1. Purpose
This Privacy Policy aims to inform individuals (hereinafter, users or interested parties) who visit our website (hereinafter, website, site, or the web) about how we collect, process, and protect the personal data they choose to provide us through any means (forms, emails, telephone, contracts, etc.), and to allow them, after reading it, to freely decide whether they wish us to process their data. Additionally, it will serve to expand upon the information we have previously provided to interested parties in the information clauses included in the processes for collecting their personal data.
Furthermore, this policy aims to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter GDPR) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD).
2. Who is responsible for processing your personal data?
Basic information on data protection:
Responsible: CELLER LA MUNTANYA, S.L.
Address: Ctra. Setla CV-705 km. 1, 03839 Setla de Nunyes, Muro de Alcoi (Alicante)
Purpose: To attend to, register and contact you to resolve the request you make through this contact form.
Legitimation: With your consent, by checking the boxes provided in this form.
Recipients: Your data will not be shared with third parties.
Rights: You can exercise your rights of access, rectification, erasure, objection, limitation and revocation at: admin@cellerlamuntanya.com
More info: You can find more information in our Privacy Policy
3. Why will we process your data (legitimacy)?
The processing of your personal data by our entity will be carried out with one or more of the following legitimizing bases:
Article 6.1 a) GDPR: the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
Article 6.1 b) GDPR: For the performance of a contract to which you are a party or to which you have requested pre-contractual measures from us.
Article 6.1 c) GDPR: When processing is necessary for compliance with a legal obligation applicable to our entity.
Article 6.1 f) GDPR: When processing is necessary for the purposes of the legitimate interests pursued by our entity or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
In this regard, we inform you that our organization has conducted an analysis weighing our legitimate interests against the rights and freedoms of the data subject, always respecting their fundamental rights. This does not apply to processing carried out by public authorities in the exercise of their functions. If the user is under 14 years of age, we will need the consent of their parents, guardians, or legal representative to process their data. The user is solely responsible for the accuracy of the data they submit to us.
4. What personal data will we process and how do we obtain it?
For the development of our business activity, it is essential to process personal data, which can be collected digitally, through paper documents or as a result of face-to-face or telephone conversations, and in any of these cases the data will be processed fairly, lawfully and transparently.
The categories of data that our organization will process about data subjects are:
• Identifying data: name and surname, national identity document or equivalent, image, voice and signature.
• Contact information: telephone, email, postal address.
• Commercial data: budgets, purchase conditions, management and history of services and/or purchases, results of contacts (telephone, email, messaging and other communication channels).
• Accounting data: control of income and expenses, billing data.
• Bank details: bank accounts and cards.
• Curriculum data: academic data, professional experience, personal characteristics, etc.
• Transaction of goods and services: bank transfers and direct debits, amounts and concepts.
• Browsing data: analysis of time spent on our website, pages visited, demographic data (e.g. age, gender, language).
Our organization will not collect special category data (e.g., health data, ethnic origin, political opinions or religious beliefs), but if it becomes necessary to process them, we will inform you and request your prior and express consent.
Consequently, the requested data will be adequate, relevant, limited to what is strictly necessary, and processed only by personnel and/or collaborators authorized by our organization, who will have signed a confidentiality agreement and undertake to comply with the necessary security measures that guarantee the confidentiality, integrity, and availability of the processed data, as well as other legal requirements established in the GDPR. Therefore, the data will be processed lawfully.
The data to be processed is provided by the interested party or their legal representative, although it may be the case that we delegate some functions to certain collaborators and they are in charge of collecting your data, but they will always be processed with your prior and express consent.
If an interested party does not provide the requested data or provides incomplete or incorrect data, it will not be possible to fulfill and maintain the relationship with them.
The categories of data we may process about a person will depend on their relationship with our organization, as shown below:
4.1. Customers:
Identification, contact, commercial, accounting, banking, and transaction data related to goods and services will be processed and may only be collected if the customer provides it to us at the time of purchase, when requesting pre-contractual measures, or during the course of the relationship between the parties. Data may be collected in person, by telephone, email, or through forms available on our website, online chat, instant messaging, etc.
Legal basis: Article 6.1 a); 6.1 b); 6.1 c); 6.1 f); GDPR
4.2. Information Requesters:
Whether the information is requested in person, by telephone, or in writing (e.g., email or web forms), we will request and process your identification, contact, and business data.
