Privacy Policy

At GREMICAT we work to offer you the best possible experience through our products and services. In some cases, collecting information is necessary to achieve this. Your privacy matters to us and we believe we should be transparent about it.

For this reason, and in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), GREMICAT will process your data as data controller.

Our commitment includes:

• Collecting your data to improve the user experience, taking your interests and needs into account. We are transparent about the data we obtain and the purpose of it, always complying with the applicable regulations and requesting your consent where necessary.
• Your data belongs to you. If you decide not to authorise us to process it, you may request that we stop doing so.
• Our priority is to guarantee your security and to process your data in accordance with European regulations.

For further information on the processing of your data, please see the sections of this privacy policy below.

1. Data Controller

The Controller of the data collected through this Website is:

• Identity: GREMICAT, S.L. (hereinafter, “GREMICAT”)
• Registered address: Av. Portal de l’Àngel, no. 42, penthouse A, 08002 Barcelona, Spain
• Email: gremicat@gremicat.es
• Telephone: +34 934 120 232
• Tax ID (CIF): B62853965

2. Purpose

The personal data of the user of this Website will be processed for the following purposes:

• Management of the client area: to enable the maintenance, development and management of the client area provided through the Website. Data processed for this purpose will be retained for as long as the business relationship remains in place and, once it has ended, for the retention and limitation periods laid down by law. The legal basis for the processing is the performance of a contract to which the data subject is party, where the data subject is a self-employed person or an individual, and legitimate interest where the data subject is the contact person of a corporate client.
• Handling enquiries: to respond to requests for information and/or enquiries made by the User. Data processed for this purpose will be retained until the request for information and/or enquiry has been answered and, thereafter, for the retention and limitation periods laid down by law. The legal basis for the processing is the User’s consent.
• Job applications: to handle job applications and, where applicable, to allow the candidate to apply for a position at GREMICAT. Data processed for this purpose will be retained for two years from receipt and, in any case, for the retention and limitation periods laid down by law. If you wish to remain in our database after that period, you will need to send us your CV again. The legal basis for the processing is your consent.
• Commercial communications: to keep the User informed, including by electronic means, about GREMICAT’s products, services and news. Data processed for this purpose will be retained until the User withdraws the consent given to receive such communications — without the withdrawal of consent affecting the lawfulness of processing carried out beforehand, as established by the GDPR — and, thereafter, for the retention and limitation periods laid down by law. The legal basis for the processing is the User’s consent. If you consent to your data being processed for this purpose, please tick the box provided. The advertising opt-out systems listed on the website www.aepd.es are available to the User.
• Provision of professional services: to provide the advisory and administrative services contracted by the client, including tax, employment, civil and commercial advice, accounting, inheritance and insurance services. Data processed for this purpose will be retained for the duration of the contractual relationship and, subsequently, for the retention periods established by law. The legal basis for the processing is the performance of the contract.
• Management of the internal reporting system: to manage the internal reporting system established in compliance with Spanish Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and combating corruption, in order to process and follow up reports of irregularities or infringements. Data processed for this purpose will be retained for as long as is necessary to process the report and, where applicable, for the retention periods established by the aforementioned legislation. The legal basis for the processing is compliance with a legal obligation.

3. Recipients

Data may be disclosed to the following third-party recipients:

• Public authorities, for compliance with legal obligations arising from the provision of advisory and administrative services.
• Banking institutions, for the management of collections and payments.
• Official bodies such as the Spanish Tax Agency, Social Security, the Commercial Registry and other public bodies, where necessary for the provision of our professional services.

Data may also be disclosed to the following categories of processors: providers of electronic communications, office software, hosting, housing, IT maintenance, administrative management, accounting, auditing, advisory and legal representation services.

Such processors may be located outside the European Economic Area. In these cases, GREMICAT guarantees that such international transfers will be carried out with appropriate safeguards in accordance with Articles 44 to 50 of Regulation (EU) 2016/679 (GDPR), by adopting mechanisms such as the standard data protection clauses approved by the European Commission or other appropriate safeguards.

4. Rights

The data subject may exercise their rights of access, rectification, erasure, restriction of processing, data portability and objection before GREMICAT. Likewise, where the processing of the User’s data is based on the consent given by the data subject, they have the right to withdraw that consent at any time, without this affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, the data subject may send their request to the following address: GREMICAT, Av. Portal de l’Àngel, no. 42, penthouse A, 08002 Barcelona, Spain, or to the email address gremicat@gremicat.es, enclosing a copy of their identity document.

In any event, if the User considers that the processing of their data does not comply with current regulations, they have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), the supervisory authority for data protection.

5. Security Measures

GREMICAT has adopted the technical and organisational measures necessary to guarantee the security of personal data and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data stored and the risks to which it is exposed.

6. Data Retention

Personal data will be retained for as long as is necessary to fulfil the purpose for which it was collected and to determine any liabilities that may arise from that purpose and from the processing of the data, in addition to the periods established by records and documentation legislation.

7. Updates to this Policy

This Privacy Policy may be amended in response to legislative or regulatory requirements, or in order to adapt it to the instructions issued by the Spanish Data Protection Agency. Where significant changes are made to this Privacy Policy, users will be notified via the website or by email.

Last updated: July 2025