PROFITHOL PRIVACY POLICY

Last updated: 14/07/2022

PROFITHOL, S.A. (hereinafter, "PROFITHOL") with Tax Identification Number A-16729196 and registered office at Av. Cabrera, 36, oficina 7-8, Edificio Torre d’Ara, 08302, Mataró, duly registered in the Commercial Register of Barcelona in Volume 48323, Sheet 26, Page B-567891, informs you by means of this Privacy Policy how your personal data will be treated.

As a rule, the completion of all the data requested by PROFITHOL is necessary for the optimal provision of the services made available to the User. Failure to provide all the information required by PROFITHOL does not guarantee that the information and services provided can be provided, are provided correctly or meet the needs of the customer or user.

The term User/s is used here to refer to all persons of legal age who are customers or potential customers of PROFITHOL.

BASIC INFORMATION ON DATA PROCESSING

Data Controller	PROFITHOL, S.A.
Purpose of the processing	Service provision.
	Management of communications and resolution of queries.
	Customer Service Management of the Grupo Solar Profit.
	Management of the internal administration functions of the Grupo Solar Profit.
Legal grounds for the processing	The processing of personal data is based on consent, contract performance and legitimate interest.
Recipients	Data will be disclosed to other Grupo Solar Profit entities, third party partners and other entities where there is an appropriate legitimate basis for doing so.
Rights	Access, rectification, erasure, objection, restriction of processing, data portability, not to be subject to automated decision-making and to revoke the consent given. You may also contact our DPO at dpo@solarprofit.es, as well as file a complaint with the Spanish Data Protection Agency, if you deem it appropriate.
Additional information	Detailed information on the processing of your data can be found below.

DETAILED INFORMATION ON DATA PROCESSING

1. Name and contact details of the Data Controller

In accordance with the terms of the applicable data protection regulations and, in particular, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, "GDPR"), Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter, the "LOPDGDD") and Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (hereinafter, "LSSICE"), the Data Controller is:

Data Controller	PROFITHOL, S.A.
Tax Identification Number	A-65009979
Headquarters	Cabrera 36 Avenue, Torre d’Ara building, 1st floor, Offices 7-8, 08302 Mataró (Barcelona)
Telephone number	+34 937 323 595
Contact email address	dpo@solarprofit.es

2. Compliance with applicable regulations

PROFITHOL has adapted its activity to the GDPR and the LOPDGDD. To do so, it has implemented those policies, measures and technical and organisational procedures to guarantee and protect the confidentiality, integrity and availability of your personal data.

The transmission of data by the user, customer and potential customers of PROFITHOL services (hereinafter, collectively, the "User"), whether by automated or non-automated means, is carried out voluntarily and the user is informed prior to processing of the use and purposes of the data.

3. The principles we apply to your personal information

The data provided to PROFITHOL by different means, online or offline contact forms or any other procedure used to collect your data, will be carried out in accordance with the data protection regulations in force, and with the sole purpose of providing the service you have been informed about.

In the processing of your personal data, we apply the following principles that comply with the requirements of the GDPR:

The principles of lawfulness, fairness and transparency: We will always have a legal basis for processing your personal data for one or more specific purposes, which we will inform you about in advance in full transparency. PROFITHOL informs you that only the information necessary to achieve the purpose of the processing will be collected and only the data you have provided will be processed for the purpose(s) for which you were informed.
The data minimisation principle: We will only ask you for data that is strictly necessary in relation to the stated purposes.
The principle of limitation of the term of retention: Personal data shall be kept for the time strictly necessary to the end of the purpose for which they were collected, and as long as the cause that made the processing of these personal data legitimate is maintained. When the reason that legitimised the processing has ended, the personal data will be kept securely stored for the term of the statute of limitations for any actions that may arise from the relationship between the parties and/or the legally stipulated storage periods.
Principle of integrity: Your data will be processed in such a way as to ensure adequate security of personal data and to guarantee confidentiality. You should be aware that we take all necessary precautions to prevent unauthorised access or misuse of data by third parties.
Principle of confidentiality: PROFITHOL, in its capacity as Data Controller, guarantees confidentiality in the processing of all personal data of the User to which it has access. As with any other person involved in any phase of the processing, the Data Controller is subject to the strictest professional confidentiality, with a special commitment to adopt the necessary levels of protection and measures, both strategy and organisational, to guarantee the security of personal data and to avoid its alteration, misuse, loss, theft, unauthorised processing or access.
Principle of data accuracy: All information provided by the User to PROFITHOL must be truthful, and the User will be solely responsible for any false or inaccurate statements made and for any damages caused to PROFITHOL or third parties.

PROFITHOL reserves the right to exclude from the services any User who has provided false information, without prejudice to any other legal action that may be appropriate.

