PRIVACY POLICY

In this policy, the data controller defines the principles and criteria it will follow when processing the personal data of data subjects, that is, those who provide their information when browsing this website or using any of its services or forms.

This processing is carried out in accordance with the provisions of Regulation (EU) 2016/679, General Data Protection Regulation (hereinafter, GDPR) and Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPD-GDD).



1. WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?

The person responsible for the processing of personal data collected through this website is:

Name: HOLA SPANISH MARKET SL,

Trade name: HOLA SPANISH MARKET

NIF: B09929381

Address: CALLE TREVIÑO, 5 – 3-2 28003 MADRID (MADRID) SPAIN

Email: lucia@holaspanishmarket.com

Website: www.holaspanishmarket.com

Hereinafter, this party will be referred to as the CONTROLLER.

The CONTROLLER will act on the personal data provided by individuals who interact with this website, whether by browsing, submitting forms, making inquiries, or using any of the services offered. For these purposes, these individuals will be referred to as the DATA SUBJECT, as the legitimate owners of the data being processed.

 

 2. GENERAL PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA

The CONTROLLER will process the personal data of the INTERESTED PARTY in accordance with the fundamental principles established in Regulation (EU) 2016/679 on the protection of personal data and in the LOPDGDD, which are detailed below:

  • Legality, loyalty and transparency: The data will be processed lawfully, fairly, and transparently, ensuring that the DATA SUBJECT is fully informed about the processing and its legal basis. The legal bases applicable to each type of processing are detailed in Section 5 of this Policy.
  • Limitation of purpose: The data will only be used for specific, explicit, and legitimate purposes, as indicated in section 4 of this Policy.
  • Data minimization: The CONTROLLER will only process the data strictly necessary for each purpose, limiting its storage and access as much as possible.
  • AccuracyReasonable measures will be taken to ensure that data is up-to-date and corrected or deleted when it is inaccurate in relation to its purpose.
  • Limitation of the storage period: Data will be retained only for the time necessary for each purpose. Once this has been fulfilled, it will be deleted, blocked, or anonymized (i.e., elements that allow the identification of the DATA SUBJECT will be removed). The retention periods are detailed in section 6.
  • Integrity and confidentiality (security): The necessary technical and organizational measures will be applied to protect data against unauthorized access, loss or alteration.
  • Proactive responsibility: The CONTROLLER undertakes to act diligently to ensure and demonstrate compliance with data protection regulations and the protection of the rights of the INTERESTED PARTY.

3. ACCEPTANCE, CONSENT AND VERACITY OF THE DATA

By accepting this Data Protection Policy, the INTERESTED PARTY expressly, freely, specifically, informedly, and unequivocally expresses their consent for the CONTROLLER to process their personal data in accordance with the purposes described in this policy and to apply the technical and organizational measures required by current data protection regulations.

By voluntarily submitting their data through electronic forms or any other channel enabled on this website, the INTERESTED PARTY declares that they are at least 14 years old and that the information provided is truthful, accurate, complete, and up-to-date.

Likewise, the INTERESTED PARTY undertakes to keep their personal data correctly updated and assumes responsibility for any consequences that may arise from having provided false, inaccurate, or outdated information, including any direct or indirect damages that this may cause to the CONTROLLER or third parties.

 

 4. TYPES OF DATA PROCESSED AND PURPOSE ACCORDING TO THE MEANS OF COLLECTION

The CONTROLLER will only process personal data that is adequate, relevant, and limited to what is necessary in relation to the specific and legitimate purposes for which it is collected, in compliance with the provisions of the GDPR and the principles described in section 2 of this Policy.

The types of data that may be collected through this website depend on the services requested by the DATA SUBJECT, and may include the following:

  • Identification data: name, surname and, where applicable, ID.
  • Contact information: email address, postal address and/or telephone number.
  • Contractual and billing data: information relating to commercial operations, contracted products or services, and payment data.
  • Technical and navigation data: IP address, device type, browser, access provider, website activity, and other data related to your interaction with the website. For more information, please consult our Cookie Policy.
  • Academic and employment data(only in selection processes).

