Privacy and Cookies Policy

General Information

This Privacy Policy applies to all personal data we process about you, as a user (understood as any natural person who accesses the website) when you access https://www.loottis.com, hereinafter the "Website."

The purpose of this Privacy Policy is to inform you about how we process your personal data as a user, as well as to explain the rights you have in accordance with the applicable data protection legislation in force at any given time.

Who is responsible?

The entity responsible for processing the personal data collected through the Website is Elma Consulting SL, with NIF B93225142 and registered office at Calle Leganitos, 15-17 , Madrid, Madrid 28013, Spain.

What do we ask your data for?

Additionally, during your navigation on the Website, we may collect certain personal data through cookies or other similar technologies, as provided in our Cookie Policy.

What is our legal basis for data processing?

Our legal basis for processing personal data is as follows:

• Consent: if you have given your express consent at the time of entering personal data by ticking the corresponding box, and you may withdraw it at any time without affecting the lawfulness of the processing carried out prior to withdrawal.
• Performance of a contract: if there is a contractual relationship between you and Loottis, or the processing of personal data is necessary for the development of the commercial relationship.
• Compliance with a legal obligation: in those cases where Loottis has a legal obligation applicable to us as data controllers.
• Legitimate interest: in those cases where there is a legitimate interest of our own or of third parties related to the operation of the Website or the provision of services to the user, provided that the interests and fundamental rights of the users do not prevail over the legitimate interest.

How long will we keep your data?

The personal data we collect through the Website will be processed and kept for the time necessary to fulfill the purpose for which it was collected.

More specifically, the data we collect for the development and execution of a contract with you will be kept as long as the contractual relationship remains in effect, but personal data collected under legitimate interest or with your consent will be kept only for the time necessary to fulfill that purpose.

Once the strictly necessary period for the execution of the purposes described above has elapsed, we will keep the personal data for an additional period, which will last until all actions that could arise from our liability derived from each of the processing activities have expired.

Do we share your data with third parties?

In order to carry out the purposes described above, it is necessary for us to give access to your personal data to other service providers, who will act as our data processors, such as:

• Service providers related to the administration and management of the company

• Providers of technological and analytical services

We have entered into an agreement with the companies acting as data processors that regulates the management and processing of users' personal data, as well as the adequacy of the security measures adopted.

In those cases where we have to make transfers to third parties with headquarters or servers outside the European Union or the European Economic Area (Iceland, Norway, or Liechtenstein), and that country does not offer a level of personal data protection equivalent to that of the European Union, we will transfer your personal data always respecting the appropriate safeguards and maintaining security standards, in accordance with applicable regulations.

When these transfers are made from the EU/EEA to a third country for which the European Commission has not issued an Adequacy Decision, or we do not have Binding Corporate Rules, we will comply with the provisions established by the European Commission for these cases to provide you with the appropriate safeguards, and whenever applicable, we will subscribe to the Standard Contractual Clauses and even implement additional protective measures when necessary.

If you want more information about the transfer of personal data we carry out to countries outside the EU/EEA, you can contact us through the following email address: contacto@loottis.com

What are your rights?

You may exercise the following rights at any time and free of charge:

• Access: to know what data we hold and what we do with it.
• Rectification: to inform us of any inaccurate data.
• Deletion: to have your personal data deleted, as far as possible.
• Objection: to have us stop processing your personal data for any of the purposes mentioned above, provided there is no legal obligation preventing it.

• Portability: to have your personal data transferred to a third party, as far as possible.

• Restriction: to have your data suspended when you contest its accuracy, or want us to keep it for the exercise of a legal claim.

• Not to be subject to decisions based solely on the automated processing of your data: If we make decisions based on the automated processing of your data, including profiling, that produce legal effects on you or significantly affect you, we will inform you of the logic applied and the expected consequences of such processing. In such cases, you have the right to obtain an explanation, to request human intervention, to express your point of view, and to request a review of the decision.

You can exercise any of these rights free of charge by accessing here.

If we do not properly respect these rights as the data controller, we inform you that you may file a complaint with the data protection supervisory authority at Agencia Española de Protección de Datos (AEPD), C/Jorge Juan, 6, 28001 Madrid, or at the email address internacional@aepd.es, as well as with the data protection supervisory authority of your country of habitual residence, workplace, or where the alleged infringement occurred.

Confidentiality and Security Measures

At Loottis, as data controllers, we are committed to respecting the confidentiality of users' personal data and to using it in accordance with the purposes for which it was collected.

We have adopted all appropriate technical and organizational security measures according to the nature of the data being processed and as required by data protection regulations.

