Privacy policy

Purpose

The purpose of this Privacy Policy is to inform individuals (hereinafter, users or data subjects) who visit our website (hereinafter, website or web) about how we collect, process, and protect the personal data they choose to provide us through any means (forms, emails, telephone, contracts, etc.), so that after reading it they may freely decide whether they wish us to process their data. In addition, it serves to provide further information to data subjects beyond that already provided in the information clauses included in the processes for collecting their personal data.

Furthermore, this policy aims to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter GDPR), as well as Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD).

Who is responsible for processing your personal data?

Entity:	PROGRESSA LEAN, S.L.
CIF/NIF:	B98754088
Postal address:	C/ Uruguay 11, 601ª, 46007 Valencia (Valencia) Spain.
Phone:	(+34) 96 3220379
Email:	info@progressalean.com
Corporate purpose:	Engineering consultancy and training
Website:	https://www.progressalean.com/
Registration details:	Valencia Mercantile Registry, Volume 9995, Book 7277, Folio 13, Section 8, Sheet V-166429

What personal data will we process and how do we obtain it?

For the development of our business activity, it is essential to process personal data, which may be collected through digital means, paper documents, or as a result of face-to-face or telephone conversations. In all such cases, the data will be processed in a fair, lawful, and transparent manner.

The categories of data that our entity will process regarding data subjects are:

Identification data: name and surname, DNI or equivalent document, image, voice and signature.
Contact data: telephone, email, postal address.
Training data: courses completed, participation in events, diplomas and certificates.
Commercial data: quotations, purchase conditions, management and history of services and/or purchases, result of contacts (telephone, email, messaging and other communication channels).
Accounting data: income and expense control, billing data.
Bank details: bank accounts and cards.
Curricular data: academic data, professional experience, personal characteristics, etc.
Transaction of goods and services: bank transfers and direct debits, amounts and concepts.
Browsing data: analysis of time spent on our website, pages visited, demographic data (e.g. age, sex, language).

Our entity will not collect special category data (e.g., health data, ethnic origin, political opinions, or religious beliefs). However, if it becomes necessary to process such data, you will be informed and your prior and explicit consent will be requested.

Accordingly, the requested data will be adequate, relevant, and limited to what is strictly necessary. They will be processed exclusively by personnel and/or collaborators authorized by our entity, who have signed a confidentiality agreement and are committed to complying with the necessary security measures that ensure the confidentiality, integrity, and availability of the processed data, as well as other legally required provisions under the GDPR. Therefore, they will be processed in full compliance with the law.

The data to be processed are provided by the data subject themselves or by their legal representative. However, in some cases, we may delegate certain functions to collaborators who may collect your data on our behalf, although such data will always be processed with your prior and explicit consent.

In the event that a data subject does not provide the requested data, or provides incomplete or incorrect data, it will not be possible to establish or maintain the relationship with them.

The categories of data that we may process in relation to an individual will depend on the relationship they maintain with our entity, as set out below:

Clients:

Identification, contact, commercial, accounting, banking, and goods and services transaction data will be processed, and may only be collected if the client provides them at the time of contracting services, requesting pre-contractual measures, or during the maintenance of the service relationship, whether in person, by telephone, email, or through forms available on our website, online chat, instant messaging, etc.

Participants:

Information or demo requesters:

Whether the information is requested in person, by telephone, or in writing (e.g., email or web forms), we will request and/or process identification, contact, and commercial data.

Suppliers:

Identification, contact, commercial, accounting, banking, goods and services transaction, and financial data will be processed. These data may be processed throughout all stages of the business relationship and only if the supplier provides them in order to initiate the commercial relationship.

Job applicants:

For this category of data subjects, curricular, identification, contact, and other data related to their professional or personal characteristics will be processed. These data will be provided by the applicant themselves when submitting their application through any means (e.g., in person, email, web forms). They may also be collected during recruitment interviews (in-person or remote), and applications may even be received through a collaborator to whom we have delegated certain functions. For further information, please consult our Job Applicants Policy.

Social media users:

We are present on various social networks and may process identification, contact, commercial, and other data that the user enables to be displayed or shared with other users of the social network, including curricular data (e.g., LinkedIn). For further information, please consult our Social Media Policy.

Subscribers:

In the subscription forms for our newsletters, an email address is requested, which may be voluntarily provided by the interested party.

Claimants:

Identification, contact, and personal information relating to the claimant or third parties submitted by the claimant will be processed.

Visitors:

Identification, contact, and company data (if the visit is for commercial purposes) will be processed. These data are collected when provided by the visitor themselves when requesting access to our facilities, or when their contact person within our entity provides them in order to grant access.