Legal basis: Article 6.1 a); 6.1 f); GDPR
4.3. Suppliers:
Identification, contact, commercial, accounting, banking, goods and services transaction, and financial data will be processed. This data may be processed during all stages of the business relationship and only if the supplier provides it to initiate said relationship.
Legal basis: Article 6.1 a); 6.1 b); 6.1 c); 6.1 f) GDPR
4.4. Job Applicants:
For this category of interested parties, curriculum vitae, identification, contact and other data related to their professional or personal characteristics will be processed, which will be provided by the applicant himself when he submits his application to us.
Data collection may be carried out in person, via email, through web forms, during recruitment interviews (in person or remotely), and even through a collaborator to whom we have delegated certain functions.
Legal basis: Article 6.1 a); 6.1 b); 6.1 f) GDPR
4.5. Usuarios de redes sociales:
Estamos presentes en diferentes redes sociales y podremos tratar datos identificativos, de contacto, comerciales y otros datos que el usuario habilite para que sean visualizados o compartidos con el resto de usuarios de la red social, incluso datos curriculares (ej. LinkedIn). Para más información consulte nuestra Política de redes sociales.
Base legitimadora: Articulo 6.1 f) RGPD
4.6. Subscribers:
Our newsletter subscription forms request an email address, which can be provided voluntarily by the interested party.
Legal basis: Article 6.1 a) GDPR
4.7. Complainants:
We will process identifying data, contact information, and personal information belonging to the complainant or third parties that they provide.
Legal basis: Article 6.1 a); 6.1 c); 6.1 f) GDPR
4.8. Visitors:
Identification data, contact information, company affiliation, and reason for visit will be processed. This data will be collected when provided by the visitor upon requesting access to our facilities or when provided by their contact person within our organization to grant them access.
Legal basis: Article 6.1 c); 6.1 f) GDPR
4.9. Website Users: When visiting our website, and only with the user’s express consent, analytical data (e.g., visit duration or pages viewed) and even demographic data (e.g., gender, age, country, or language) may be collected. For more information, please see our Cookie Policy.
Legal basis: Article 6.1 a) GDPR
4.10. Further information for data subjects: Data subjects will be provided with the legally required information in the corresponding information clauses included in the various data collection methods, so that they can freely and expressly decide whether they wish their personal data to be processed by our organization. For more detailed information, please refer to these clauses for details on how to access this policy.
All categories and types of personal data processed will be duly identified in the corresponding processing activities under the responsibility of our organization.
5. What will your data be used for?
In general, the processing of personal data carried out by our organization is for the purpose of fulfilling and maintaining our relationship with the various groups of people with whom we interact. Depending on this relationship, the processing of your data serves different purposes, which, by way of example and not limitation, are detailed below:
5.1. Clients:
Your personal data will be processed to identify you, fulfill and maintain the pre-contractual and contractual relationship, including sending commercial communications through different means, responding to inquiries, carrying out quality controls and commercial statistics, for the sale and delivery of goods, for accounting and billing management, the transaction of goods and services, collection management, incident management, claims and exercise of rights, as well as for other purposes to which we are obliged to comply with said relationship, the laws to which we are subject or to attend to our legitimate interests.
5.2. Information Requests:
We will process your personal data to respond to any information requests you may submit, to identify you, and to send or deliver quotes and information about goods and/or services of interest to you, including in our response (verbal or written) commercial information related to your request. We will also make follow-up contacts, through various means, to learn about the decisions made regarding the commercial proposals we have sent you.
5.3. Job Applicants:
Your data will be processed to include you in our selection processes and job bank, to identify you, as well as to contact you and inform you about vacancies, coordinate interviews and other matters related to your application.
5.4. Proveedores:
Se tratarán sus datos personales con la finalidad de mantener la relación precontractual y contractual, cumplir la relación comercial ya sea para la solicitud de presupuestos, para la compra de bienes o contratación de servicios, para realizar consultas e identificarle, para la gestión contable y la transacción de bienes y servicios, así como para otros fines necesarios para cumplir con dicha relación, con nuestras
obligaciones legales e intereses legítimos.
5.5. Social Media Users: We will process your personal data to maintain our relationship as users of the same social network, to identify you, to contact you, to share news or advertising, and to process other personal data that you, as a social media user, allow us to share with other members of the network. For more information, please see our Social Media Policy.
