data subjects shall not be considered commercial communication provided that its purpose is to maintain the existing relationship between the user and our organisation).
• When you request a product and/or service from us, we process the data you provide for the provision of the requested product and/or service and for its administrative and accounting management, and when you request a product or service, we process your data to manage such request, the contractual relationship and compliance with the legal obligations arising therefrom.
• If you have given your consent or if a previous contractual relationship exists, we may send you commercial information related to similar products or services.

3. What is the legal basis for processing personal data?

• Responding to enquiries, requests for information or requests submitted through our contact forms, email or telephone. Legal basis: implementation of pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR).
• Managing the commercial, contractual or service relationship requested. Legal basis: performance of a contract or implementation of pre-contractual measures (Art. 6.1.b GDPR).
• Managing administrative, accounting, tax and legal obligations arising from the commercial relationship. Legal basis: compliance with legal obligations applicable to the Data Controller (Art. 6.1.c GDPR).
• Sending information about products or services similar to those contracted or requested by our customers. Legal basis: the legitimate interest of the Data Controller pursuant to Article 21.2 of the Spanish Information Society Services and Electronic Commerce Act (LSSI-CE) and Article 6.1.f of the GDPR.
• Sending commercial communications regarding products, services, news or activities where no prior contractual relationship exists. Legal basis: the explicit consent of the data subject (Art. 6.1.a GDPR).

4. How long will we retain personal data?

Data obtained through contact forms will be retained for the time necessary to respond to the enquiry and, subsequently, for the legally required periods in order to deal with any potential liabilities.

Accounting and tax documentation for commercial purposes shall be retained for a period of six (6) years and, for the purposes of Anti-Money Laundering legislation, for a period of ten (10) years.

No automated decision-making or profiling is envisaged.

5. To whom may we disclose your data?

• To service providers acting as Data Processors.
• To Public Administrations: for compliance with legal obligations while the service relationship remains in force.
• To the banking institution: we use SEPA direct debit or bank domiciliation in order to collect payment for services provided. This process is carried out through a secure banking platform containing your data.

6. Who are our Data Processors?

In order to provide you with an appropriate service and manage the contractual relationship, we have engaged the following categories of Data Processors who will process your data on our behalf: accounting and tax advisory services, labour advisory services, auditing and consultancy services, administrative services, printing and mailing services, physical security services, legal services, IT consultancy services, data processing services, security and cybersecurity services, hosting services, backup services, and other business support activities. Place of service provision: Spain and, in some cases, the European Union. Providers acting as Data Processors will only access the data for the provision of the contracted services and under the corresponding legal safeguards.

7. What are your rights?

You have the right to obtain information as to whether Grupo Morón is processing your personal data (right of access), to request the rectification of inaccurate data (right to rectification) or its erasure when the data is no longer necessary for the performance of the contract (right to erasure), to request, under certain circumstances, the restriction of its processing (right to restriction of processing), to receive the personal data concerning you that you have provided or to request that we send it to another Data Controller of your choice in a structured, commonly used and machine-readable format (right to data portability), as well as to withdraw at any time the consent granted to receive information of interest by any means (right to object).

You may exercise your rights by writing to the postal or electronic address of the Data Controller, in accordance with Articles 15 to 22 of GDPR 2016/679. To exercise your rights, please attach a copy of your national identity document or equivalent document proving your identity.

If you consider that the processing of your data infringes the applicable personal data protection regulations, you may lodge a complaint with the competent Supervisory Authority, which in Spain is the Spanish Data Protection Agency.

8. Availability of the Data Protection Policy

This Privacy Policy remains permanently accessible through the website so that users may consult it at any time before providing their personal data.

Last review: 4 July 2026.