Privacy Policy

General Information

This Privacy Policy applies to all personal data we process about you, as a user (understood as any natural person who accesses the website) when you access https://www.arteche.com/es, hereinafter the “Website.”

The purpose of this Privacy Policy is to inform you about how we process your personal data as a user, as well as to explain the rights you have in accordance with the applicable data protection legislation in force at any given time.

Who is responsible?

The entity responsible for processing the personal data collected through the Website is Arteche Lantegi Elkartea S.A., with NIF A48898548 and registered office at Derio Bidea 28, Mungia, Bizkaia 48100, Spain.

You can contact the Data Protection Officer at the email address rgpd@arteche.com to make any inquiries or request information you need about the processing of users' personal data. The personal data we collect will be treated confidentially and will be incorporated into our Record of Processing Activities.

Why do we request your data?

Additionally, during your navigation on the Website, we may collect certain personal data through cookies or other similar technologies, as provided in our Cookie Policy.

What is our legal basis for data processing?

Our legal basis for processing personal data is as follows:

• Consent: if you have given your express consent at the time of entering personal data by ticking the corresponding box, and you may withdraw it at any time without affecting the lawfulness of the processing carried out prior to withdrawal.
• Performance of a contract: if there is a contractual relationship between you and Arteche, or the processing of personal data is necessary for the development of the commercial relationship.
• Compliance with a legal obligation: in cases where Arteche has a legal obligation applicable to us as data controllers.
• Legitimate interest: in cases where there is a legitimate interest of our own or third parties related to the operation of the Website or the provision of services to the user, provided that the fundamental rights and freedoms of users do not override the legitimate interest.

How long will we keep your data?

The personal data we collect through the Website will be processed and retained for the time necessary to fulfill the purpose for which it was collected.

More specifically, data collected for the development and execution of a contract with you will be retained while the contractual relationship remains in effect, but personal data collected under legitimate interest or with your consent will only be kept for the time necessary to fulfill that purpose.

Once the strictly necessary period for the execution of the purposes described above has elapsed, we will retain the personal data for an additional period, which will last until all actions that could arise from our liability derived from each of the processing activities have expired.

Do we share your data with third parties?

In order to carry out the purposes described above, it is necessary for us to provide access to your personal data to other service providers, who will act as our data processors, such as:

• Other companies of the group

We have entered into an agreement with the companies acting as data processors that regulates the management and processing of users' personal data, as well as the adequacy of the security measures adopted.

In cases where we need to make transfers to third parties based or with servers outside the European Union or the European Economic Area (Iceland, Norway or Liechtenstein), and that country does not offer a level of personal data protection equivalent to that of the European Union, we will transfer your personal data always respecting the appropriate safeguards and maintaining security standards, in accordance with applicable regulations.

When these transfers are made from the EU/EEA to a third country for which the European Commission has not issued an Adequacy Decision, or we do not have Binding Corporate Rules, we will comply with the provisions established by the European Commission for these cases to provide you with the appropriate safeguards, and where applicable, we will enter into the Standard Contractual Clauses and even implement additional protective measures when necessary.

If you want more information about the transfer of personal data we make to countries outside the EU/EEA, you can contact us through the following email address: marketing@arteche.com

What are your rights?

You may exercise the following rights at any time and free of charge:

• Access: to know what data we hold and what we do with it.
• Rectification: to inform us of any inaccurate data.
• Deletion: to have your personal data deleted, as far as possible.
• Objection: to have us stop processing your personal data for any of the purposes mentioned above, provided there is no legal obligation preventing it.

• Portability: to have your personal data transferred to a third party, as far as possible.

• Restriction: to have your data suspended when you contest its accuracy, or want us to keep it to exercise some action.

• Not to be subject to decisions based solely on the automated processing of your data: If we make decisions based on the automated processing of your data, including profiling, that produce legal effects on you or significantly affect you, we will inform you of the logic applied and the expected consequences of such processing. In those cases, you have the right to obtain an explanation, to request human intervention, to express your point of view, and to request a review of the decision.

You can exercise any of these rights free of charge by accessing here.

If we do not properly respect these rights as the data controller, we inform you that you may file a complaint with the data protection supervisory authority at Agencia Española de Protección de Datos (AEPD), C/Jorge Juan, 6, 28001 Madrid, or at the email address internacional@aepd.es, as well as with the data protection supervisory authority of your country of habitual residence, workplace, or where the alleged infringement occurred.

