Date of last update: 08/05/2025
This Privacy Policy has been developed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the GDPR) and with Organic Law 3/2018, of 5 December, on Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), and other applicable regulations.
The purpose of this Privacy Policy is to inform individuals who provide their personal data, and/or that of the person they represent, about the specific aspects related to the processing of such data, including the purposes of the processing, contact details for exercising their rights, data retention periods, and security measures, among other things.
In terms of data protection, INDUSTRIAS ALIMENTARIAS DE NAVARRA S.A.U shall be considered the Data Controller in relation to the processing of personal data carried out by this entity.
The contact details of the Data Controller are as follows:
o Identity of the data controller: INDUSTRIAS ALIMENTARIAS DE NAVARRA S.A.U (A31204175)
• Physical address: P.I. PEÑALFONS, S/N, 31330, VILLAFRANCA, NAVARRA
• Email: info@grupoian.com
Telephone: Telephone: 948 84 33 60
This entity has appointed a Data Protection Officer, who can be contacted via the following email address: GESPRODAT S.L dpd@gesprodat.net 902 929 926, or by writing to the registered address of this entity for the attention of the “Data Protection Officer”.
All information collected by INDUSTRIAS ALIMENTARIAS DE NAVARRA S.A.U will be processed in a fair, lawful, and transparent manner.
Likewise, the data requested in each of the processing activities carried out will consist solely of those that are strictly necessary to fulfil the specific, informed purpose in each case.
In this way, the data collected will be adequate, relevant, and not excessive in relation to the purposes for which they are processed in each case. Therefore, your personal data will be collected for specific, explicit and legitimate purposes and will not be further processed in a manner incompatible with those purposes. In addition, they will be updated whenever necessary.
In general terms, within the scope of the various processing activities carried out by the organization, the following types of data are collected:
• Identifying data.
• Identifying data.
• Administrative data.
• Commercial information.
As a general rule, personal data is always collected directly from the data subject. However, in certain exceptions, data may be collected through third parties, entities, or services other than the data subject.
In this regard, this matter will be communicated to the data subject through the informational clauses included in the various data collection channels, and within a reasonable time or during the first notification made to the data subject.
FOR WHAT PURPOSES AND IN WHAT SPECIFIC CASES DO WE PROCESS PERSONAL DATA?
In general terms, personal data is processed for the following purposes:
• User registration management: The information you provide in the registration form will be processed for the management of users on our platforms.
• Newsletters: when previously authorized, via email, fax, SMS, MMS, social communities, or any other present or future electronic or physical means that enables commercial communications, as well as sending the website's newsletter. These communications will be made by the Data Controller or any of the companies in the Data Controller's group, about its products and services, or by its collaborators or suppliers with whom it has reached a promotion agreement. In this case, third-parties will never have access to personal data.
• Contact: In order to respond to your request, we will process the necessary data, which generally corresponds to contact details (email), or the issue you communicate to us, as well as responding to information requests regarding the products and services offered or any type of request made by the user through any of the contact methods available to them.
When using social media to send us queries, please avoid entering personal data. Remember that we have no control over the data entered on these platforms, so we advise you to carefully read the privacy policies of the social media platform you are using.
• Surveys: For conducting customer service and/or product quality surveys carried out by the Data Controller or any of the companies in the Data Controller's group. In order to improve these services, we will process your personal data to obtain information about our products or the service provided by our customer support team.
The personal data collected will not be used to create profiles or make automated decisions. However, all the specific purposes for which each of the processing activities is carried out are outlined in the informational clauses included in each of the data collection channels (web forms, paper forms, voice recordings or posters, informational notes, invoices, contracts, and other documents containing personal data).
As a general rule, prior to the processing of personal data, INDUSTRIAS ALIMENTARIAS DE NAVARRA S.A.U informs about the legal basis upon which the legitimacy of the processing is established.
However, the organization may process personal information for the following purposes:
• Compliance with legal and regulatory obligations: For example and without limitation: General Law for the Defence of Consumers and Users, General Tax Law, Corporate Tax Law, Auditing Law, Value Added Tax Law, Civil Code, Commercial Code, also in the case of any specific law or regulation that authorizes or requires the processing of the data subject's data, which will be stated in the corresponding informational clause.
• Performance of a Contract: for the prior management of a contracted service or product, the performance of a contract or subsequent procedures arising from such operations.
• Consent: there are processing activities based on the explicit and unequivocal consent of the data subject, obtained through the inclusion of informed consent clauses in the various data collection systems, with consent being provided through a declaration or a clear affirmative action, such as checking a box provided for this purpose, subscribing to the relevant document, or submitting data through the indicated contact methods. Additionally, we inform you that we will only use personal information in accordance with this Privacy Policy and, in general, we will request your consent for uses that are different from those for which you initially provided it.