4. Processing of personal data

4.1. Collection and processing of personal data

In providing us with their data through the Website, online or offline forms or by any other means, the User guarantees that they are truthful, exact, complete and up to date, and shall be liable for any direct or indirect damage or harm that may be caused as a result of non-compliance with this obligation.

In the event of providing PROFITHOL with third party data, the User must have the consent of the third party and undertake to provide them with the information contained in this clause, exempting PROFITHOL from any liability in this regard. However, PROFITHOL may carry out checks to verify this fact, adopting the appropriate due diligence measures, in accordance with data protection regulations.

4.2. Purposes of processing

The purposes of the processing carried out by PROFITHO of the User's personal data are:

Data processing	Purpose of processing	Legal grounds of the processing	Retention time
Service provision	To manage the contractual relationship with the client, including the sending of communications related to the provision of the service via email and/or SMS, and to carry out the execution of the contracted services, which include the preparation of the strategy, the plans and the final registration.	Performance of the contract.	6 years after the end of the contractual relationship.
Communication management and query resolution	To attend to and adequately manage the queries and communications sent by the User through generic emails, contact forms and any other communication channel made available by PROFITHOL.	Consent of the person concerned and/or execution of the contract.	12 months after a consultation; and in case of a contractual relationship with the user, 6 years after the end of the contractual relationship.
Customer Service Management at Grupo Solar Profit	To manage the Grupo Solar Profit customer service, manage the emails received, the calls, communications and queries made by consumers and users, as well as the recording of the voice messages they leave on the Grupo Solar Profit customer service switchboard managed by PROFITHOL, in order to record and resolve queries and incidents and communicate them to the corresponding Grupo Solar Profit company.	Execution of the contract (pre-contractual measures).	12 months after a consultation; and in case of a contractual relationship with the user, 6 years after the end of the contractual relationship.
Management of internal administration functions	Manage the internal administration functions of the Grupo Solar Profit, such as accounting and customer billing, customer service, communication, IT and human resources, and other central services of the Group.	Legitimate interest in accordance with paragraph 48 of the GDPR.	6 years after the end of the contractual relationship.

Upon termination of the legitimate grounds for the processing of your data, said data may be kept duly stored and will not be processed unless it is necessary for the submission, exercise or defence of claims or when it is required to provide the same to the Public Administration, Judges and Courts during the period of limitation of their legal rights or obligations.

4.3. Data Category

For the purposes mentioned above, PROFITHOL collects and processes the following categories of User data:

Identification and contact details: name, surname, email address, country, address, proof of identity ( National ID card/Foreign ID/Passport), voice and signature.
Financial and tax data: bank details, SEPA, data necessary to issue invoices and corresponding credit notes.
Data derived from the contract: the contract and conditions of sale with the companies of the Grupo Solar Profit with which it has been contracted.
We also collect certain information related to your navigation through cookies. Their treatment and purposes are explained in our Cookies Policy.

Other User data obtained from the consultation itself or from the commercial relationship, which are necessary for the management of the pre-contractual relationship and for the resolution of the consultation, may be gathered and processed.

Under no circumstances will the User communicate data of any special nature (such as, for example, health data, religious data, etc.). In the event of doing so, the User exempts PROFITHOL from all liability. In the event that inappropriate queries or content are submitted, PROFITHOL will remove them.

5. Data processing by third parties and transfer

Depending on the purposes for which personal data are collected, your personal data may be processed by:

Authorised PROFITHOL personnel or their representatives acting on their behalf, subject to the applicable data protection regulations in force.

Grupo Solar Profit entities, when strictly necessary to carry out the purposes of the reported data processing and for internal administrative purposes.

The entities that currently make up the Grupo Solar Profit are: Solarprofit Sales, S.L.U.; Solar Profit Energy Services S.L.; Profithol, S.A.; Ingenia Ambiental S.L.U.; SolarProfit Iberica, SLU; and Solarma Sistemas de Control y Seguridad S.L. Any change in the structure of Grupo Solar Profit will be communicated through this privacy policy.

Third parties with which Grupo Solar Profit maintains collaborative relationships and/or other entities that offer products and services related to the sector, as well as products and services from other sectors that may be of interest to the User, as long as the interested party is informed of the processing of their data beforehand and consent or another legitimate basis has been obtained in accordance with this policy.

Public Administrations, Public Authorities and Bodies, including Courts and Tribunals, when required by the applicable regulations.

Third party external service providers contracted by PROFITHOL who have the status of data processor [IT service providers who process information, host servers, maintain database support, software and applications]. This is only after we have taken steps to ensure that we can share such information in compliance with data protection regulations.