Confidentiality and Security Measures

At Arteche, as data controllers, we commit to respecting the confidentiality of users' personal data and to using it in accordance with the purposes for which it was collected.

We have adopted all appropriate technical and organizational security measures suitable to the nature of the data being processed and as required by data protection regulations.

At https://www.arteche.com/es, we use Google Consent Mode v2 to transmit consents to the different purposes. More information here

Processing under the EU General Data Protection Regulation

This section applies to you and provides you with more information if one of our companies located in the European Economic Area processes your personal data.

Data Controller
The company providing you with this privacy notice, or identified as the operator of the corresponding website, application, or service, is the data controller of your personal data under the General Data Protection Regulation.

Business Partner Personal Data in Customer Relationship Management Systems
During our business relationship with you, we may share business partner contact information with affiliated companies and partners. We and these affiliated companies and partners are joint controllers for the proper protection of your personal data (Article 26 of the GDPR).

To enable you to effectively exercise your data subject rights in the context of this joint controllership, we have entered into an agreement with these Arteche companies that grants you the right to exercise your rights centrally against Arteche.

To exercise your rights or request a copy of the joint controller agreement, you may contact: rgpd@arteche.com.

Legal Basis for Processing
The GDPR requires us to inform you about the legal basis for processing your personal data. This basis is one or more of the following:

• Performance of a contract: processing is necessary to exercise our rights and fulfill our obligations under any contract concluded with you (Art. 6.1.b GDPR).
• Compliance with legal obligations: processing is necessary to comply with an applicable legal obligation (Art. 6.1.c GDPR).
• Legitimate interest: processing is necessary for the purposes of the legitimate interests we pursue, mainly the efficient management of your use of the services and our business relationship (Art. 6.1.f GDPR). For more information: rgpd@arteche.com.
• Consent: in some cases, we may request your consent for the use of your personal data (Art. 6.1.a GDPR).

Below is the legal basis applicable to each purpose described in this Privacy Policy:

Management of Registration, Contact, Quotes, and Contract Execution
Manage registration or sign-up on the website, verify your identity, and provide you access to the corresponding functionalities. Legal basis: Performance of a contract (Art. 6.1.b) · Legitimate interest (Art. 6.1.f).
Respond to inquiries made through the contact form or other customer service channels. Legal basis: Performance of a contract (Art. 6.1.b) · Legitimate interest (Art. 6.1.f).
Manage personalized quote requests. Legal basis: Performance of a contract (Art. 6.1.b) · Legitimate interest (Art. 6.1.f).
Develop, execute, and fulfill the service provision or sales contract, including payment management, invoicing, shipping, and returns. Legal basis: Performance of a contract (Art. 6.1.b) · Compliance with legal obligations (Art. 6.1.c).

For marketing and newsletter purposes * Carry out promotional actions, personalize services, and display advertising related to the user's profile, according to the expressed consent. Legal basis: Consent, if given voluntarily (art. 6.1.a) · Legitimate interest (art. 6.1.f). * Manage newsletter subscription and send information about products and services. Legal basis: Consent, if given voluntarily (art. 6.1.a) · Legitimate interest (art. 6.1.f).

Artificial Intelligence Functions * Offer automated navigation, query resolution, and guidance functions through artificial intelligence tools. Legal basis: Contract performance (art. 6.1.b) · Legitimate interest (art. 6.1.f). * Improve services based on user interactions so that responses and recommendations are more useful and aligned with their profile. Legal basis: Legitimate interest (art. 6.1.f).

Management of resumes and selection processes * Manage the personnel selection process based on the received resumes. Legal basis: Consent, if given voluntarily (art. 6.1.a) · Legitimate interest (art. 6.1.f).

International data transfers In the event that we transfer your personal data outside the European Economic Area, we ensure that your data is protected consistently with the GDPR. To this end, we adopt the following measures:

• We only share your personal data with affiliated companies outside the European Economic Area if they have applied our Binding Corporate Rules (BCR) for the protection of personal data.
• We transfer personal data to external recipients outside the European Economic Area only if the recipient has (i) signed the EU Standard Contractual Clauses with us, or (ii) implemented Binding Corporate Rules in their organization. For more information: rgpd@arteche.com.