Website users:

When visiting our website, and only if the user expressly authorises it, analytical data (e.g., visit duration or pages visited) may be collected, as well as demographic data (e.g., gender, age, country, or language). For further information, please refer to our Cookie Policy.

Further information for data subjects:

The legally established information will be made available to data subjects through the corresponding information clauses included in the various data collection channels, so that the data subject can freely and expressly decide whether they wish their personal data to be processed by our entity.

All categories and types of personal data processed will be duly identified in the corresponding processing activities owned by our entity.

What will your data be used for?

As a general rule, the processing of personal data carried out by our entity is intended to ensure compliance with and maintenance of the relationship with the various groups of individuals with whom we are in contact.

Depending on that relationship, the processing of your data serves different purposes, which we set out below in a non-exhaustive manner:

Clients:

Your personal data will be processed to identify you, comply with and maintain the pre-contractual and contractual relationship, including the sending of commercial communications through different channels, handling inquiries, performing quality controls and commercial statistics, providing our services, managing accounting and invoicing, processing goods and services transactions, managing payments, handling incidents, complaints, and the exercise of rights, as well as for any other purposes required to fulfil such relationship, comply with applicable laws, or meet our legitimate interests.

Participants:

Your personal data will be processed to identify you, deliver the requested training, issue certificates or diplomas of participation, and contact you in relation to it, including the sending of commercial communications through different channels, handling inquiries, performing quality controls and commercial statistics, managing accounting and invoicing, handling incidents, complaints, and the exercise of rights, as well as for any other purposes required to fulfil such relationship, comply with applicable laws, or meet our legitimate interests.

Information or demo requesters:

We will process your personal data in order to handle any type of request you may submit (e.g., commercial inquiries or product demonstrations), to identify you, coordinate the requested demo, and contact you for this purpose, as well as to send or provide quotations and information regarding the goods and/or services of interest to you, including commercial information related to your request in our response (whether verbal or written). We may also conduct follow-up contacts through different channels to understand the decisions made regarding the commercial proposals we have submitted to you.

Job applicants:

Your data will be processed to include you in our recruitment processes and job pool, to identify you, as well as to contact you and inform you about job vacancies, coordinate interviews, and address other matters related to your application. For further information, please refer to our Job Applicants Policy.

Suppliers:

Your personal data will be processed for the purpose of maintaining the pre-contractual and contractual relationship, fulfilling the business relationship, whether for requesting quotations, purchasing goods, or contracting services, handling inquiries and identifying you, managing accounting and goods and services transactions, as well as for any other purposes necessary to comply with such relationship, our legal obligations, and our legitimate interests.

Social media users:

We will process your personal data to maintain the relationship as users of the same social network, to identify you, to contact you, to share news or advertising, and to process other personal data that the social network user allows to be shared with other members of the platform. For further information, please refer to our Social Media Policy.

Claimants:

Your personal data will be processed to identify you, manage your complaint, and contact you regarding its status, as well as to comply with our legal obligations and legitimate interests.

Visitors:

Data relating to visits to our facilities will be processed to identify you, comply with our occupational risk prevention obligations, and for security and access control purposes.

Website users:

By accepting the installation of cookies when visiting our website, data may be processed for different purposes (e.g., visit analytics). For further information, please refer to our Cookie Policy.

Further information for data subjects:

The legally established information will be made available to data subjects through the corresponding information clauses included in the various data collection channels (e.g., forms, voice prompts, contracts, etc.), so that you may freely and expressly decide whether you wish the requested personal data to be processed by our entity. In this same regard, such information will also be reiterated in the different documents or communications we share with data subjects (e.g., notices, invoices, legal statements, etc.).

In the event that the data subject does not provide the requested data, or provides incomplete or inaccurate data, we may be unable to respond to their information request or establish a relationship with them

The data will not be further processed or used for purposes other than those accepted by the data subjects.

The purposes that justify the processing of personal data will be duly identified in the corresponding processing activities owned by our entity.

Why do we process your data (legal basis)?

The processing of your personal data by our entity is based on one or more of the following legal grounds:

When you provide us with your explicit, free, informed, and unequivocal consent, after being informed at the time of collecting your data and in a more detailed manner through this privacy policy, so that after reading it and agreeing to it, you may voluntarily authorise us to process your data for one or more purposes, by ticking the boxes provided for this purpose in our web forms, by giving your verbal consent (which will require voice recording) or by signing the information clauses that we provide to you at the time of requesting your personal data.