If there is a sale, merger, consolidation, change in corporate control, substantial transfer of assets, reorganisation or liquidation of PROFITHOL, then we may, at our discretion, transfer, sell or assign the information collected on the Site to one or more relevant parties.

6. Security measures

PROFITHOL adopts the security levels required by the GDPR appropriate to the nature of the data that are processed at all times by its activity. In this sense, it uses encryption techniques that do not allow a third party to trace the identity of the User interacting with our services. Similarly, it may also carry out secure anonymisation strategies for the personal data it processes in order to carry out its activities. However, the strategy in a medium such as the Internet is not infallible and there may be fraudulent actions by third parties, although PROFITHOL makes every effort to prevent such actions.

7. International data transfer

No data is disclosed to third parties outside the European Economic Area. In this sense, PROFITHOL takes appropriate technical and organisational measures to guarantee data security. It also requires its third party service providers and partners, where applicable, to have adequate safeguards in place.

In the event that international transfers of your data are necessary, PROFITHOL ensures that (i) such personal data are transferred to countries that offer an equivalent level of protection, or (ii) the transfer is carried out in accordance with appropriate safeguards, for example by adopting the standard data protection clauses established by the European Commission.

8. The rights of data subjects and the exercise of these rights

In accordance with both the GDPR and the LOPDGDD, Users may exercise the following rights:

Rights of access: The User may ask PROFITHOL if it is processing his or her data and, if so, may access said data.
Right of rectification: The User may request rectification of the data if it is inaccurate or incomplete.
The right to request the erasure of their data, where possible. However, as soon as the User exercises this right, all personal data linked to his/her account, as well as the information and content included in his/her profile, will be deleted and will remain stored until the end of the legally stipulated term. Similarly, in the event that the User exercises the right to delete the data necessary for PROFITHOL to be able to provide the contracted services, PROFITHOL will be obliged to terminate its relationship with the User, and will proceed to unsubscribe the User, without the right to make any claim whatsoever on the part of the User.
Right to request the limitation of processing: In this case, we will only retain them for the exercise or defence of claims.
Right to object to processing: PROFITHOL will stop processing personal data, with the exception of data that must continue to be processed for reasons of compelling legitimate interest or for the exercise or defence of possible claims.
Right to data portability: In the event that the User wants his/her data to be processed by another data controller, PROFITHOL will facilitate the transfer of his/her data to the new data controller if both have the necessary technical means to do so.
The right not to be subject to a decision based solely on automated processing of their personal data.
Right to revoke consent: If the User has given consent for a specific purpose, he or she may withdraw such consent at any time, without this affecting the lawfulness of the processing based on the consent prior to its withdrawal.
Right to make a complaint with the Spanish Data Protection Agency: If you consider that a breach of data protection legislation has been committed with regard to the processing of your personal data (https://www.aepd.es/es)

To exercise your rights, you can use the templates and forms available on the official website of the Spanish Data Protection Agency (https://www.aepd.es/es/derechos-y-deberes/conoce-tus-derechos), and write to PROFITHOL's Data Protection Officer at the following email address dpo@solarprofit.es, REF: "Data Protection".

9. User Consent

The User declares to have read and expressly accepted this Privacy Policy, and accepts it when the legal basis for the processing is his or her consent.

The User undertakes to exempt PROFITHOL from any possible claim, fine or penalty that it may be obliged to pay as a result of the User's failure to comply with the duty described in this paragraph.

10. Changes to the privacy policy

We will only use personal data in accordance with the Privacy Policy in effect at the time such data is collected.

PROFITHOL reserves the right to modify this Privacy Policy at any time with effect from the date of publication of such modifications, so it is recommended that you review it each time you access it. If at any time we decide to use personal data in a manner different from that stated at the time it was collected, this will be communicated to the User by email, where available to us. At this point, you will be given the option to consent to other uses or disclosures of the personal information you provided to us prior to the change in our Privacy Policy.

Should any clause of this Privacy Policy be annulled or considered null and void, the rest of the conditions shall not be affected, and shall remain fully valid and in force, in accordance with the applicable regulations in force at any given time.

11. Governing Law

The privacy of all information provided, both by the User through the different forms for requesting personal data, and that made available through the Website, is regulated by the data protection regulations in force, especially by the GDPR and the LOPDDGDD.

12. Cookies

Access to the website may involve the use of cookies. Cookies are small pieces of information that are stored on the browser used by each user so that the server remembers certain information that can be subsequently used. This information allows us to distinguish you as a specific user and to store your personal preferences, as well as strategic information about the use and operation of the Website.

Users who do not wish to enable cookies or who wish to be informed before they are stored on their devices can configure their own device to that effect. For more information, you can consult our Cookie Policy.