Back to the website

Privacy and personal data protection policy

SVX LABs, S.L. In accordance with the GDPR (EU) 2016/679 and the Spanish LOPDGDD (Organic Law 3/2018). Version 1.0, approved on 31/05/2025.

This is an English translation provided for information purposes. In the event of any discrepancy, the Spanish version shall prevail.

1. Data controller information

2. Purpose and scope

This Privacy Policy governs the processing of personal data carried out by SVX LABs, S.L. (hereinafter "SVX LABs" or "the Company"), both as Data Controller and, where applicable, as Data Processor on behalf of its clients.

This policy applies to:

• All personal data processed by SVX LABs in the course of its activities.
• All natural persons whose data is processed: employees, candidates, clients, suppliers, website users and any other data subjects.
• All SVX LABs staff and any third parties processing personal data under its responsibility or instructions.

3. Personal data processed and purposes

3.1 Clients and business contacts

Legal basis: performance of a contract and legitimate interest (Art. 6.1.b and 6.1.f GDPR).

• Identification and contact data (first name, surname, email, telephone, position).
• Data required for invoicing and accounting.
• Purpose: management of the contractual relationship, provision of the contracted services, invoicing and service-related communications.

3.2 Suppliers and partners

Legal basis: performance of a contract and legitimate interest (Art. 6.1.b and 6.1.f GDPR).

• Identification and contact data of contact persons or representatives.
• Purpose: management of the contractual relationship, suitability checks and compliance with legal obligations.

3.3 Employees and candidates

Legal basis: performance of a contract and legitimate interest for employees (Art. 6.1.b and 6.1.f GDPR); consent for candidates (Art. 6.1.a GDPR).

• Employees: identification and contact data, bank details for payroll, and data required to comply with employment, tax and Social Security obligations.
• Candidates: identification and contact data and any CV voluntarily provided.
• Purpose: human resources management, recruitment and compliance with employment and legal obligations.

3.4 Website users

Legal basis: consent and/or legitimate interest, depending on the specific purpose (Art. 6.1.a and 6.1.f GDPR).

• Data provided through contact forms: name, email and message.
• Browsing data collected through cookies (in accordance with the Cookie Policy published on the website).
• Purpose: responding to enquiries, sending requested information and improving the website.

3.5 Marketing and commercial communications

Legal basis: express consent of the data subject (Art. 6.1.a GDPR).

• SVX LABs will only send commercial or promotional communications to those who have given their express consent.
• Data subjects may withdraw this consent at any time by writing to [email protected].

4. Security measures

SVX LABs applies the technical and organisational measures necessary to ensure the security of personal data and prevent its alteration, loss, or unauthorised processing or access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. These include:

• Encryption of data in transit and at rest.
• Role-based access control: only authorised staff can access personal data.
• Confidentiality agreements signed by all employees and partners with access to personal data.
• Periodic reviews and audits of the security measures in place.
• Ongoing staff training in data protection.

5. Data subject rights

In accordance with the GDPR and the LOPDGDD, data subjects may exercise the following rights by writing to [email protected], enclosing a copy of their identity document:

SVX LABs will respond to requests within a maximum of one month from receipt, which may be extended in complex cases. If you do not receive a satisfactory response, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

6. Data retention

Personal data will be kept only for as long as strictly necessary to fulfil the purpose for which it was collected and, thereafter, for the applicable statutory limitation periods:

Once the retention periods have expired, the data will be securely deleted or anonymised for statistical purposes.

7. International data transfers

As a general rule, SVX LABs does not transfer personal data outside the European Economic Area (EEA). Should any technology service provider involve such a transfer, SVX LABs will ensure that it is carried out with the appropriate safeguards provided for in the GDPR (standard contractual clauses approved by the European Commission or other equivalent mechanisms).

8. Disclosure of data to third parties

SVX LABs will not disclose personal data to third parties except in the following cases:

• Where necessary to provide the contracted service (providers acting as Data Processors under a contract in accordance with Art. 28 GDPR).
• Where there is a legal obligation (tax authorities, Social Security, courts, etc.).
• Where the data subject has given their express consent.

Data Processors engaged by SVX LABs only process personal data in accordance with the documented instructions of SVX LABs and are subject to confidentiality and security obligations equivalent to those set out in this policy.

9. Security incident management

SVX LABs has an internal procedure for detecting, recording and managing personal data breaches. Where a breach is likely to result in a risk to the rights and freedoms of data subjects, SVX LABs will notify the Spanish Data Protection Agency within 72 hours of becoming aware of it, in accordance with Art. 33 GDPR, and will inform those affected where required under Art. 34 GDPR.

10. Privacy by design and by default

SVX LABs applies the principles of privacy by design and by default (Art. 25 GDPR), which means:

• Collecting only the data strictly necessary for each purpose (data minimisation).
• Building data protection measures into the design of new products, services and processes.
• Periodically reviewing the relevance of the data processed and deleting data that is no longer necessary.
• Ensuring that, by default, only the data essential for each specific purpose is processed.

11. Updates to this policy

SVX LABs reserves the right to amend this Privacy Policy to reflect changes in legislation, case law or the guidance of the Spanish Data Protection Agency, as well as changes in the processing carried out by the Company. The current version will always be available on the corporate website, and data subjects will be informed of significant changes through the means available.

12. Contact

For any enquiry, exercise of rights or communication relating to data protection, please contact:

Approved by the Management of SVX LABs, S.L.

Madrid, 31 May 2025