• Legitimate interest: data processing based on the legitimate interest of the controller will primarily be carried out for sending communications or commercial events regarding products or services similar to those contracted. In accordance with Article 21.2 of the Law on Information Society Services, this processing will only be valid when, as a customer, you have not expressly objected at the time of data collection or in any of the communications we send.
At http://www.carretilla.info/, personal data is processed for the time necessary to fulfil the purpose for which it was collected, as long as the service or employment/contractual relationship is maintained, there is mutual interest, and/or for the period stipulated by the relevant regulations.
WHO DO WE SHARE PERSONAL DATA WITH?
As a general rule, INDUSTRIAS ALIMENTARIAS DE NAVARRA S.A.U does not transfer or disclose your data to third parties, except when required by law.
Nevertheless, if necessary, such data transfers or disclosures will be notified to the data subject through the informational clauses included in the various data collection channels.
We also inform you of the data transfer to Mailchimp (The Rocket Science Group) outside the European Economic Area, based on the existence of adequate safeguards in accordance with the GDPR, with these safeguards being available to anyone who explicitly requests them at rgpd@grupoian.com.
Specifically, the following safeguards are established:
• The data controller has been certified in accordance with certification mechanisms approved under Article 42 of the GDPR, along with binding and enforceable commitments in the third country to apply adequate safeguards, including those related to the rights of the data subjects.
According to European regulations, you have the following rights:
• Right of Access, the right to request information from the data controller about whether your personal data is being processed.
• Right of Rectification, the right to request the modification of data that is inaccurate or incomplete.
• Right to Object, the right of a person to object to the processing of their personal data or to have it deleted.
• Right to Individual Automated Decisions, the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on the data subject or significantly affects them in a similar manner.
• Right to Restriction, the right to suspend the processing of the user's personal data in certain cases.
• Right to Erasure or to be Forgotten, the right to have the personal data of the data subject erased.
• Right to Portability, the right to request that the data controller to provide personal data in a structured, commonly used, and readable format to another controller.
• Right to lodge a complaint with the relevant supervisory authority if the data subject considers that the processing does not comply with current regulations.
The applicant can exercise their rights through the following means:
•By email to rgpd@grupoian.com , providing documentation proving the identity of the applicant (copy of the front of the National Identity Document, or equivalent)
• By post to P.I. PEÑALFONS, S/N, 31330, VILLAFRANCA, NAVARRA, providing documentation proving the identity of the applicant (copy of the front of the National Identity Document, or equivalent)
In any case, you can request the oversight of the Spanish Data Protection Agency through its website.
In this regard, INDUSTRIAS ALIMENTARIAS DENAVARRA S.A.U will respond to your request as soon as possible and taking into account the deadlines established in the data protection regulations.
The data requested in the fields marked with an asterisk (*) or provided in the documents or channels where the information is given, are those strictly necessary in relation to the purpose for which they are collected, either for providing optimal service to the data subject, for a legal obligation imposed on the data controller, or a necessary requirement for entering into a contract. The inclusion of data in the remaining fields is voluntary.
In the event that all the data is not provided, it is not guaranteed that the information and services provided will be completely adjusted to their needs.
Therefore, if the required data is not provided or is provided incorrectly or incompletely, we will not be able to process your request, making it entirely impossible to provide the requested information or carry out the service contract.
Similarly, the user guarantees that the information provided in any of the forms is truthful, accurate, and corresponds to data they own.
The services on our platforms are not intended for minors, and therefore, only individuals over 18 years of age are allowed to register. In the event that a minor registers, it is hereby noted that any potential liabilities arising from the use of our platforms will be the responsibility of the minor's parents or guardians.
To prevent the use of our services by minors, we make an effort to verify the age of our users when they complete their registration by requesting their date of birth.
The security measures adopted by INDUSTRIAS ALIMENTARIAS DE NAVARRA S.A.U are those required in accordance with the provisions of Article 32 of the GDPR.
In this regard, INDUSTRIAS ALIMENTARIAS DE NAVARRA S.A.U, taking into account the state of the art, the application costs, and the nature, scope, context, and purposes of the processing, as well as the varying probability and severity of risks to the rights and freedoms of individuals, has established the appropriate technical and organizational measures to ensure a level of security that is adequate to the existing risk.
In any case, INDUSTRIAS ALIMENTARIAS DE NAVARRA S.A.U has implemented sufficient mechanisms to:
Ensure the ongoing confidentiality, integrity, availability and resilience of the processing systems and services.
Restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
Regularly verify, assess and evaluate the efficacy of the technical and organizational measures implemented to guarantee the security of the processing.
This Privacy Policy may be revised from time to time in order to align it with changes in current legislation, update our procedures for the collection and use of personal information, and reflect the appearance of new services or the exclusion of others. These changes will take effect from the moment they are published on the website, so it is important that you regularly review this Privacy Policy in order to stay informed about any updates.
Remember that all fields are required