For the performance of a contract to which you are a party or for the implementation of pre-contractual measures requested by you.

When the processing is necessary for compliance with a legal obligation applicable to our entity.

When the processing is necessary for the purposes of the legitimate interests pursued by our entity or by a third party, provided that such interests do not override the interests or fundamental rights and freedoms of the data subject. In this regard, we inform you that our entity has carried out an assessment balancing our legitimate interests with the rights and freedoms of the data subject, always respecting their fundamental rights.

In the event that the user is under 14 years of age, the consent of the parents, guardians, or legal representatives will be required for the processing of their data. The user is solely responsible for the accuracy of the data they provide to us.

Data retention

The personal data provided will be retained while the relationship with the data subject is maintained and for the time necessary to fulfil the purpose for which the data was collected.

Once that relationship has ended, the data will be kept in a blocked state in cases where it is necessary to retain them until the statute of limitations for liabilities has expired, solely for the purposes of potential claims or legal actions, as well as to comply with our legal obligations, for example:

Data subjects	Sector scope	Legal basis	Retention period
· Clients · Suppliers	Accounting	Art. 30.1 Royal Decree of the Commercial Code	· 6 years from the last entry
· Clients · Suppliers	Tax	Art. 66 General Tax Law 58/2003	· General period: 4 years · In case of losses during the financial year: 10 years · Invoices: 5 years
· Any person	General	Art. 1964.2 of the Civil Code	· 5 years: Personal actions that are not subject to a special limitation period become time-barred after five years from the moment the obligation can be enforced. In ongoing obligations to do or not do something, the limitation period starts each time a breach occurs.
· Workers	Employment	Art. 21 of Legislative Royal Decree 5/2000 – Social Order	· 4 years:
· Job seekers	Employment	Guide on Employment Relations of the Spanish Data Protection Agency (AEPD)	· 1 year
· Workers	Occupational risk prevention	Art. 4.3 of Legislative Royal Decree 5/2000 – Social Order	· 5 years
· Visitors	Access control to facilities	Instruction 1/1996 of the Spanish Data Protection Agency (AEPD)	· 1 month
· Web users	Use of cookies	Guide on the use of cookies by the Spanish Data Protection Agency (AEPD)	· 24 months maximum
· Information requesters	Commercial Legal	Art. 20.1 a and d) Spanish Constitution	· The shortest possible time or the period established by law.

Profiling

We do not create profiles, nor will automated decision-making be carried out using your personal data. However, should this occur, you will be informed in advance and your prior consent will be requested.

Likewise, you have the right to object to this type of processing at any time by submitting a written request to our organisation at: info@progressalean.com

Data sharing

As a general rule, our organisation does not share personal data with third parties without prior consent. However, data sharing will be necessary in the following cases:

In the case of our clients or suppliers, their personal data may be disclosed to third-party entities where required by law (e.g. the Tax Agency), or to those entities necessary to provide our services or process payments (e.g. banking institutions).

The personal data of participants in training activities that are subsidised or funded may be disclosed to those entities to which we are legally obliged (e.g. FUNDAE).

Likewise, the personal data of clients or suppliers may be processed by third parties to whom we delegate some of our obligations (e.g. accounting advisors), or, in the case of subsidised training courses, may be shared with partners to whom we have delegated the management of such subsidies. All of them have committed, through a data processing agreement, to comply with the same security measures implemented by our organisation, as well as to be bound by confidentiality and professional secrecy regarding the personal data processed, among other obligations related to personal data protection.

In the case of job applicants, their data will not be disclosed to third-party entities, unless we are legally required to do so.

With regard to information requesters or users of our website, their data will not be disclosed to third parties, except in the cases previously described and informed at the time of collection, and only with their explicit consent, unless our legitimate interest prevails or we are legally required to do so, in which case consent will not be required.

As a general rule, we may disclose your personal data to Judges, Courts, the Public Prosecutor’s Office, and/or the competent Public Authorities in the event of potential claims, when we are legally obliged to do so.

International data transfers

In the event of data transfers to third-party entities located in countries outside the European Economic Area, we will inform the data subjects and request their prior and explicit consent.

Security measures

Our organisation has implemented all necessary technical and organisational measures to protect the personal data processed, preventing loss, theft, or unauthorised use.

Such measures have been established based on the type of data processed and the purposes of the processing. They are periodically reviewed through our internal compliance controls regarding personal data protection regulations, as well as through external audits.

Your rights

As the data subject and acting on your own behalf or through your representative, you may contact our organisation at any time to request the exercise of your data protection rights.

