THIS AUTOMATIC TRANSLATION IS FOR YOUR INFORMATION ONLY! THE LEGALLY BINDING DOCUMENT IS THE SPANISH VERSION

PROCESSING OF PERSONAL DATA

The personal data collected on our website is processed in compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as with Organic Law 3/2018, of December 5, on the Protection of Personal Data and the guarantee of digital rights.

Likewise, we guarantee that personal data is processed lawfully, fairly, and transparently, and is collected for specified, explicit, and legitimate purposes, remaining limited to those purposes and updated if necessary. Data subjects will not be identifiable for longer than necessary, and their security will be guaranteed through appropriate technical and organizational measures.

The Customer or User states that all the data provided by them is true and correct and agrees to keep it updated by informing Lendismart of any changes. The user is responsible for the accuracy of their data and will be solely liable for any disputes or conflicts resulting from the inaccuracy of such data. It is important that the user informs Lendismart of any changes to their personal data to keep it updated; otherwise, we cannot ensure its accuracy.

Who is responsible for your personal data?

Company Name: Lendismart, S.L.

Tax ID (NIF): B90242645

Registered Office: Avenida San Francisco Javier, 19, Module J, 41005 Sevilla

Contact: lopd@lendismart.com

Why do we process your data and what allows us to do so?

Personal data will be processed by the responsible entity when you provide it by filling out registration or contact forms, sending emails, or calling by phone.

The data will be processed for the following purposes:

• Responding to inquiries and information requests: When an individual submits an inquiry or information request, we process their data with their consent to respond to their inquiry or request.
• Managing our business processes and issuing quotations: When an individual requests it, we process their data to manage the offer and follow up on it via phone, email, or other equivalent electronic means. This processing is legitimized by the request for a quotation and our legitimate interest as a provider in concluding a contract, even if the initial offer is not accepted, as long as the commercial information aligns with the initial request and no additional products are offered.
• Communicating commercially with individuals by any means:
  • • When an individual requests or authorizes it through the contact form, we may communicate with them electronically about our services and activities, processing their data with their consent.
    • When an individual registers their email address in our newsletter form, we process their data with their consent to keep them informed through periodic electronic communications about our services and activities.

Individuals may object to these communications in each message sent and additionally through the mechanism described in the “What are your rights?” section.

• Considering candidates for our recruitment processes: If an individual provides us with their resume, their data will be used for current and future recruitment processes within our company and to communicate with them, including electronically, regarding their application.
• Using data storage and retrieval devices: When an individual visits our website, we use cookies and other tools with their consent for the purposes outlined in our Cookie Policy, where more information is available.
• We also use “Google reCAPTCHA” on our websites. reCAPTCHA is used to verify whether the data entered on our website (e.g., in a contact form) is entered by a human or an automated program. This analysis begins automatically when the website visitor accesses the site and evaluates various factors (e.g., IP address, time spent on the site, mouse movements). The data collected during this analysis is sent to Google. reCAPTCHA analyses occur entirely in the background. This processing is based on our legitimate interest in protecting our website from spam and abusive automated tracking. For more information about Google reCAPTCHA and Google’s privacy policy, please visit: https://policies.google.com/privacy?hl=en and https://www.google.com/recaptcha/about/

Who do we share your data with?

We may share personal data with third-party data processors (website hosting and development, email services) solely for the purpose of providing specific services under our instructions, without using the data for their own purposes, and to carry out our activities, or with competent public authorities in compliance with legal obligations.

For sending our newsletter and bulletins, we use Mailchimp services. Mailchimp’s servers are located in the United States (a country with an adequate level of protection under the EU-USA Data Privacy Framework Decision of July 10, 2023), which may involve an international transfer of data (email address). Mailchimp also provides sufficient security measures through the European Commission’s Standard Contractual Clauses.

How long do we retain your data?

As a general rule, data will be retained as long as it is compatible with the purpose for which it was collected, in compliance with legal retention obligations, and to address any potential liabilities arising from processing, after which it will be deleted. Aggregated or anonymized data will be retained without a specific deletion period.

Data collected for commercial communication will be retained as long as the purpose remains or until the user objects to the processing.

Regarding client data, the retention period may vary depending on the service contracted. In any case, applicable legal obligations are as follows:

4 years: Law on Social Order Infractions and Sanctions (obligations related to social security, registration, deregistration, contributions, salary payments); Articles 66 et seq. of the General Tax Law (accounting records).

5 years: Article 1964 of the Civil Code (personal actions without a special term).

6 years: Article 30 of the Commercial Code (accounting records, invoices).

10 years: Article 25 of the Law on the Prevention of Money Laundering and Terrorist Financing.

For recruitment processes, if the candidate is not selected, their personal data may be retained for up to two years for future consideration unless they express their opposition.

What are your rights?

You can:

1. Obtain more information.
2. Withdraw your consent when given for specific processing.
3. Stop receiving our commercial communications by notifying us via email.
4. Exercise your rights to:
   • • Access: Know what personal data we process about you.
     • Rectification: Correct inaccurate or incorrect personal data.
     • Erasure: Delete your personal data that we are not legally required to retain.
     • Objection: Stop processing your data for a specific purpose.
     • Restriction: Limit the processing we carry out.
     • Portability: Receive your personal data in our possession.

To exercise any data protection rights, you may request a rights exercise form from the responsible entity or download the forms provided by the Spanish Data Protection Agency at this link and submit it with additional information to verify your identity to the responsible party’s address or email.

Company Name: Lendismart, S.L.

Tax ID (NIF): B90242645

Registered Office: Avenida San Francisco Javier, 19, Module J, 41005 Sevilla

Contact: lopd@lendismart.com

For more information or to file a complaint, you may contact the Spanish Data Protection Agency at http://www.agpd.es – C/ Jorge Juan, 6. 28001 – Madrid (901 100 099 – 912 663 517).

How do we ensure the security of your data?

In compliance with current data protection regulations, Lendismart has implemented appropriate technical and organizational measures. The personal data collected through forms is processed solely by Lendismart staff or designated processors. Adequate security measures are in place to prevent data loss, misuse, alteration, unauthorized access, and theft.

Lendismart’s website uses SSL encryption, ensuring the secure transmission of personal data through website contact forms.

Changes to the Privacy Policy

We have updated this policy to comply with the requirements and obligations of the General Data Protection Regulation.

This policy is effective as of 03/27/2025.