1. Data Controller
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “GDPR”), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, the “LOPDGDD”), users are hereby informed about the processing of their personal data.
The data controller is:
Data Controller: ECOFICUS, S.L. (hereinafter, Ecoficus)
NIF: ESB10214021
Business activity: Marketing and processing of figs.
Address: Polígono del Casar, Naves 21-23, 10190 Casar de Cáceres (Cáceres), Spain.
Telephone: +34 927 290 577
Email: info@ecoficus.com
Website: www.ecoficus.com
2. What personal data do we process?
Ecoficus may process personal data provided directly by the data subject in the context of their commercial, contractual or other dealings with the company.
Depending on the relationship concerned and the services used, the data processed may include, among other things, identification and contact details, information relating to enquiries, commercial and financial information, billing, collection or payment data, and any other information voluntarily provided by the data subject where necessary to deal with their request or manage the relevant relationship.
No personal data will be requested unless it is adequate, relevant and necessary for the purposes for which it is processed.
3. For what purposes do we process your data?
Ecoficus may process your personal data for the following purposes:
a) Responding to enquiries and requests for information
To manage and respond to enquiries, requests for information or communications sent to Ecoficus by email, telephone, web forms or any other available contact channel.
Legal basis: taking steps at the request of the data subject prior to entering into a contract where the enquiry relates to a potential contractual relationship and, in all other cases, Ecoficus’s legitimate interest in responding to communications voluntarily addressed to it.
b) Managing commercial and contractual relationships
To manage orders, sales, quotations, relationships with customers and suppliers, invoicing, collections, payments, after-sales support and, generally, all activities necessary to maintain and perform the relevant commercial or contractual relationship.
Legal basis: performance of a contract or taking steps at the request of the data subject prior to entering into a contract.
Certain processing activities relating to invoicing, accounting, taxation or other administrative obligations will also be carried out on the basis of compliance with legal obligations applicable to Ecoficus.
c) Compliance with legal obligations
To process and, where appropriate, disclose personal data where necessary to comply with legal, tax, accounting, administrative or other obligations applicable to Ecoficus.
Legal basis: compliance with a legal obligation.
d) Marketing communications
Where appropriate, Ecoficus may use your contact details to send you marketing information about its products, services or activities.
Where legally required, such communications will only be sent where the data subject has previously given their consent.
Where a prior contractual relationship exists, Ecoficus may send marketing communications relating to its own products or services which are similar to those originally purchased, in the circumstances permitted by the applicable legislation.
The data subject may object at any time to receiving marketing communications by using the unsubscribe mechanism included in the relevant communication or by contacting Ecoficus using the contact details set out in this Policy.
Legal basis: as applicable, the consent of the data subject or the legitimate interest recognised by the applicable legislation in relation to existing customers.
4. Is providing the data mandatory?
Any data identified as mandatory will be necessary in order to process the relevant request or manage the contractual or commercial relationship. The data minimisation principle laid down in the GDPR will always be observed.
Where the provision of data is voluntary, the data subject will be informed accordingly.
5. How long will we retain your data?
Personal data will be retained only for as long as necessary to fulfil the purpose for which it was collected and, thereafter, for the periods during which legal liabilities may arise from the relationship concerned.
In particular:
- Data relating to enquiries will be retained for as long as necessary to deal with them and, thereafter, for the period strictly necessary to address any potential liabilities.
- Data associated with contractual or commercial relationships will be retained for the duration of the relationship and, thereafter, for the applicable statutory limitation periods.
- Tax, accounting and invoicing documentation will be retained for the periods established by the relevant legislation.
- Data used for marketing communications will be retained for as long as there is a legal basis permitting its processing or until the data subject withdraws their consent or exercises their right to object, as applicable.
Once personal data is no longer required for ordinary processing purposes, it may remain duly blocked for the periods necessary to address any potential legal liabilities and will be deleted once those periods have expired.
6. To whom may we disclose your data?
As a general rule, Ecoficus will not disclose your personal data to third parties unless such disclosure is necessary to manage the relationship with the data subject, is required by law, or another valid legal basis exists which permits the disclosure.
In particular, where appropriate, data may be disclosed to:
- Public authorities, public bodies, courts and competent authorities where required under applicable legislation.
- Financial institutions and payment service providers for the management of collections, payments and financial transactions.
- Advisers, auditors or other professionals where their involvement is necessary to comply with legal obligations or to protect Ecoficus’s legal interests.
- Other third parties where a valid legal basis exists permitting such disclosure.