 

This data is collected through the following means enabled on the website:

  • Web forms(such as contact forms, subscriptions, purchases, comments, or others): In each case, the INTERESTED PARTY will be informed, clearly and in advance, about the identity of the CONTROLLER, the purpose of the processing, the legal basis, the recipients, the retention period, and how to exercise their rights.
  • Social networksThe CONTROLLER may also collect personal data from the DATA SUBJECT when they interact on social networks where they are present (direct messages, comments, mentions, etc.). These platforms have their own privacy policies, so it is recommended that you review them beforehand.
  • Cookies: During browsing, technical information is collected through cookies and similar technologies. In any case, the INTERESTED PARTY can consult the Cookie Policy to learn more about the data collected, its purpose, and how to configure their consent.

The types of data collected and their purpose are detailed below, depending on the means of collection:

WEB FORMS:

Contact form

  • Data processed: name and surname, email, telephone number.
  • Purpose: To manage the submission of queries, suggestions, or requests for professional contact made by the INTERESTED PARTY through the provided form. The information provided will be used exclusively to respond to the request and send the requested information; it will not be used for any other unsolicited purposes.

Newsletter subscription form

  • Data processed: name and surname, email.
  • Purpose: To send the DATA SUBJECT newsletters with exclusive content, news, promotions, or personalized offers. In some cases, your occupation may also be collected to better tailor the information to your profile. Subscription is voluntary and can be unsubscribed at any time from the newsletter itself or by notifying the CONTROLLER.

Access form to free resources, such as our sales presentations

  • Data processed: name and surname, email, telephone number.
  • Purpose: to facilitate access to the requested resource or free session, and subsequently send informational or commercial communications related to the CONTROLLER’s products, services, or activities via email.

Appointment Booking Form

  • Data processed: name and surname, email.
  • Purpose: To manage the booking of meetings, assessment sessions, or individual interviews for the provision of services offered by the CONTROLLER, as well as to send communications necessary for confirmation or reminder of the appointment.

Purchase form

  • Data processed: identification, contact, billing and payment data.
  • Purpose: To manage the purchase of products or services offered on the website, including order processing, payments, invoicing, sending confirmations or related notifications, as well as providing after-sales support.

Job bank form or selection processes

  • Data processed: name and surname, address, telephone number, email address, academic background, professional experience, and availability.
  • Purpose: to assess the INTERESTED PARTY’s candidacy in selection processes opened by the CONTROLLER to incorporate new profiles into the team.
  • Legal basis: consent of the interested party, pre-contractual measures and, where applicable, execution of the contract.



SOCIAL NETWORKS:

At www.holaspanishmarket.com you will find links that redirect to the social networks Instagram, Facebook, LinkedIn, Youtube, Tiktok, X. When accessing them, their respective privacy policies will apply, since they are external services unrelated to this website:



COOKIES

During browsing, certain technical data is automatically collected through cookies. You can consult the Cookie Policy for detailed information on:

  • Types of cookies used
  • Specific purposes
  • Preference settings
  • Consent management



5. LEGAL BASIS THAT LEGITIMIZES THE PROCESSING

The CONTROLLER processes the personal data of the INTERESTED PARTY in accordance with the provisions of Regulation (EU) 2016/679 (GDPR).

The legal bases that legitimize the processing derived from the different data collection systems used by the CONTROLLER are detailed below.

The bases that legitimize the treatment are the following:

  • Execution of a contract: The data is necessary to formalize, execute, and manage the contractual relationship between the INTERESTED PARTY and the CONTROLLER, such as in the purchase of products, provision of services, or participation in courses or training.
  • Application of pre-contractual measures: : The processing is carried out to respond to pre-contract requests, such as budgets, commercial information, session scheduling, or selection processes (generally).
  • Consent of the INTERESTED PARTY:

    Express, free, informed and unequivocal consent is requested in the following cases:
  • Sending commercial communications by electronic means (email).
  • Use of cookies for advertising or analytical purposes.
  • Legitimate interest of the CONTROLLER:

    Processing may be based on legitimate interest when:
  • It is necessary to provide a service requested by the INTERESTED PARTY without the need to formalize a contract (for example, general customer service).
  • The purpose is to protect the security of the website and prevent fraud or unauthorized access.
  • Informational communications are provided regarding similar services previously contracted, in accordance with the provisions of Article 21.2 of Law 34/2002, of July 11, on information society services and electronic commerce.
  • Internal analyses are carried out to improve the quality of service, provided that the rights and freedoms of the INTERESTED PARTY do not prevail.