5.6. Subscribers:
Your data will be processed to send you our newsletters or advertising by email, to identify you, and to process your subscription or unsubscription to these mailings when you request it.
5.7. Claimants:
Personal data will be processed to identify you, manage your claim and contact you about its status, in addition to complying with our legal obligations and legitimate interests.
5.8. Visitors:
Data from visits to our facilities will be processed to identify you, to comply with our obligations regarding occupational risk prevention and for security and access control purposes.
5.9. Website Users: By accepting the installation of cookies when visiting our website, data may be processed for different purposes (e.g., website traffic analysis). For more information, please visit our
5.10. Further information for interested parties:
The legally established information will be made available to interested parties in the corresponding information clauses included in the different means of data collection (e.g., forms, recorded messages, contracts, etc.) so that you can freely and expressly decide whether you want the requested personal data to be processed by our entity. In this same sense, this information will be reiterated in the different documents or communications that we share with interested parties (e.g., badges, invoices, legal notices, etc.).
If the interested party does not provide the requested data or provides incomplete or incorrect data, we may not be able to process their request for information or interact with them.
The data will not be processed further or for purposes other than those accepted by the interested parties.
The purposes that motivate the processing of personal data will be duly identified in the corresponding processing activities owned by our entity.
6. Data Retention
The personal data provided will be retained for as long as we maintain a relationship with the data subject and for the time necessary to fulfill the purpose for which the data was collected.
Once this relationship has ended, we will keep the data blocked in those cases where it is necessary to retain it, either until the statute of limitations expires for the sole purpose of claims or legal actions, as well as to comply with our legal obligations, for example:
When the data is no longer needed, our organization will proceed to its deletion and destruction in a secure and confidential manner.
7. Profiling
We do not create profiles or make automated decisions using your personal data, but if we were to do so, we would inform you and request your prior consent.
Likewise, you have the right to object to this type of processing at any time by contacting us in writing at: info@cellerlamuntanya.com
8. Data Transfer
As a general rule, our organization does not transfer personal data to third parties without prior consent. However, it will be necessary to transfer data in the following cases:
In the case of our clients or suppliers, their personal data may be transferred to third-party entities due to legal obligation (e.g., the Tax Agency), or in those cases and entities necessary to provide our services or pay invoices (e.g., banks). In the case of goods delivery, their data may be transferred to transport companies that collaborate with our organization.
Likewise, the personal data of clients or suppliers may be processed by third parties to whom we delegate some of our obligations (e.g., accounting advisors) and all of them have committed through a data processing agreement to comply with the same security measures implemented by our entity, as well as to submit to the duty of secrecy and confidentiality regarding the personal data processed, among other obligations in the area of personal data protection.
In the case of job applicants, your data will not be shared with third parties unless we are legally obligated to do so. Regarding those requesting information or using our website, your data will not be shared with third parties, except in the cases previously outlined and communicated to you at the time of collection, and only with your explicit consent, unless our legitimate interest prevails or we are legally obligated to do so, in which case your consent will not be required. Generally speaking, we may share your personal data with Judges, Courts, the Public Prosecutor’s Office, and/or the competent Public Administrations in the event of potential claims when we are legally required to do so.
9. International data transfer
In the event of transfers to third-party entities located in countries outside the European Economic Area, we will inform and request the prior and express consent of the interested parties.
10. Security Measures
Our organization has implemented all necessary technical and organizational measures to protect the personal data processed, preventing its loss, theft, or unauthorized use.
These measures have been designed based on the type of data processed and the purposes for which it is processed. They are periodically verified through our internal controls for compliance with personal data protection regulations and through external audits.
11. Your Rights
As the data subject, acting on your own behalf or through a representative, you may contact our organization at any time to request the exercise of your personal data protection rights.
We explain these rights below:
11.1. Right of Access:
You have the right to know and request from us at any time the following information:
• Whether or not we are processing your personal data.
• The purposes of the processing, as well as the categories of personal data that are processed.
• The origin of your data, in case you did not provide it to us.
• The recipients or categories of recipients to whom my personal data has been, or will be, disclosed, including, where applicable, recipients in third parties or international organizations.
• Information on the appropriate safeguards regarding the transfer of my data to a third country or an international organization, if applicable.
• The expected retention period, or if that is not possible, the criteria for determining that period.
• If automated decisions exist, including profiling, meaningful information about the logic applied, as well as the significance and intended consequences of such processing.
