Your data.
And who touches it.

01Data controller

The controller of the personal data collected through this website and through the client portal is:

You can write to that address or that email about anything to do with your data, including exercising the rights explained in section 10. No special form is needed: an email is enough.

02What data we handle

We handle the data you give us and the data generated while the work is carried out. We do not buy databases and we do not build profiles.

What you give us

• Identification and contact details: name and surname or company name, NIF or CIF where there is a contract or an invoice, telephone number, email address and postal address.
• The address of the job and the details needed to get into it (floor, door, contact for the concierge or the management company).
• The content of your enquiry: what you want done, timescales, drawings or photographs you send us, and any documentation you provide.
• Billing and payment details once the relationship is formalised.

What is generated as we work

• The history of the job: quote and items, measurements, dates, progress, interim valuations and delivery notes.
• Photographs from the site survey and from the works themselves. They are photographs of spaces and of work done; we try to keep identifiable people out of them and, if any of them makes you uncomfortable, we take it down.
• The messages exchanged in the portal with the site manager, with their date.
• Technical data about portal access: date and time, action taken and IP address.

If you give us data about third parties —a relative who will open the door, the chair of the owners' association, an architect— you undertake to have told them beforehand that you are giving them to us and what for.

03Purposes and legal basis

Every processing operation has a specific purpose and a legal basis under article 6 of Regulation (EU) 2016/679 (GDPR). These are all of them:

Providing the data marked as compulsory in any form is necessary for the stated purpose: without the address of the job we cannot come and see it, and without a phone number or an email we cannot get back to you.

04How long we keep it

• Enquiries that do not end in a job: for as long as we are dealing with them and, afterwards, for up to a year, in case you ring again and so we do not have to ask you the same things twice. If you tell us to delete them sooner, we delete them.
• Clients whose work has been carried out: throughout the relationship and afterwards for as long as liabilities arising from it remain. In construction, the warranty periods of Spanish Act 38/1999 on building standards run to ten years for structural damage, and that is the period that governs how long the technical file for the job is kept.
• Accounting and tax records: the periods set by the Commercial Code (six years) and by tax law (four years from the end of the filing period, extendable).
• Client portal data: the job is closed but stays visible for a while after handover; the account is then deactivated. Access logs are kept for as long as their security purpose requires.
• Consents: until you withdraw them, and afterwards blocked for as long as is needed to prove they existed.

Once those periods have passed, the data are deleted or anonymised.

05Who we share it with

We do not sell or pass your data to third parties for commercial purposes. Ever. Only the people who need it to get the work done have access to it:

Processors

Service providers who process data on our behalf, following our instructions and under a signed contract in accordance with article 28 of the GDPR:

• The hosting provider for this website and for the client portal.
• The corporate email provider.
• The group's accounting, tax and payroll advisers, for invoicing and legal obligations.

Disclosures required by law or by contract

• Public authorities where a rule requires it: the tax authority, social security, town councils for permits, and the contracting authority and the supervising architect on jobs awarded through tender.
• Banks, to handle payments in and out.
• Courts, tribunals and law enforcement, when legally required.
• Other divisions of Grupo PEMAGA only when you ask for it —for example, if you want a kitchen quote through PEMAGA Home— and with the minimum information needed to help you.

The trades and suppliers working on a job receive only what they need to do their work: the address, how to get in and the work to be done. They do not receive your quote or your financial details.

06International transfers

The management systems of PEMAGA Building —the client portal included— run on infrastructure contracted within the European Union, so managing your job does not involve international data transfers.

There can be transfers, however, simply from loading this page: the Google Fonts typefaces and the GSAP and Lenis libraries are requested from content delivery networks with servers all over the world, and some of the companies that operate them have their parent company outside the European Economic Area. When those files are requested, your browser sends them your IP address. Those providers state that any processing this involves is covered by the mechanisms set out in chapter V of the GDPR —the Data Privacy Framework and standard contractual clauses. It is explained in the next section.

07The client portal

The portal (panel.grupopemaga.com) is the part of this relationship where most of your data sits, so it deserves a section of its own.

