PRIVACY POLICY
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and with Spanish data protection legislation, Law 3/2018, of 5 December, on the protection of personal data and the guarantee of digital rights, as well as Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSICE), XTERNA SOLUCIONES EN OUTSOURCING, SL (hereinafter, XTERNA) informs you of the processing of personal data in accordance with this Privacy Policy.
XTERNA makes this document available to users in order to inform them of the Privacy Policy adopted regarding data protection.
Anyone who accesses this website assumes the role of user, undertaking to strictly observe and comply with the provisions set out herein, as well as with any other legal provision that may apply.
The provision of XTERNA’s professional services necessarily entails the processing of its clients’ personal data. XTERNA also needs to have your personal data for commercial communication actions with regard to its contacts, when you are interested in our professional services, courses, training activities, etc.
IDENTIFICATION OF THE CONTROLLER
XTERNA SOLUCIONES EN OUTSOURCING, SL
Tax ID (CIF) B-61054847
Registered office: Rda. de Sant Pere 52, 5th floor, ATICCO Building, 08010 Barcelona
Tel. +34 93 445 46 47
Email: rgpd@xterna.es.
Registered in the Barcelona Commercial Registry: Volume 31739, Folio 60, Sheet B-143752
PURPOSE OF THE COLLECTION AND PROCESSING OF PERSONAL DATA
Our clients’ personal data will be processed for the development and performance of the services requested and/or contracted, which includes:
∙ Properly preparing the service proposal requested.
∙ Managing the contracting of the services requested and the corresponding invoicing.
∙ Maintaining contact in order to obtain or provide information about the contracted services and/or any changes to them.
∙ Complying with the contractual and commercial obligations undertaken and with all legal obligations that XTERNA must fulfil.
∙ Finding out the level of satisfaction with the services received.
∙ Sending electronic communications regarding activities, news, events and updates from the firm that may be of interest to you, in accordance with the nature of the service contracted and provided that you do not state your wish not to receive them under the terms permitted by Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce.
In the case of use of the Internal Information System (Whistleblowing Channel) (IIS), the purpose of the processing will be to handle the report or an enquiry relating to legal breaches, unlawful acts against the group or its main stakeholders (employees, collaborators, clients or suppliers), unethical conduct and/or conflicts of interest of individuals, manipulation or falsification of documentation, among others, through the form included for that purpose on the page.
TYPES OF PERSONAL DATA THAT WILL BE PROCESSED
∙ Identification and contact data: first name, surname, tax ID (NIF), telephone number, postal address or email address.
∙ Commercial information data, according to the instructions received.
∙ Data strictly necessary for the provision of the service you have contracted with XTERNA, whether labour, tax or accounting related.
No specially protected categories of data are processed.
The personal data that will be processed will be the personal data that the user has provided to XTERNA when completing the contact form or by any other means (Chat, WhatsApp, telephone, email).
In the case of use of social networks, the policy provided for therein will apply. If user data is collected through a social network, the applicable Privacy Policy will be that of the specific social network.
The services, access to content and offer of products on the Website are exclusively aimed at persons over 18 years of age, so that, when you access or use the Website and/or provide us with your personal data, you declare that you are of that age, being aware of the prohibition on using the Website if you are a minor.
This website prohibits the entry and communication of personal data of minors and, should such data have been provided by the user or by minors, it will be deleted if the Controller becomes aware of such irregularity.
Likewise, the user expressly exonerates XTERNA from any possible claim arising from this fact, the user who sent the information assuming full liability that may result from any claim.
ACCURACY OF THE DATA PROVIDED
The User guarantees that the personal data provided to XTERNA is truthful and up to date, and is responsible for communicating any changes to it, the user being solely responsible for the inaccuracy or falsity of the data provided and for any damage that this may cause to said entities or to third parties as a result of the use of the services offered by them. Likewise, XTERNA states that the data collected is adequate, relevant and not excessive in relation to the scope, purposes and services determined.