Your competent data protection authority If you have any questions or requests related to data privacy, we recommend that you contact our Data Protection Officer at rgpd@arteche.com. Additionally, you always have the right to contact the competent supervisory authority, which in Spain is the Spanish Data Protection Agency (AEPD), located at C/Jorge Juan, 6, 28001 Madrid, or the data protection authority of your country of habitual residence, workplace, or where the alleged infringement occurred, as indicated in the section What are your rights? of the Privacy Policy.

Processing under the General Data Protection Law of Brazil

This section applies to you and provides you with more information if the processing by one of our companies (i) takes place in Brazilian territory, (ii) relates to data of individuals located in Brazilian territory, (iii) includes personal data collected in Brazilian territory, or (iv) aims at offering or supplying goods or services to individuals located in Brazilian territory. In these cases, the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados (LGPD)) applies to the processing of your personal data, and the following additions or deviations apply to sections 2, 5, 6, and 9 of this Data Privacy Policy:

Retention periods

As permitted under Article 16 of the LGPD, we may retain your personal data to comply with legal or regulatory obligations (such as retention obligations under tax or commercial law), during the legal statute of limitations period, or for the normal exercise of rights in judicial, administrative, or arbitration proceedings.

Your rights

In addition to the rights mentioned in this data privacy notice, you have the right under the LGPD to:

• If you understand that your data is not processed in accordance with the applicable data protection law or is processed excessively, request that we anonymize, block, or delete unnecessary or excessive personal data; or
• Request information about the public or private entities with which we have shared your personal data;
• Be informed about the possibility of not giving your consent to process your data and the consequences of not giving consent in case we request your consent to process your data;
• Revoke your consent at any time for us to process your personal data if we have requested your consent to process your data.

Legal basis for processing

The Brazilian General Data Protection Law requires us to provide you with information about the legal basis for processing your personal data.

The legal basis for our processing is:

• Article 7 V of the LGPD (“Performance of a contract”);
• Article 7 II of the LGPD (“Compliance with Legal Obligations”);
• Articles 10 I and II of the LGPD (“Legitimate interest”);
• Article 7 I of the LGPD (“Consent”).

International Transfers

Following the requirements of the LGPD defined in Article 33 of the Brazilian General Data Protection Law, in the event that we transfer your personal data outside Brazilian territory, we ensure that your data is protected consistently with the Brazilian General Data Protection Law, we will comply with the applicable law and the decisions imposed by the corresponding authority.

Your competent contact for data protection

If this section applies, you can also contact our Brazilian Data Protection Organization at rgpd@arteche.com

Processing According to Canadian Privacy Laws

Each Arteche company based in Canada (“Arteche entity in Canada”) maintains its personal data on secure servers accessible by authorized employees, representatives, or agents who need access for the purposes described in this privacy notice.

Residents of Quebec: Please note that your personal data may be communicated outside the province of Quebec (i.e., outside the province or territory and outside Canada).

If you have any questions about how an Arteche entity in Canada processes your personal data, including regarding the use of service providers outside Canada, or if you wish to exercise any of your rights concerning your personal data under the control of an Arteche entity in Canada, you may contact the privacy officer of Arteche in Canada at rgpd@arteche.com.

Processing under the Personal Data Protection Law of the People's Republic of China

This section applies to you and provides you with more information if processing by one of our companies takes place within the borders of the People's Republic of China ("China") or relates to data of persons within the borders of the People's Republic of China.

Processing of sensitive personal information

According to the PIPL, sensitive personal information refers to personal information that, once leaked or illegally used, can easily cause harm to the dignity of natural persons, serious harm to personal or property safety, including information about biometric characteristics, religious beliefs, specially designated status, health, financial accounts, individual location tracking, etc., as well as personal information of minors under 14 years old.

In addition to the payment data mentioned in the section Management of registration, contact, quotes, and contract execution of this Data Privacy Notice, we will, in principle, not process your sensitive personal information. In the event that we process your sensitive personal information, we will notify you of the necessity of processing and the effects on the rights and interests of the person, and obtain your specific consent, if applicable.