 

 6. INFORMATION RETENTION PERIODS

The personal data collected by the CONTROLLER will not be retained indefinitely, but only for the time strictly necessary to fulfill the purposes for which it was collected, comply with applicable legal obligations, and address any potential liabilities arising from the processing.

Once this period has elapsed, the data will be blocked: it will be stored without being used, and will only be accessed if necessary for the defense of legitimate interests, such as legal claims, audits, or administrative proceedings.

The following are the indicative retention periods depending on the type of data and the relationship with the DATA SUBJECT:

  • Data of clients or persons with a current contractual relationship: They will be retained as long as the relationship is active or the right to erasure or restriction is not exercised. Once the relationship ends, they will be blocked for the time necessary to comply with legal liabilities.
  • Data linked to tax, labor or accounting obligations or other applicable legal provisionsThe retention periods established by the regulations in force in each case will be observed. For illustrative purposes, the following are considered: four years for obligations to Social Security and the Tax Agency (General Tax Law and labor regulations); five years as the general statute of limitations for personal actions (Article 1964 of the Civil Code); six years for the retention of commercial documentation, such as invoices or accounting books (Article 30 of the Commercial Code); and ten years in compliance with requirements regarding the prevention of money laundering (Law 10/2010). In any case, the data will be retained for the period determined by the applicable law based on the type of obligation.
  • Subscriber data: will be processed as long as the INTERESTED PARTY does not request the cancellation or deletion of their data.
  • Data of interested parties without a contractual relationship (potential clients): They will be kept as long as there is an active business relationship or for a maximum of two years from the last contact, unless the INTERESTED PARTY requests their deletion beforehand.
  • Data collected in selection processes: Unless expressly indicated at the time of collection, they will be kept for a maximum period of one year, after which they will be deleted unless there is a legal basis for their further maintenance.

 

 7. RECIPIENTS AND DATA TRANSFERS

As a general rule, the CONTROLLER does not share the DATA SUBJECT’s personal data with third parties, except in cases where there is a legal obligation to do so. If an unforeseen transfer is necessary, the DATA SUBJECT’s express consent will be requested in advance, and they will be clearly informed of the recipient and the purpose of the processing.

Specifically, personal information may be made available to public authorities, courts, or tribunals if necessary to comply with legal obligations or to address responsibilities arising from processing.

However, certain third parties may access personal data without this constituting a transfer in the strict sense. These are service providers contracted by the CONTROLLER, acting as data processors and processing the data only in accordance with the CONTROLLER’s instructions. They may not use it for their own purposes, ensuring the confidentiality of the information at all times. These accesses are necessary to properly provide the services contracted or requested by the DATA SUBJECT.

These providers include, but are not limited to:

  • Web hosting and site maintenance companies.
  • Platforms for sending electronic communications (email marketing, notifications).
  • Statistical analysis and web activity tracking services.
  • Payment system and banking gateway providers.
  • Campaign management and CRM tools.
  • Online training providers and teaching platforms.

In compliance with the principles of transparency and information, the following is the list of data processors who may access the personal data of the INTERESTED PARTY:

  • WordPress: CMS platform managed by Automattic Inc., headquartered in San Francisco, California, USA, with the designated controller for the processing of personal data for Europe, Aut O’Mattic A8C Ireland Ltd., located at Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland. Automattic Inc. adheres to the EU-US data adequacy decision for data flows “Data Privacy Framework” adopted by the European Commission on July 10, 2023. You can access its privacy policy here:https://automattic.com/privacy/
  • Google: provides email, video conferencing, cloud storage, and web analytics services. These services are operated by Google LLC, headquartered in Mountain View, California, USA, with a designated controller for the processing of personal data in the European Economic Area and Switzerland. Google Ireland Limited, a company established and operating under the laws of Ireland (registration number: 368047), is a company established and operating under the laws of Ireland. Google LLC adheres to the EU-US Data Privacy Framework (the “Data Privacy Framework”), adopted by the European Commission on July 10, 2023. You can view its privacy policy here.https://policies.google.com/privacy?hl=es
  • The Rocket Science Group LLC (part of the INTUIT group of companies): a US-based email marketing provider under the Mailchimp® brand, adheres to the EU-US Data Privacy Framework (DPF) adopted by the European Commission on July 10, 2023. You can view its privacy policy here:https://www.intuit.com/privacy/statement/
  • Zoho: A payment management tool operated by Zoho Corporation, headquartered in the US, which has adopted standard data processing clauses approved by the European Commission. You can view its Privacy Policy at the following link:https://www.zoho.com/privacy.html
  • Calendly: A tool used to schedule meetings. Calendly LLC is located in Buford, Georgia (United States) and adheres to the EU-US Data Privacy Framework adopted by the European Commission on July 10, 2023. For more information, you can consult its privacy policy athttps://calendly.com/es/legal/privacy-notice.
  • Microsoft Corporation: Provides cloud storage, organization, and video conferencing services. This company is located in Redmond, Washington, USA, and adheres to the EU-US Data Privacy Framework (DPF) adopted by the European Commission on July 10, 2023. You can view its privacy policy here.https://privacy.microsoft.com/es-es/privacystatement
  • WhatsApp: A tool used for customer communication through WhatsApp LLC, headquartered in Menlo Park, California, USA, with a designated controller for the processing of personal data in the European Economic Area and Switzerland Ireland Limited. WhatsApp LLC adheres to the EU-US Data Privacy Framework (DPF) adopted by the European Commission on July 10, 2023. You can consult its privacy policy athttps://www.whatsapp.com/legal?eea=1#privacy-policy
  • ClickUp: A tool used for project organization and management, located at 350 Tenth Ave Suite 500, San Diego, CA 92101, has adopted standard data processing clauses approved by the European Commission. You can learn more about its privacy policy here:https://clickup.com/terms/dpa

 

 8. INTERNATIONAL DATA TRANSFERS

In certain cases, the CONTROLLER uses services provided by providers located outside the European Economic Area (EEA), which involves international transfers of personal data.

These transfers are carried out only when essential for the execution of specific functions, such as communications management, web hosting, data analysis, online training, or other functionalities requested by the INTERESTED PARTY.

In all cases, the CONTROLLER guarantees that such transfers comply with the requirements established in Regulation (EU) 2016/679 (GDPR), adopting the necessary measures to ensure an adequate level of protection equivalent to that required within the EEA.

Suppliers providing services from third countries have signed the corresponding data processing and confidentiality contracts, and apply appropriate legal safeguards to protect personal information. These safeguards may include:

  • Adequacy decisions adopted by the European Commission regarding the country of destination.
  • Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Any other legally valid mechanism as provided for in Articles 44 to 50 of the GDPR.

 

 

9. USER PROFILING AND SEGMENTATION

The CONTROLLER may segment or classify DATA SUBJECTS based on the data they provide at various times: when subscribing to newsletters, participating in free challenges, completing a purchase process, or interacting with the website. Information obtained through cookies related to browsing habits is also taken into account.

This data allows us to create user groups with common characteristics. These groups are used for purposes such as administrative management, sending informative or commercial communications tailored to specific interests, analyzing proposals, conducting statistical studies on the use of services and content, conducting surveys, and improving the user experience.

In some cases, profiling based on automated decisions may be carried out. This means that certain personal aspects of the DATA SUBJECT—such as their interests, preferences, online behavior, or location—will be automatically analyzed using statistical techniques. The goal is to offer personalized information and content tailored to their profile, thus improving the relevance of the communications sent.

The data used in these processes does not directly identify the interested party. Instead, aggregated criteria are used that only show generic audience profiles, such as age range, country, gender, or common interests.

The legal basis for this processing is the explicit consent of the INTERESTED PARTY, expressed by checking specific boxes on subscription forms or by accepting cookies for personalization or advertising purposes.



10. USER RIGHTS AND HOW TO EXERCISE THEM


The DATA SUBJECT, as the data subject of the personal data processed by the CONTROLLER, may exercise the rights recognized in current data protection regulations. These rights are as follows:

  • Access: allows you to know what personal data the CONTROLLER is processing, for what purpose, the origin of the data, the recipients, the retention periods, as well as obtain a copy of all this information.
  • Rectification: enables the INTERESTED PARTY to request the correction of data that is inaccurate or incomplete, and the CONTROLLER must respond to said request diligently and, where appropriate, justify the changes made.
  • Suppression: allows you to request the deletion of personal data when it is no longer necessary, the INTERESTED PARTY withdraws their consent, opposes the processing or it is unlawful, without prejudice to any legal retention obligations that may remain.
  • Limitation of treatment: This involves the retention of data solely for the purposes of exercising or defending claims, in cases where the INTERESTED PARTY challenges the accuracy of the data, opposes its deletion or while an opposition to the processing is being resolved.
  • Opposition: allows the INTERESTED PARTY to refuse the processing of their personal data for reasons related to their particular situation, especially when the processing is based on the legitimate interest of the CONTROLLER or has commercial purposes.
  • Portability: enables the personal data provided to the CONTROLLER to be received in a structured, commonly used and machine-readable format, as well as to transmit them directly to another controller if technically feasible.
  • Automated decisions and profiling: recognizes the right not to be subject to decisions based solely on automated processes, including profiling, unless there is explicit consent, it is necessary for a contract or it is authorized by law, and may in all cases request human intervention.