We explain what these rights are:

Right of access:

You have the right to know and request from us, at any time, the following information:

Whether or not we are processing your personal data.
The purposes of the processing, as well as the categories of personal data being processed.
The origin of your data, if you did not provide it to us.
The recipients or categories of recipients to whom your personal data have been or will be disclosed, including, where applicable, recipients in third countries or international organisations.
Information on the appropriate safeguards relating to the transfer of your data to a third country or to an international organisation, where applicable.
The expected retention period, or if not possible, the criteria used to determine this period.
Whether automated decisions exist, including profiling, meaningful information about the logic involved, as well as the significance and expected consequences of such processing.
A copy of your personal data undergoing processing.

Right to rectification:

To request the rectification of your personal data when they are inaccurate, as well as their completion when they are incomplete.

Right to object:

You may object to the processing of your data when it is incorrect or when its processing is no longer necessary.

In the event that you act as a reported party or as a person affected by a report under Law 2/2023, you will not be able to exercise your right to object, as it is presumed (subject to proof to the contrary) that there are legitimate grounds for the processing of your personal data, in accordance with Article 31.4 of the Law.

Right to erasure:

To request the deletion of your data for any of the following reasons:

Your data are no longer necessary for the purposes for which they were collected or processed.
You have not given consent for the processing of your data.
You have exercised your right to object.
The data have been processed unlawfully.
The data must be erased to comply with a legal obligation.

Right to restriction of processing:

You may request to exercise this right when one or more of the following circumstances apply:

When you contest the accuracy of your data, for a period that allows the controller to verify their accuracy.
When the processing is unlawful and you oppose the erasure of your data and request the restriction of their use instead.
When the data are no longer needed for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims.
When you have objected to processing pursuant to Article 21(1), while it is verified whether the legitimate grounds of the controller override those of the data subject.

Right to data portability:

It refers to the right to obtain the data relating to you in a structured, commonly used, and machine-readable format, as well as to transmit it to another data controller for further processing.

Right not to be subject to automated decision-making:

Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

How you can exercise your rights

To exercise any of your rights, you must submit a written request to PROGRESSA LEAN, S.L., either by postal mail to the following address: C/ Uruguay 11, 601ª, 46007 Valencia (Valencia), Spain, or by email at: info@progressalean.com, clearly specifying the rights you wish to exercise. If you are acting on behalf of another person, you must provide proof of representation. If there are reasonable doubts regarding the identity of the person submitting the request, we may ask for additional information necessary to confirm their identity.

If you wish to submit any suggestions or inquiries regarding the processing of your personal data, you may contact our data protection consultants:

BUSINESS ADAPTER, S.L.

Ronda Guglielmo Marconi, 11, 26, (Technology Park) 46980 Paterna (Valencia).

Data subject request form

We inform you that you have the right to lodge a complaint with the Spanish Data Protection Agency at: C/ Jorge Juan, 6, 28001 Madrid, or at www.aepd.es.

Commitment to the Protection of Personal Data

Scope of application

Our commitment to the protection of personal data is mandatory for all departments and employees of our organisation, as well as for any third parties acting on our behalf.

Purpose

We have established operational protocols for the processing of your personal data in accordance with European and Spanish data protection regulations.

Principles

We will process your data lawfully, fairly, and transparently, ensuring data minimisation, accuracy, storage limitation, integrity, confidentiality, and proactive accountability.

Special category data

Our organisation prohibits the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sexual orientation, except where legally authorised exceptions apply and with the prior consent of the data subject.

Data subjects’ rights

Our organisation will address and respond to your requests to exercise your rights with the greatest possible speed and diligence.

Records of Processing Activities, Data Protection Impact Assessment, and Security Measures

Our organisation will maintain a record of processing activities and analyse the purposes of processing, categories of data subjects and data, recipients, international transfers, retention periods, etc., in order to assess processing risks and implement the necessary security measures to ensure the confidentiality, integrity, and availability of personal data.

Likewise, for each processing activity, we have assessed the need to carry out a Data Protection Impact Assessment and to determine whether there is an obligation to appoint a Data Protection Officer, ensuring that, where required, the designated person meets the necessary knowledge and experience in accordance with applicable regulations.

Control

We rely on external support that advises us in this area, monitoring all publications issued by the relevant supervisory authorities and other European and Spanish entities related to data protection regulations, in order to ensure ongoing compliance with such regulations at all times.

Update of this Policy

Our entity reserves the right to modify this Policy without prior notice. Therefore, we recommend that you consult it each time you visit our website.

Text updated on April 24, 2025.