Transfer and disclosure of personal data

Following the requirements defined in Article 23 of the PIPL, in addition to the content mentioned in the section "Do we share your data with third parties?", we will, in principle, not transfer or share your personal information with third-party controllers, unless (1) we obtain your specific consent, if applicable, or (2) to comply with legal obligations under local laws and regulations.

International transfer

You acknowledge that your data will be transferred and processed outside the People's Republic of China. We will follow applicable laws and decisions imposed by the competent authority and ensure that your data is protected consistently with the Personal Information Protection Law of the People's Republic of China. If you or the company you work for are business partners, please note that Arteche is a multinational company and, in order to enter into or fulfill the contract/agreement with you or the company you work for, you understand and agree that we may transfer your personal information to foreign affiliated companies.

Legal basis for processing

The PIPL requires that we provide you with information about the legal basis for processing your personal data.

The legal basis for our processing is:

• Article 13 (2) of the PIPL ("Performance of the contract");
• Article 13 (3) of the PIPL ("Legal duties and responsibilities");
• Article 13 (6) of the PIPL ("Processing publicly available data");
• Article 13 (1) of the PIPL ("Consent")

Use by children

This offer is not directed at children under fourteen (14) years of age. We will not knowingly collect personal data from children under fourteen (14) years of age without prior parental consent if required by applicable law. We will only use or disclose a child's personal data to the extent permitted by law, to seek parental consent, in accordance with local laws and regulations, or to protect a child.

Processing under the South African Protection of Personal Information Act

Processing under the South African Protection of Personal Information Act
For business partners and users located in South Africa, please note the following:
According to Section 1 of the Protection of Personal Information Act of 2013 (“POPI”), “personal data” or “personal information” includes “information relating to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person.”

The corresponding legal grounds and conditions for the lawful processing of personal data in South Africa are set out in Sections 8 to 25 of the POPI and refer to “Accountability,” “Processing limitation,” “Purpose specification,” “Further processing limitation,” “Information quality,” “Openness,” “Security safeguards,” and “Data subject participation.”

According to Section 69 of the POPI, it is prohibited to process a data subject’s personal information for direct marketing purposes by any form of electronic communication, including ATMs, faxes, SMS, or email, unless the data subject has given consent for the processing or is, subject to other conditions, a current customer of Arteche.

To exercise your rights of access, objection, and complaint regarding the processing of personal data, as described in the section "What are your rights?" of this Privacy Policy, the contact details of the South African Information Regulator are as follows:

JD House, 27 Stiemens Street
Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
Complaints: complaints.IR@justice.gov.za
General inquiries: inforeg@justice.gov.za

Processing under the Swiss Data Protection Act

Each data subject has the right to assert their rights before the courts or to file a complaint with the competent data protection authority.

The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

To exercise your rights, as described in the section "What are your rights?" of this Privacy Policy, you can contact us at rgpd@arteche.com.

Processing under the Turkish Personal Data Protection Law, number 6698

This section applies to you and provides more information if one of our companies located in Turkey processes your personal data under the Personal Data Protection Law numbered 6698 (“PDPL”).

Data Controller
The company providing you with this privacy notice, or identified as the operator of the corresponding website, application, or service, is the data controller of your personal data under the PDPL.

Legal Basis for Processing
The PDPL requires us to provide you with information about the legal basis for processing your personal data. Such basis is one or more of the following:
Performance of a contract: processing is necessary to exercise our rights and fulfill our obligations under any contract concluded with you (art. 5.2.c PDPL).
Compliance with legal obligations: processing is necessary to comply with an applicable legal obligation (art. 5.2.ç PDPL).
Legitimate interest: processing is necessary for the purposes of the legitimate interests we pursue (art. 5.2.f PDPL).
Consent: in some cases, we may request your consent for the use of your personal data (art. 5.1 PDPL).