Furthermore, the DATA SUBJECT may revoke the consent granted for the processing or transfer of their data at any time, without retroactive effect. They may also request to unsubscribe from any of the subscription services offered by the CONTROLLER.

Characteristics of the exercise of rights

  • The exercise of these rights is free of charge, unless the requests are manifestly unfounded or excessive, in which case a proportional fee may be charged or even the processing may be denied.
  • They may be exercised directly by the INTERESTED PARTY or through a duly accredited legal representative.
  • The CONTROLLER must respond to the request within a maximum period of one month, which may be extended by two more months in the case of complex or multiple requests.
  • The means enabled for exercising rights must be accessible. The right cannot be denied because the interested party chooses a channel other than their usual one.
  • If the request is submitted electronically, the response will also be provided electronically, whenever possible.

Means enabled to exercise rights

The INTERESTED PARTY may exercise his or her rights through any of the following means:

  1. Postal mail: by written and signed request addressed to HOLA SPANISH MARKET SL, CALLE TREVIÑO, 5 3-2 – 28003 MADRID (MADRID). Email: lucia@holaspanishmarket.com, with the reference “Exercise of LOPD Rights”.
  2. Email: Send the scanned and signed form to lucia@holaspanishmarket.com, indicating “Exercise of LOPD Rights” in the subject line.

In both cases, proof of identity must be provided with a copy of your ID or equivalent document. If the application is submitted through a representative, proof of such representation must be provided.

If the INTERESTED PARTY believes that their rights have not been adequately exercised, they may file a complaint with the Spanish Data Protection Agency, located at C/ Jorge Juan, 6 – 28001 Madrid. More information, forms, and resources are available on their official website:https://www.aepd.es/es/derechos-y-deberes/conoce-tus-derechos.

 

 11. SECURITY AND PROTECTION OF YOUR INFORMATION

The CONTROLLER undertakes to protect the personal information of the INTERESTED PARTY, applying technical, organizational, and physical measures that are reasonable, effective, and appropriate to preserve the confidentiality, integrity, availability, and resilience of the systems and services that manage personal data.

In compliance with the obligations arising from data protection regulations, the CONTROLLER adopts security controls proportional to the level of risk and regularly monitors their effectiveness to ensure the security of the processing.

Contracts entered into with third-party providers include an express obligation to maintain professional secrecy and confidentiality, as well as the requirement to implement appropriate technical and organizational measures to ensure adequate data protection, in accordance with Article 28 of the GDPR.

This website incorporates an SSL (Secure Socket Layer) certificate, which guarantees that data transmitted between the INTERESTED PARTY’s browser and the website server is encrypted, preventing unauthorized access during transmission.

However, although recognized security standards are applied, it should be noted that no system is completely invulnerable. In the event of a security breach affecting personal data under the responsibility of the CONTROLLER, the necessary measures will be immediately taken to contain, analyze, and mitigate the incident. Furthermore, the obligation to notify the competent supervisory authority and, where appropriate, the affected DATA SUBJECTS will be fulfilled, in accordance with the provisions of Articles 33 and 34 of the GDPR.

 12. CHANGES IN THE PRIVACY POLICY

The CONTROLLER may update this Privacy Policy at any time to adapt it to legislative changes, jurisprudential criteria, instructions from competent authorities, or evolving industry practices.

In the event of a modification, the INTERESTED PARTY will be notified through the website or, where appropriate, by direct electronic notification. The publication of the new version will automatically replace the previous version, taking effect from the moment of its dissemination, unless otherwise indicated.

The INTERESTED PARTY is encouraged to periodically review this Policy to stay informed about how their personal data is protected.



This Privacy Policy was last updated on June 23, 2025.