COLLECTION OF YOUR PERSONAL DATA
Mostly, but not limited to, your data may be collected when it is provided to us via the contact form, the whistleblowing report processing form, by email, by handing over photocopied documents or through the formalisation of contracts and engagement letters.
XTERNA participates in social networks. The processing of data of Users who become followers (and/or make any link or connection action through social networks) of XTERNA’s official pages on social networks will be governed by the terms of use, privacy policies and other access, use and similar regulations belonging to the corresponding social network, which the user, as a participant in such social networks, will have previously accepted. Consequently, XTERNA is not responsible for the personal information shared by the user on social networks.
COMMUNICATION AND DESTINATION OF THE DATA
The data subject’s data will be communicated to XTERNA exclusively for the purposes indicated. It may also be transferred, where there is a legal obligation, to the competent authorities and administrations, as well as to Notaries and Court Procurators in the case of legal proceedings.
In order to fulfil the stated purposes, XTERNA may communicate data to third parties that provide us with financial, technological, logistical services, etc.
In this regard, XTERNA uses the services of reliable IT providers for comprehensive client management, and Zoom and Teams for holding online events, conferences and videoconferences, whose servers are hosted outside the European Economic Area. However, in both cases this communication is carried out under the safeguards provided for by the GDPR and the standard contractual clauses approved by the European Commission.
In the case of IIS management, the recipients of the data may be public administrations and/or persons named in your report/enquiry form, as well as those administrative or judicial bodies that may be involved in the report.
LEGAL BASIS FOR THE PROCESSING
The legal basis that legitimises the processing is the performance of the contract in the case of contracting, or else the legitimate interest in similar services from XTERNA if you have previously been a client.
Likewise, it will be your express consent to be able to personalise and communicate the quote to you in the case of a request for services where there is no prior contractual relationship.
When submitting the contact forms, including the IIS management form, their submission will be considered express consent to this Privacy Policy, which you declare you are aware of.
RETENTION PERIOD
The personal data provided will be retained for as long as it is necessary for the provision of the contracted services, to respond to the requests made, and in any case for as long as the data subject does not request deletion, as well as for the time necessary to fulfil the legal obligations that apply in each case according to each type of data and service provision. Thus, by virtue of tax regulations your data will be retained for 5 years, by virtue of anti-money laundering regulations, for 10 years and, in labour matters, for 6 years.
In relation to the IIS, the data will be retained for the period of resolution of the enquiry and/or report made, in compliance with the different regulations applicable at any given time. Once the enquiry and/or report has been resolved, the data may be retained for statistical purposes in anonymised form.
RIGHTS OF DATA SUBJECTS
You may access your personal data, as well as request its rectification if you consider it to be inaccurate or erroneous. You may also request its deletion, if it is no longer relevant for the purposes for which it was collected.
You may object to the processing of your data, if given your circumstances you consider that the processing is neither relevant nor appropriate. In such a case, XTERNA will stop processing the data unless it is necessary to comply with legal obligations or for the defence of possible claims.
In certain circumstances, clients or data subjects may request the restriction of processing, so that XTERNA will only use the data for those purposes for which it has been authorised or in the cases provided for by Law.
You may request the portability of your data and request that your data be delivered in electronic format for direct transmission to other processors. You may also receive it, in order to store it on your own devices. If you request it in a format other than the one used by XTERNA, such transformations may be quoted for.
The data subject may exercise their rights by sending an email to the address web@xterna.es attaching a photocopy of their national ID (DNI) or document proving their identity, stating the reason and the right they wish to exercise. You may lodge a complaint relating to the processing of your personal data with the Supervisory Authority (AEPD).
Nevertheless, XTERNA makes available to you a direct channel with the Privacy Officer to deal with your requests at the email address: msanchez@xterna.es
CHANGES TO THE PRIVACY POLICY
XTERNA reserves the right to modify this Policy in order to adapt it to legislative or case-law developments, as well as to industry practices.
In such cases, XTERNA will announce on this page the date of the latest changes introduced.
Version: February 2026.