• Copy of your personal data that is being processed.
11.2. Right of Rectification:
Request us to rectify your personal data when it is inaccurate, as well as to complete it when it is incomplete.
11.3. Right to Object:
You may object to the processing of your data when it is incorrect or its processing is no longer necessary.
If you are acting as the accused or a person affected by a complaint under Law 2/2023, you will not be able to exercise your right to object, since it is presumed (unless proven otherwise) that there are grounds that legitimize the processing of your personal data, in accordance with the provisions of Article 31.4 of the Law.
11.4. Right to Erasure: You may request that your data be erased for any of the following reasons:
• Your data is no longer necessary for the purposes for which it was collected or processed.
• You have not given your consent for the processing of your data.
• You have exercised your right to object.
• The data has been unlawfully processed.
• The data must be erased to comply with a legal obligation.
11.5. Right to Restriction of Processing: You may request to exercise this right when one or more of the following circumstances apply:
• When you contest the accuracy of your data, for a period enabling the controller to verify its accuracy.
• When the processing is unlawful and you oppose the erasure of your data and request the restriction of its use instead.
• When the data are no longer needed for the purposes of the processing, but are required by the data subject for the establishment, exercise, or defense of legal claims.
• When you have objected to processing pursuant to Article 21(1), pending the verification of whether the legitimate grounds of the controller override those of the data subject.
11.6. Right to Portability:
This refers to the right to obtain your personal data in a structured, commonly used and machine-readable format, and to transmit it to another data controller for further processing.
11.7. Right not to be subject to automated decisions: Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
11.8. How to Exercise Your Rights
To exercise any of your rights, you must submit a written request to CELLER LA MUNTANYA, S.L., either by mail to the following address: Ctra. Setla CV-705 km. 1, 03839 Setla de Nunyes, Muro de Alcoi (Alicante), Spain, or by email to info@cellerlamuntanya.com, specifying the rights you wish to exercise. If you are acting on behalf of another person, you must provide proof of representation. If there are reasonable doubts regarding the identity of the person making the request, we may request additional information to confirm their identity.
If you wish to submit any suggestions or queries regarding the processing of your personal data, you can contact our data protection consultants: BUSINESS ADAPTER, S.L.
Ronda Guglielmo Marconi, 11, 26, (Technology Park) 46980 Paterna (Valencia, Spain).
Customer service form
We inform you that you have the right to file a complaint with the Spanish Data Protection Agency at: C/ Jorge Juan, 6,
28001 Madrid or at www.aepd.es.
12. Commitment to the Protection of Personal Data
Purpose and Scope
This commitment aims to comply with European and Spanish regulations on data protection and guarantee of digital rights (GDPR and LOPDGDD) and will be mandatory for all departments and employees of our entity, as well as for third parties acting on our behalf.
Principles governing the processing of personal data
We will process personal data lawfully, fairly, transparently, with data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. The processing of special categories of data is prohibited, as provided for in Article 9 of the GDPR and the LOPDGDD.
Record of Processing Activities
Our organization will maintain a record of processing activities to assess the risks of processing and implement the necessary security measures to guarantee the confidentiality, integrity, availability and retention period of the data.
Impact Assessment
In each processing activity, the need to prepare an Impact Assessment is analyzed to determine if there is a risk to the rights and freedoms of the data subjects, in order to determine if it is necessary to apply additional technical and organizational measures to guarantee their fundamental rights.
Security measures and security breaches
All necessary technical and organizational measures will be implemented for the personal data processed. In the event of a security breach, the Security Breach Response Protocol, designed for this purpose, will be applied.
Data protection rights
Our organization will address and respond as quickly and diligently as possible to requests to exercise your rights or to information regarding their violation.
Guarantee of Digital Rights in the Workplace
Policies will be adopted to guarantee the digital rights of employees, and they will be duly informed accordingly. These policies will promote the right to reconcile work, personal, and family life, and will also guarantee the right to information and privacy. Our organization may exercise control over the performance of work duties, within the limits established in Article 20.3 of the Workers’ Statute.
Training
All necessary employees will be trained, both in data protection and on their digital rights in the workplace.
Control
We have external consultants who advise and audit us, in order to comply with the GDPR and the LOPDGDD.
13. Policy Updates
Our organization reserves the right to modify this Policy without prior notice. Therefore, we recommend that you consult it each time you visit our website.
Text updated on December 3, 2025.