Certain service providers may also access personal data on behalf of Ecoficus in order to provide services required for its business activities, such as web hosting, IT services, email services, maintenance, administrative management or other professional services.
Where these service providers act as processors, their access to personal data will be governed by an appropriate data processing agreement in accordance with Article 28 GDPR.
7. International transfers of personal data
Ecoficus will seek to use service providers that process personal data within the European Economic Area or in territories offering an adequate level of protection.
However, certain technology providers may involve international transfers of personal data.
Where personal data is transferred to a third country or international organisation, Ecoficus will ensure that the transfer is carried out in accordance with the mechanisms provided for in Articles 44 et seq. GDPR, such as an adequacy decision adopted by the European Commission, Standard Contractual Clauses or other legally recognised appropriate safeguards.
Where applicable, the data subject may request further information about the safeguards used for international transfers by contacting Ecoficus using the contact details set out in this Policy.
8. Data security and confidentiality
Ecoficus will process the personal data under its responsibility confidentially and will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the nature, scope, context and purposes of the processing.
These measures are intended, among other things, to prevent the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Personnel who may have access to personal data will be subject to the corresponding duty of confidentiality.
9. Rights of data subjects
Where applicable, the data subject may exercise the following rights:
Right of access: the right to know whether Ecoficus is processing their personal data and to obtain information about such processing.
Right to rectification: the right to request the correction of inaccurate or incomplete personal data.
Right to erasure: the right to request the deletion of personal data where any of the circumstances provided for by law applies.
Right to object: the right to object to the processing of personal data in certain circumstances, particularly where the processing is based on legitimate interests or is carried out for direct marketing purposes.
Right to restriction of processing: the right to request that the processing of personal data be temporarily restricted where the statutory requirements are met.
Right to data portability: the right to receive the personal data provided by the data subject in a structured, commonly used and machine-readable format and to transmit those data to another controller where the conditions established in the GDPR are met.
Right to withdraw consent: the right to withdraw consent at any time where the processing is based on consent, without affecting the lawfulness of processing carried out before such withdrawal.
Right not to be subject to automated individual decision-making: where applicable, the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them, except in the circumstances permitted by applicable legislation.
To exercise these rights, you may contact:
ECOFICUS, S.L.
Polígono del Casar, Naves 21-23
10190 Casar de Cáceres (Cáceres – Spain)
Email: info@ecoficus.com
The request must enable the data subject to be properly identified and must specify the right they wish to exercise.
Ecoficus may request additional information where there are reasonable doubts concerning the identity of the person exercising the relevant right. As a general rule, it will not be necessary to provide a copy of a national identity document unless this is required to verify the identity of the applicant and such verification cannot be carried out by other, less intrusive means.
The exercise of these rights is free of charge, without prejudice to the exceptional circumstances provided for in the applicable legislation where requests are manifestly unfounded or excessive.
If you consider that the processing of your personal data infringes data protection legislation, you may first contact Ecoficus using the contact details provided above.
You also have the right to lodge a complaint with the competent supervisory authority and, in particular, with:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid
www.aepd.es
The exercise of this right does not require the assistance of a lawyer or court representative.
10. Automated decision-making and profiling
As a general rule, Ecoficus does not make decisions based solely on automated processing of personal data which produce legal effects concerning data subjects or similarly significantly affect them.
Nor will profiling producing such effects be carried out unless the data subject has been informed in advance and there is a legal basis permitting such processing in accordance with the GDPR.
If automated processing requiring specific information pursuant to Article 13(2)(f) GDPR is implemented in the future, Ecoficus will inform the data subject of its existence and, where applicable, provide meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing.
11. Further processing for other purposes
Ecoficus will not use personal data for purposes incompatible with those for which it was originally collected.
Where it is intended to process personal data subsequently for a different purpose, the compatibility of that purpose with the original purpose and the existence of a valid legal basis for such processing will be assessed in advance.
Where required by law, the relevant information will be provided to the data subject before the new processing begins and their consent will be requested where consent constitutes the necessary legal basis.
12. Accuracy of personal data
The data subject warrants that the information provided is true, accurate and up to date and undertakes to notify any changes that may be necessary.
Ecoficus will take reasonable steps to ensure that inaccurate personal data is rectified or erased once it becomes aware of the inaccuracy.
13. Changes to this Privacy Policy
Ecoficus may update this Privacy Policy where necessary as a result of legislative, case-law or technical developments, or changes to its personal data processing activities.
Where such changes are relevant to data subjects, reasonable measures will be taken to inform them accordingly.
Last updated: September 2026.