What data is handled there

• The identification and contact details of the person authorised to sign in, and their login credentials. Passwords are stored encrypted: nobody in the company can read them, only reset them.
• Your quote, item by item, with its measurements and amounts, and the photographs from the site survey attached to each item.
• The percentage of progress of your job and its breakdown by phase.
• The photographs of the work that we have reviewed and published, with their date.
• The messages you exchange with the site manager.
• The activity logs: which account signed in, when, from which IP address and what it did.

How access is set up

• Access is named: one account per authorised client, created by the office. There is no open sign-up and no public links that show a job.
• Each account reaches only its own jobs and quotes. The check runs on the server on every screen and on every photograph.
• The portal does not show internal costs, margins or other clients' data. The amounts you see are the ones in your quote.
• There is an activity log that records sign-ins and the relevant actions. It is there for the security of the system and to be able to establish what was done and when; it is not used to measure or to profile anyone.
• Share the password and you are sharing your job: whoever has it will see exactly what you see.

If the job is for a block of flats, we give access to whoever the owners' association tells us to —usually the chair and the management company— and those people handle the information within the scope of their duties. More detail on the client area page.

08Cookies and third-party services

This website does not install analytics, advertising or profiling cookies. There is no Google Analytics, there is no Meta pixel and there is no cookie banner, because there is no point asking permission for something we do not do.

What does happen is that, to look the way it looks and move the way it moves, the page loads three resources hosted outside our server. They are not cookies, but they do mean the provider in question receives your IP address, the browser you use and the page the file is requested from:

• Google Fonts (fonts.googleapis.com and fonts.gstatic.com), for the Cormorant Garamond, Jost and Space Mono typefaces. Controller: Google Ireland Limited.
• GSAP, the animation library, served from cdnjs.cloudflare.com (Cloudflare, Inc.).
• Lenis, the smooth-scrolling library, served from cdn.jsdelivr.net.

Those providers receive that technical information as part of any internet request; we do not collect it and we do not cross-reference it with anything. If you want to avoid it, you can block those domains with a browser extension: the site will still be readable, though the typeface will change and the animations will be lost.

The client portal does use technical session cookies, needed to keep you signed in as you move around and to protect the forms. Without them you cannot get in, which is why they are exempt from the duty to obtain prior consent under article 22.2 of the Spanish LSSI.

Outbound links to WhatsApp, to pemagahome.com or to social media lead to third-party services with their own policies: when you click them, you leave this website.

09Information security

We apply technical and organisational measures appropriate to the risk, in accordance with article 32 of the GDPR: traffic encrypted over HTTPS, passwords stored encrypted, role-based access control —each person in the company sees what they need for their work and no more—, activity logging and regular backups.

No system is infallible. If there were a security breach posing a high risk to your rights, we would tell you and would notify the supervisory authority within the periods laid down in articles 33 and 34 of the GDPR.

10Your rights

The GDPR and Spanish Organic Act 3/2018 (LOPDGDD) give you the following rights over your data:

• Access: to know what data of yours we handle and to obtain a copy.
• Rectification: to correct data that are inaccurate, or complete them.
• Erasure: to ask us to delete data once they are no longer needed, as long as there is no legal duty to keep them.
• Objection: to object to processing based on our legitimate interest, including receiving commercial messages.
• Restriction: to ask us to pause processing while a challenge is being checked.
• Portability: to receive, in a structured and commonly used format, the data you have given us that we process under a contract or with your consent.
• Withdrawing consent at any time, without that affecting the lawfulness of processing carried out beforehand.
• Not being subject to automated decisions: there are none here. Quotes are written by a person.

To exercise them, write to avisos@grupopemaga.com or send a letter to PEMAGA Building SL, C/ Riera de la Salut, 47, 08980 Sant Feliu de Llobregat (Barcelona), saying which right you are exercising and enclosing a copy of your ID card or equivalent document so we can verify who you are. It is free and we reply within one month at the latest.

If you think we have not dealt with your request properly, or that we are handling your data improperly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es). Before that, we would rather you told us: if something is wrong, we would prefer to fix it.

11Children

The services on this website are aimed at adults with the capacity to enter into a contract. We do not knowingly collect children's data. If we find that a piece of data belongs to a child without the authorisation of whoever has parental responsibility, we delete it.

12Changes to this policy

This policy may be updated if the services, the providers or the rules change. The version in force is always the one published on this page, with its revision date at the top. If a change substantially affects how we handle your data, we will tell you through the contact details we hold.