Below is the legal basis applicable to each purpose described in this Privacy Policy:

Management of registration, contact, quotes, and contract execution
Manage registration or sign-up on the website, verify your identity, and provide you access to the corresponding functionalities. Legal basis: Performance of a contract (art. 5.2.c) · Legitimate interest (art. 5.2.f).
Respond to inquiries made through the contact form or other customer service channels. Legal basis: Performance of a contract (art. 5.2.c) · Legitimate interest (art. 5.2.f).
Manage personalized quote requests. Legal basis: Performance of a contract (art. 5.2.c) · Legitimate interest (art. 5.2.f).
Develop, execute, and fulfill the service provision or sales contract, including the management of payments, invoicing, shipments, and returns. Legal basis: Performance of a contract (art. 5.2.c) · Compliance with legal obligations (art. 5.2.ç).
*

For marketing and newsletter purposes
Carry out promotional actions, personalize services, and display advertising related to the user profile, according to the expressed consent. Legal basis: Consent, if voluntarily given (art. 5.1) · Legitimate interest (art. 5.2.f).
Manage newsletter subscription and send information about products and services. Legal basis: Consent, if voluntarily given (art. 5.1) · Legitimate interest (art. 5.2.f).

Artificial Intelligence Functions * Provide automated navigation, query resolution, and guidance functions through artificial intelligence tools. Legal basis: Contract execution (art. 5.2.c) · Legitimate interest (art. 5.2.f). * Improve services based on user interactions so that responses and recommendations are more useful and aligned with their profile. Legal basis: Legitimate interest (art. 5.2.f).

Resume Management and Selection Processes * Manage the personnel selection process based on the resumes received. Legal basis: Consent, if given voluntarily (art. 5.1) · Legitimate interest (art. 5.2.f).

International Data Transfers In the event that we transfer your personal data outside of Turkey, we will ensure that your data is protected consistently with the PDPL. To this end, we transfer personal data to recipients outside of Turkey only if the recipient has signed a standard contract for the transfer of personal data abroad.

Your Rights as a Data Subject In accordance with Article 11 of the PDPL, and in addition to what is indicated in the "What are your rights?" section of this Privacy Policy, you may make the following requests regarding your personal data by contacting us: * To know whether your personal data has been processed or not. * To request information about the processing if your data has been processed. * To know the purpose of the processing and whether the data is used in accordance with that purpose. * To know the third parties, in the country or abroad, to whom your personal data has been transferred. * To request the correction of your data if it has been processed incompletely or inaccurately, and the notification of the corrections to the third parties to whom it has been transferred. * To request the deletion, destruction, or anonymization of your personal data if the reasons for processing have ceased, and the notification of such actions to the third parties to whom it has been transferred. * To object to any outcome that may be detrimental to you through the exclusively automated analysis of your personal data. * To request compensation for damages suffered as a result of the unlawful processing of your personal data.

To exercise any of these rights, you can contact us at rgpd@arteche.com.

Processing under the United Kingdom Data Protection Act 2018 and the United Kingdom GDPR

This section applies to you and provides you with more information if one of our companies located in the United Kingdom processes your personal data under the Data Protection Act 2018 and/or the UK GDPR (i.e., Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as incorporated into the law of England and Wales, Scotland, and Northern Ireland pursuant to section 3 of the European Union (Withdrawal) Act 2018).

Data Controller

The company providing you with this privacy notice, or identified as the operator of the relevant website, application, or service, is the data controller of your personal data under the UK GDPR.

During our business relationship with you, we may share the contact information of business partners with Arteche subsidiary companies. These Arteche companies and we are joint controllers of the proper protection of your personal data (Article 26 of the UK GDPR).

To enable you to effectively exercise your data subject rights in the context of this joint controllership, we have signed an agreement with these Arteche companies granting you the right to exercise your rights centrally with Arteche.

To exercise your rights, you may contact us at rgpd@arteche.com.

Legal Basis for Processing

The UK GDPR requires us to provide you with information about the legal basis for processing your personal data. Such basis is one or more of the following:

• Performance of a contract: processing is necessary to exercise our rights and fulfill our obligations under any contract entered into with you (Art. 6(1)(b) UK GDPR).

• Compliance with legal obligations: processing is necessary to comply with a legal obligation applicable to us (Art. 6(1)(c) UK GDPR).

• Legitimate interests: processing is necessary for the purposes of the legitimate interests pursued by us, primarily the efficient management of your use of the services and our business relationship (Art. 6(1)(f) UK GDPR). For more information: rgpd@arteche.com.

• Consent: in some cases, we may request your consent for the use of your personal data (art. 6.1.a UK GDPR).

Below is the applicable legal basis for each purpose described in this Privacy Policy:

Management of registration, contact, quotes, and contract execution

• Manage registration or sign-up on the website, verify your identity, and grant you access to the corresponding functionalities. Legal basis: Contract performance (art. 6.1.b) · Legitimate interest (art. 6.1.f).

