Privacy policy applicable to entities and/or professionals contracting with Lutech One Iberia, S.A.U
The company Lutech One Iberia, S.A.U. hereby informs that, for the processing of personal data deriving from the management of the current contractual relationship, it acts as the data controller of your personal data within the meaning of EU Regulation No. 2016/679, hereinafter referred to as the GDPR; therefore, information regarding the processing of personal data concerning them is provided below to data subjects.
If you are (i) a professional contracting with us, or (ii) a representative and/or employee of a company or entity contracting with us, we will process the personal data relating to you within the framework of said contractual relationship and, in general, within the framework of the business and commercial relationship we have either with you (in the case of being a professional contracting with us) or with the entity you represent or work for (in the case of the relationship being with said entity).
Data Controller and Data Protection Officer (DPO)
The data controller is Lutech One Iberia, S.A.U. with registered office at Calle Alcalá, 490, 3rd floor, postal code 28027 Madrid Spain, tax identification number A78696648 (hereinafter the Company or we).
The Company has appointed a personal data protection officer (DPO), who can be contacted at the following email address: dpo@lutech.es.
Purposes of Processing and Legal Bases
The data subject is informed that, for the processing purposes indicated below, their data will be processed both by the Company and by the companies forming part of the Lutech Group, on the basis of the following legitimizing bases.
| Purposes | Legal bases | Typology of personal data |
|---|---|---|
| Manage the contractual relationship established in the contract we have with you or the entity you represent and/or work for | Performance of the contract and prevailing legitimate interest in managing our business effectively | Personal data including identification, representation, company, position held in the company, telephone numbers, exchanged business emails, etc. |
| Establish or maintain commercial relations with you | Prevailing legitimate interest in managing our business effectively | Personal data, including identification, representation, company, position held in the company, telephone numbers, exchanged business emails, etc. |
| Comply with an obligation provided for in law or current regulations (such as those deriving from tax and/or labor matters) | Compliance with a legal obligation, as well as the prevailing legitimate interest in avoiding labor contingencies. | Personal data, including identification, company, position held in the company, telephone numbers, exchanged business emails, as well as salary and social security contributions, reflected in the TC2 forms provided to us by your employer, etc. |
| Operational needs, such as ensuring access to facilities and managing security | Prevailing legitimate interest in ensuring the security of our facilities, workers, and assets. | Personal data, including identification, company, position held in the company, telephone numbers, images captured by video surveillance cameras, exchanged business emails, etc. |
| Undertake service quality improvement processes by sending questionnaires to a contact person | Prevailing legitimate interest in managing our business effectively | Personal data, including identification, company, position held in the company, telephone numbers, exchanged business emails, etc. |
Your data will not be used for automated decision-making or profiling.
Communication of Personal Data
We may communicate your data to the competent Public Administrations and/or judicial bodies when required or enabled by law or necessary and/or convenient for the defense of our legitimate rights (on the legal basis of compliance with a legal obligation and/or the prevailing legitimate interest in exercising the rights that assist us or third parties, as well as, in general, ensuring compliance with the law within the framework of our activities).
Likewise, we may transfer your data to other companies for reasons of corporate reorganization or when a sale of the company occurs, as well as to provide our services in the most effective manner possible (on the basis of the prevailing legitimate interest in ensuring efficient management of the group).
Furthermore, we may share your data with those entities or individuals who provide services to us for which access to such data may be relevant, solely for the purpose of providing those services to us (i.e., acting as mere data processors). These third-party service providers may include, among others: legal and/or financial advisors, accounting advisors, companies supporting our IT systems, and/or any other data processors whose identity will be provided in due course by appropriate means.
International Transfers of Personal Data
All collected data will be processed exclusively within the European Union and/or the European Economic Area for the specified purposes and, only when necessary, will be transferred to countries outside the European Union and/or the European Economic Area after implementing appropriate safeguards to ensure the transfers.
Retention Period of Personal Data
Your personal data will be kept for the time necessary to fulfill the legitimate purposes for which they were collected; that is, even after the termination of the commercial relationship, when necessary for compliance with potential legal obligations related to the conclusion of the contract or that could derive from it, as well as during the limitation periods of any actions in which said data or the documents containing them could be relevant.
As the sole exception to the above, we will keep your identification, contact, and job position or profession data indefinitely until we no longer have an interest in maintaining commercial relations with your company (or until you object to us continuing to process them).
Rights of the Data Subject
The GDPR, in addition to guaranteeing you the right to lodge a complaint with the supervisory authority, which in Spain is the Spanish Data Protection Agency (AEPD), recognizes the following rights to data subjects:
- Right of access: Possibility for the data subject to obtain from the data controller confirmation of whether or not personal data concerning them are being processed and to obtain more information, which includes the purposes of processing, the categories of personal data, and the recipients.
- Right to rectification: Possibility for the data subject to obtain from the data controller the rectification of inaccurate personal data.
- Right to erasure: Possibility for the data subject to request the erasure of personal data concerning them when any of the circumstances provided for in the article occur, including: withdrawal of consent, unlawful processing, and the exercise of the right of defense.
- Right to restriction of processing: Possibility for the data subject to obtain restriction, in the following cases:
- When you contest the accuracy of the data, for a period enabling us to verify its accuracy; or when you have objected to the processing of your personal data that we carry out based on legitimate interest or a task carried out in the public interest, while we verify whether these grounds override yours.
- When you consider that the processing is unlawful and you have opposed the erasure of your data; or when we no longer need your personal data for the purposes of the processing, but you need them for the establishment, exercise, or defense of legal claims.
- Right to data portability: when the processing is based on your consent or on a contract and the processing is carried out by automated means, the data subject has the right to request that their data be communicated to them, in the exercise of their rights, in a structured, commonly used, and machine-readable format and, when technically possible, to transmit your data to the controller you indicate.
- Right to object: Possibility for the data subject to object at any time, when their personal data are subject to processing within the framework of a task carried out in the public interest or based on legitimate interest, including profiling, in which case we will cease to process their data, unless there are compelling grounds that override their interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.
You may also object to the processing when it is for direct marketing purposes, including profiling to the extent that it is related to such direct marketing, in which case we will cease to process your data for these purposes. - Right not to be subject to automated decision-making: Possibility for the data subject to object to being subject to processes based solely on automated processing in the event that these produce legal effects concerning them or significantly affect them.
In case of doubt, clarification, or to exercise your rights, you can address the Company through the email of the data protection officer or at the registered office indicated in the introduction of this Privacy Policy.
19/06/2026