Privacy Policy
Last updated: June 16, 2026
This Privacy Policy has been developed taking into account the provisions of Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter the GDPR, as well as Organic Law 3/2018, of December 5, on Data Protection and digital rights (hereinafter, LOPDGDD) and other applicable regulations.
The purpose of this Privacy Policy is to inform natural persons who provide their personal data, and/or the data of the person they represent, about whom information is being collected, of the specific aspects related to the processing of their data, the purposes of the processing, the contact details for exercising their rights, the data retention periods, and security measures, among other things.
WHO IS THE DATA CONTROLLER?
In terms of data protection, PLASTICOS ERUM SL must be considered the Data Controller in relation to the processing of personal data carried out by this entity.
Below are the contact details of the Data Controller:
- Controller’s Identity: PLASTICOS ERUM SL
- Tax ID (NIF): B03083771
- Physical Address: Partida de Sant Benet Baix, Polígono industrial El Clérigo. Parcela 2A, 03802 Alcoy, Alacant (Alicante)
- Email: erum@erumgroup.com
- Phone: 965 330 817
WHAT PERSONAL DATA DO WE PROCESS?
All information collected by PLASTICOS ERUM SL will be processed fairly, lawfully, and transparently.
Likewise, the data requested in each of the processing activities will consist only of those strictly essential to achieve the intended and informed purpose in each case.
Thus, your collected data will be adequate, relevant, and not excessive in relation to the purposes for which they are processed in each case. Furthermore, your personal data will be collected for specific, explicit, and legitimate purposes, and will not be further processed in a manner incompatible with those purposes. In addition, they will be updated whenever necessary.
In general terms, within the framework of the different processing activities carried out in the organization, the following types are collected:
- Identification data.
- Commercial Information.
WHERE DO PERSONAL DATA COME FROM?
As a general rule, personal data are always collected directly from the data subject; however, in certain exceptions, data may be collected through third parties, entities, or services other than the data subject.
In this regard, this will be communicated to the data subject through the informative clauses contained in the different data collection channels and within a reasonable period or in the first communication made to the data subject.
FOR WHAT PURPOSE DO WE PROCESS PERSONAL DATA?
In general terms, personal data are processed for the following purposes:
- Newsletter: To send information through the provided means about news, events, products, and services related to us or our sector.
- Contact: To respond to information requests received about the products and services we offer, as well as to answer any other type of question sent by users.
- Retail: To manage requests received through the retail form, addressing queries or requests related to this channel.
- Profiling: To use your data to create a commercial profile based on your consumption habits, personal, and social characteristics. The creation of the profile will in no case result in automated decision-making that could be detrimental to the user.
- Candidates: To carry out internal personnel selection processes, both current and future.
- Internal information system (Whistleblowing Channel): Processing of data related to complaints or queries regarding possible breaches of the ethical code or internal regulations of the organization, acts or conduct that could be contrary to general or sectoral regulations, with the purpose of managing investigation processes of possible complaints or queries. Through these processing activities, profiles of our website visitors are created to make automated decisions based on the logic described in this privacy policy.
WHAT IS THE LEGAL BASIS FOR DATA PROCESSING?
As a general rule, the data subject’s consent is the legal basis for data processing according to the purposes described above. This consent is manifested by a statement or a clear affirmative action, such as checking a box provided for this purpose, voluntary subscription, or by sending data through forms. This consent can be revoked at any time by contacting the company through its contact channels, and, in general, we will request your consent for uses for purposes other than those for which you initially granted them.
Specifically, and for the processing activities indicated below, the following legal bases are used:
- Newsletter and Candidates. The legal basis is the explicit consent of the data subject (Art. 6.1.a GDPR), manifested by voluntarily checking the box provided for this purpose. The data subject can withdraw their consent at any time.
- Contact and Retail. The legal basis is the legitimate interest of PLASTICOS ERUM SL (Art. 6.1.f GDPR) in responding to information requests received through the forms available on the website.