At https://www.loottis.com we use Google Consent Mode v2 to transmit consents to the different purposes. More information here

Cookie Policy and Tracking Technologies

Before we start, what is a cookie? What types of cookies exist?

A cookie is a small text file that websites install on the user's computer or mobile device when they visit them. Cookies are generally used to make web pages work or work more efficiently, as well as to collect information about their use.

The use of cookies may involve the collection of certain personal data, so we recommend that you also consult our Privacy Policy to learn about the personal data we process, how we use it, and the rights you have.

Likewise, cookies can be classified as follows:

• According to the entity managing them: first-party or third-party
• According to the duration of activity: session or persistent
• According to their purpose: technical, preference/personalization, analytics, or marketing

Other Tracking Technologies

In addition to cookies, we may use other tracking technologies that work similarly and allow us to better understand how you use our website and improve your browsing experience (hereinafter collectively “Cookies”).
These are:

• Local Storage / Session Storage: allow storing information directly in the browser similarly to a cookie.
• Tracking scripts: code snippets that load when visiting the website and enable analytical, advertising, or personalization tools.
• Tracking pixels: small pieces of code that load when visiting a page or opening an email. When activated, they send information to the hosting server, which allows detecting visits, measuring interactions, and knowing certain actions performed on the website. These pixels may collect data such as the type of browser used, IP address, visit frequency, or how the user navigates the site. Their purpose can be analytical (measuring site performance) or advertising (optimizing campaigns and audiences).
• Web beacons: tracking tags inserted into web pages or electronic communications. When loaded, they allow collecting information about content viewing and user activity.

These technologies can collect information about your device, your browser, and your interactions on the website, and are used for analytical, functional, or advertising purposes, just like Cookies. They will only be activated when you have given your consent, except for those necessary for the basic functioning of the website.

What is the legal basis for our use of Cookies?

Technical or strictly necessary Cookies allow the basic functioning of the website and facilitate access to the services we offer. Their use is justified by the relationship established when you decide to visit our website and use its functionalities, so they do not require consent.

Preference/personalization, analytics, or marketing Cookies have as their legal basis the consent you may give when first accessing the website, which you can revoke at any time.

Who is responsible for the use of Cookies on https://www.loottis.com?

When you browse our website, some Cookies are installed directly from our own domains, while others come from external companies that incorporate their technologies on our site with our authorization and allow us to offer services such as analytics, measurement, content personalization, or advertising.

At Loottis we are responsible for the first-party Cookies installed from our domains. Third-party Cookies are installed and managed by the companies identified in the ‘Owner’ column of the Cookies table in this Policy, who are responsible for the processing they carry out with the data obtained through them. You can consult their privacy policies on their respective websites.

What Cookies do we use?

The following table explains the Cookies we use and their purposes:

How can you manage or modify your consent regarding Cookies?

You can modify your Cookie usage preferences at any time with the tool for Configure Cookies.
You may need to refresh the page for the settings to take effect.

Through this tool you can:

• Independently enable or disable preference/personalization, analytics, and marketing Cookies.
• Keep only technical Cookies (strictly necessary) enabled.
• Modify your initial choice or withdraw it whenever you consider appropriate. We will keep your choice for a maximum of 24 months, after which we will request your consent again.

Each category includes different Cookies whose specific uses can be consulted in the table included in this Policy. Disabling certain categories may limit some functionalities or prevent content from being adapted to your preferences.

How can you delete Cookies?

In addition to managing your consent through our tool, you can also control most Cookies directly from your browser settings.

You can do this in the most common browsers by following their instructions:

• Google Chrome
• Mozilla Firefox
• Microsoft Edge
• Opera
• Apple Safari

To find information related to other browsers, you can visit the corresponding browser’s website.

At https://www.loottis.com we use Google Consent Mode v2 to transmit consents to the different purposes.
More information here.

International data transfers with the use of Cookies

By using this website and accepting certain Cookies or tracking technologies, some of the generated data may be processed by providers located in third countries. In particular, certain services may involve data transfers to the United States or other territories outside the European Economic Area (EEA).

When these transfers are made to entities located in the United States, the processing may be based on an adequacy decision by the European Commission, provided that the provider adheres to the EU–US Data Privacy Framework. If the provider is not listed in the “Data Privacy Framework List,” or when the transfer is directed to countries without an adequacy decision, the safeguards provided in the GDPR will apply.

Changes to the Privacy and Cookies Policy

This Privacy and Cookies Policy was last updated on 26/10/2026, Loottis reserves the right to update and modify certain aspects of it to adapt to legislative and jurisprudential developments, so we recommend that you review it periodically.