• Handle inquiries made through the contact form or other customer service channels. Legal basis: Contract performance (art. 6.1.b) · Legitimate interest (art. 6.1.f).

• Manage personalized quote requests. Legal basis: Contract performance (art. 6.1.b) · Legitimate interest (art. 6.1.f).

• Develop, execute, and fulfill the service provision or sales contract, including payment management, invoicing, shipping, and returns. Legal basis: Contract performance (art. 6.1.b) · Compliance with legal obligations (art. 6.1.c).

For marketing and newsletter purposes

• Carry out promotional actions, personalize services, and display advertising related to the user’s profile, according to the expressed consent. Legal basis: Consent, if voluntarily given (art. 6.1.a) · Legitimate interest (art. 6.1.f).

• Manage newsletter subscription and sending information about products and services. Legal basis: Consent, if voluntarily given (art. 6.1.a) · Legitimate interest (art. 6.1.f).

Artificial Intelligence Functions

• Offer automated navigation, query resolution, and guidance functions through artificial intelligence tools. Legal basis: Contract performance (art. 6.1.b) · Legitimate interest (art. 6.1.f).

• Improve services based on user interactions so that responses and recommendations are more useful and tailored to their profile. Legal basis: Legitimate interest (art. 6.1.f).

Management of resumes and selection processes

• Manage the personnel selection process based on the resumes received. Legal basis: Consent, if given voluntarily (art. 6.1.a) · Legitimate interest (art. 6.1.f).

International data transfers

In the event that we transfer your personal data outside the United Kingdom, we ensure that your data is protected consistently with the UK GDPR.

To do this, we transfer personal data to recipients outside the United Kingdom only if the recipient has (i) signed the UK Standard Contractual Clauses with us, or (ii) implemented Binding Corporate Rules in their organization.

For more information about the security measures applied in relation to specific transfers, you can contact us at rgpd@arteche.com.

Your competent data protection authority

If you have any questions or requests related to data privacy, we recommend that you contact our Data Protection Officer at rgpd@arteche.com.

Additionally, you always have the right to contact the competent data protection authority of the United Kingdom, the Information Commissioner's Office (ICO), with your request or complaint, as indicated in the section "What are your rights?" of this Privacy Policy.

More information for U.S. residents.

Do Not Track
At this time, our offerings do not recognize or respond to browser "Do Not Track" signals.
For more information about "Do Not Track," please visit your browser’s support page.

Use by Children
This offering is not directed to children under thirteen (13) years of age.
We will not knowingly collect personal data from children under thirteen without insisting on obtaining prior parental consent if required by applicable law.
We will only use or disclose a child’s personal data to the extent permitted by law, to seek parental consent, in accordance with local laws and regulations, or to protect a child.

State Rights
Depending on the U.S. state in which you reside, you may have special rights regarding your personal data. This section applies to residents of the following states:
California
Colorado
Connecticut
Delaware
Florida
Iowa
Maryland
Minnesota
Montana
Nebraska
New Hampshire
New Jersey
Oregon
Tennessee
Texas
Utah
* Virginia

Categories of Personal Information Collected and Disclosed
Based on the context of your interactions with us, Arteche may have collected and disclosed to third parties for commercial purposes, in the past 12 months, the following categories of personal information:

• Personal identifiers such as name, postal address, unique identifier, IP address, email address, phone number, bank account number, credit or debit card number, financial or medical information. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
• Characteristics of protected classes under California or federal law, such as age, gender, race, religion, national origin, physical or mental health condition, citizenship, or marital status. Disclosed to: affiliated companies, service providers, professional advisors, and government agencies. Purpose: business or employment relationship management.
• Commercial information, including records of personal property, products, or services purchased or considered. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
• Internet or other electronic network activity, including browsing history, search history, and interaction with websites or applications. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
• Geolocation data, such as device location or location via IP. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
• Biometric and physical characteristics, such as audio, electronic, or visual information. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
• Professional or employment-related information. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.
• Educational information. Disclosed to: affiliated companies, service providers, business partners, and professional advisors. Purpose: service provision and business relationship management.