- Internal information system (whistleblowing channel). Compliance with legal and regulatory obligations: Including, but not limited to, the General Law for the Defense of Consumers and Users, General Tax Law, Corporate Income Tax Law, Audit Law, Value Added Tax Law, Civil Code, Commercial Code, as well as the existence of a specific law or regulation that authorizes or requires the processing of the data subject’s data, which will be stated in the corresponding informative clause.
In relation to the Internal Information System, the law regulating the protection of persons who report regulatory infringements and corruption applies.
- Legitimate interest: data processing based on the controller’s legitimate interest will be established, mainly, for sending commercial communications or events about products or services similar to those contracted. According to Article 21.2 of the Information Society Services Law, this processing will only be valid when, being a client, you have not expressly objected at the time of data collection or in any of the communications we send.
HOW LONG DO WE RETAIN PERSONAL DATA?
In general, personal data are processed for the time necessary to fulfill the purpose for which they were collected, as long as the service provision or contractual relationship is maintained, there is a mutual interest, and/or for the period provided in the corresponding regulations.
Once the established deadlines are met, the data will be canceled. Such cancellation will result in the blocking of the data, which will only be kept at the disposal of Public Administrations, Judges, and Courts, to address any possible liabilities arising from the processing, during their statute of limitations period. Once this period has expired, the information will be destroyed.
Specifically, and for the processing activities indicated below, data are retained for the following periods:
- Contact and Retail: Data will be retained until the query is resolved and, subsequently, blocked for a maximum of 3 years due to the statute of limitations for civil actions.
- Newsletter: Data will be retained until the data subject withdraws their consent or requests to unsubscribe.
- Candidates: Data will be retained for a maximum period of 1 year or until the data subject withdraws their consent or requests the deletion of their data for current or future selection processes.
- Internal information system (Whistleblowing Channel): Data will be retained as long as necessary to fulfill the purpose for which they were collected. In any case, three months after the data is entered, it will be deleted from the whistleblowing system, unless the purpose of retention is to provide evidence of the operation of the crime prevention model by the legal entity. After the aforementioned period, the data may continue to be processed by the body responsible for investigating the reported facts, but will not be kept in the internal whistleblowing information system itself.
WITH WHOM DO WE SHARE PERSONAL DATA?
To fulfill the purposes described above, personal data may be shared with:
- Technology providers acting as data processors in accordance with Art. 28 GDPR, including, by way of example, the web platform provider, the email service provider, and the cookie management platform (Cookiebot/Cybot A/S). These providers will only process data according to the instructions of PLASTICOS ERUM SL and will not use them for their own purposes.
- Public Administrations, Judges, and Courts, when there is a legal obligation to do so.
- ERUM Group companies: Data may be shared with companies of the Erum Group when necessary to:
- Provide internal, administrative, or technological support.
- Ensure the provision of service under the integrated corporate structure.
In case of business restructuring or acquisition, data will be transferred in accordance with data protection regulations and maintaining the commitments assumed in this Policy.
In any case, data communication will be limited to strictly necessary information, will be carried out with due security and confidentiality guarantees, and data will not be used for purposes other than with the consent and, where appropriate, the consent of the data subject.
ARE INTERNATIONAL DATA TRANSFERS CARRIED OUT?
We inform you that some of the technology providers used on this website may transfer data outside the European Economic Area. Specifically:
- Google LLC (USA), provider of Google Tag Manager and Google Analytics: the transfer is covered by the European Commission’s adequacy decision regarding the EU-US Data Privacy Framework (adopted in July 2023).
- Cybot A/S (Denmark/USA), provider of Cookiebot: the transfer is covered by the appropriate safeguards established in accordance with the GDPR.
The applicable safeguards are available to anyone who expressly requests them by contacting erum@erumgroup.com.
WHAT RIGHTS CAN YOU EXERCISE?
According to European regulations, the rights you have are the following:
- Right of Access, the right to request information from the controller of a file about whether your personal data is being processed.