Sources from which we may collect this information include:
Arteche’s websites and mobile applications and those of its affiliated companies.
You or your employer, via phone, postal mail, email, trade shows, or in the context of employment or business opportunities.
Our customers, suppliers, and vendors.
Third parties from whom we acquire contact data, such as LinkedIn.

Exercise of Applicable Rights
To exercise any right you may have under the laws of the state in which you reside (for example, rights of access, deletion, portability, correction, or objection), you may contact us at rgpd@arteche.com.

Requests may be subject to verification of the requester’s identity. Depending on your state’s laws, you may use an authorized agent to exercise your rights on your behalf, who must also verify their own identity and authorization to act on your behalf.

State-Specific Rights
California
California residents have the right to:
Request the deletion of personal data we have collected about them, except where retention is necessary to complete a transaction, detect security incidents, comply with a legal obligation, or other exceptions provided by law.
Request that we inform them about the categories of data collected, sources, purpose of processing, categories of third parties with whom we share the data, and the specific data collected.
Request correction of inaccurate personal data.
Not be discriminated against for exercising any of these rights.
Under California’s “Shine The Light” law, California residents may annually request information about personal data disclosed to third parties for direct marketing purposes. Currently, Arteche does not disclose personal data to third parties for their own direct marketing purposes.

Colorado, Virginia, Utah, Oregon, Montana, Tennessee, Delaware, Iowa, Minnesota, Nebraska, New Hampshire, New Jersey, Connecticut, and Texas
Residents of these states may have the following rights, depending on their state of residence:
Right of access: confirm whether we process your personal data and request access to it.
Right of deletion: request that we delete personal data we have collected about you.
Right of portability: request that we provide your personal data in a portable format.
Right of correction: correct inaccuracies in your personal data.
* Right of objection: object to the use of your data for targeted advertising, sale of personal data, or profiling with significant legal effects.

Florida
In addition to the above rights, Florida residents have the right to object to:
The collection of sensitive data, including precise geolocation data.
The processing of sensitive data.
* The collection of personal data through voice or facial recognition features.

Oregon
Oregon residents additionally have the right to obtain a list of specific third parties, other than natural persons, to whom we have disclosed personal data.

Maryland
Maryland residents additionally have the right to obtain a list of categories of third parties to whom we have disclosed consumer personal data.

Minnesota
Minnesota residents additionally have the right to challenge the outcome of decisions based on profiling, to be informed of the reason for the decision and the actions that could have led to a different outcome, as well as to have the decision reevaluated if it was based on inaccurate data.

Iowa
Iowa residents have the rights of access, deletion, portability, correction, and objection to the sale of their personal data.

Utah
Utah residents have the rights of access, deletion, and portability of their personal data.

Specific Provisions for Users in the United Mexican States

For users located in the territory of the United Mexican States, the Data Controller of your personal data is Arteche North America, S.A. de C.V., with registered office at Ant. Carretera México-Querétaro Km. 73,540, Col. Tlaxinacalpan, CP. 42850, Tepeji del Rio de Ocampo, Hidalgo, Mexico.

In accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations, you are expressly informed that your personal data will be shared and transferred internationally to Arteche Lantegi Elkartea, S.A. (as well as to other parent companies, subsidiaries, or affiliates under the common control of the Arteche Group in Spain), in accordance with the corresponsibility and data sharing agreement existing between the companies of the corporate group.

This international transfer is carried out securely and solely for the purpose of centralizing the management of clients and prospects (CRM systems), providing technical and administrative support, and coordinating commercial actions globally. According to Article 36 of the LFPDPPP, commercial transfers between companies of the same corporate group that operate under the same internal processes and policies do not require mandatory consent; however, by interacting with this website and providing your data, you declare that you are fully informed of these flows and accept the terms of this Notice.

Annex: https://www.arteche.com/en/cmis/document/default/e8bf4064-3c0e-4b92-a049-3968b7c994a1?uuid=ade395c5-ce7a-421d-923d-aa80d82236af

Annex: https://www.arteche.com/en/cmis/document/default/d4414540-7269-4a54-b6bf-d0db01fb504b?uuid=aa550420-384a-4a57-8655-2e81c39401f4

Changes to the Privacy Policy

This Privacy Policy was last updated on 21/10/2026. At Arteche, we reserve the right to update and modify certain aspects of it to adapt to legislative and jurisprudential developments, so we recommend reviewing it periodically.