- Right to Rectification, the right that allows the affected person to request the modification of data that is inaccurate or incomplete.
- Right to Object, the right of a person to object to the processing of their personal data or to cease it.
- Right to Automated Individual Decision-Making, the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
- Right to Restriction of Processing, the right to suspend the processing of the user’s personal data in certain cases.
- Right to Erasure or Right to be Forgotten, the right to erase the data subject’s personal data.
- Right to Data Portability, the right to request the controller to provide personal data in a structured and clear format to another controller.
- Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
- Right to lodge a complaint with the competent supervisory authority if you consider that the processing does not comply with current regulations.
HOW TO EXERCISE YOUR RIGHTS?
The applicant can exercise their rights through the following means:
- Email to erum@erumgroup.com.
- Postal mail to Partida de Sant Benet Baix, Polígono industrial El Clérigo. Parcela 2A, 03802 Alcoy, Alacant (Alicante).
In both cases, if necessary, documentation proving the applicant’s identity may be required.
In any case, you can request the protection of the Spanish Data Protection Agency through its website.
In this regard, your request will be attended to within a maximum period of 1 month from the receipt of the request, extendable up to 3 months in cases of special complexity, with prior notification to the data subject (Art. 12.3 GDPR).
WHAT COULD BE THE CONSEQUENCES OF NOT PROVIDING THE INFORMATION?
The data requested in the established fields marked with an asterisk, or identified as mandatory, or those provided in the means where the information is given, are those strictly necessary in relation to the purpose for which they are collected, or for the provision of an optimal service to the data subject or by a legal obligation imposed on the data controller himself or a necessary requirement to sign a contract, with the inclusion of data in the remaining fields being voluntary.
In the event that not all data are provided, it is not guaranteed that the information and services provided will be fully adjusted to your needs.
Therefore, if the required data are not provided or are provided incorrectly or incompletely, your request cannot be processed, making it entirely impossible to provide the requested information or carry out the contracting of services.
Likewise, the user guarantees that the information transmitted in any of the forms is truthful, accurate, and corresponds to their own data of which they are the owner.
How is profiling carried out?
PLASTICOS ERUM SL may create a commercial profile based on the information provided by the data subject and their interactions with the offered content, with the purpose of sending personalized information about our products or services, including by electronic means. The legal basis for profiling is the legitimate interest of PLASTICOS ERUM SL to understand the data subject’s profile in its communications and services to offer personalized information and content adapted to their interests and activity. No automated decisions will be made based on said profile. The User may at any time object to the profiling of their information through the channel enabled for this purpose.
- Subscription to our Newsletters. We will process your identification and contact data to send you personalized information about our products, promotions, offers, as well as products and offers from our partners. To carry out this purpose, we create a profile of users that allows us to personalize the information we send you, adapting it to the tastes and preferences we know based on your browsing habits or even information collected through the use of cookies and other similar technologies (for more information on the use of cookies, visit our Cookie Policy).
- Other marketing and advertising purposes: We will use your data to show you advertising on other pages, apps, or social networks you frequent. This advertising is usually based on a profile created according to your history on our website.
WHAT SECURITY MEASURES DO WE HAVE IN PLACE?
The security measures adopted by PLASTICOS ERUM SL are those required, in accordance with the provisions of Article 32 of the GDPR.
In this regard, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, appropriate technical and organizational measures have been established to ensure a level of security appropriate to the existing risk.
In any case, PLASTICOS ERUM SL has implemented sufficient mechanisms to:
- Ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
- Restore the availability and access to personal data quickly in the event of a physical or technical incident.
- Regularly verify, evaluate, and assess the effectiveness of the technical and organizational measures implemented to ensure the security of processing.
- Enable data and communications encryption.
CHANGES TO THIS PRIVACY POLICY
Eventually, this Privacy Policy may be revised to update changes in current legislation, update procedures for collecting and using personal information, the appearance of new services, or the exclusion of others. These changes will be effective from their publication on the website, so it is important that you regularly review this Privacy Policy to stay informed about the changes.