PRIVACY POLICY.

Privacy is important to CRISTALERIA Y ALUMINIOS GRAU SL. This policy contains the practices related to the processing of personal data on the CRISTALERIA Y ALUMINIOS GRAU SL websites, such as the type of data collected, its tracking, use, and disclosure.

At CRISTALERIA Y ALUMINIOS GRAU SL, we understand that the privacy and security of personal data is of vital importance. Therefore, this policy sets out what we do with your information and what we do to keep it secure. It also explains where and how we collect information, as well as the data protection rights that data subjects have.

This policy applies to those who access and use our website services and those who interact with CRISTALERIA Y ALUMINIOS GRAU SL on social media (our “Services”).

This policy defines our commitment to protecting personal information. We recommend reading our privacy policy before continuing to browse.

This privacy policy was last updated on September 30, 2025

1. Identification of the company name of the data controller

In accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter GDPR), we inform you that the personal data obtained from the data subject, as well as the data generated in the context of the activity of our website, will be processed by:

In accordance with Law 34/2002 of 11 July on Information Society Services and Electronic Commerce, we inform you of the company details of the entity:

Company name:	GRAU GLASS AND ALUMINUM SL
N.I.F/C.I.F.:	B98881048
Address:	Avenida del Arenal 9 local 1, 03738 Platja de l’Arenal, Alacant
Residence:	Spain
E-mail:	info@ cristalumjavea.com
Phone numbers:	658 84 25 79
Object:	Manufacturing and installation of glassware, aluminum and PVC products
Data Register them:

• General privacy principles.

CRISTALERIA Y ALUMINIOS GRAU SL collects and processes personal information adopting the following principles:

• Data is treated fairly, legally and transparently.
• Data is collected for specific, explicit, and legitimate purposes and is not processed in a manner incompatible with those purposes.
• Data is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
• Data is accurate and up-to-date.
Inaccurate data will be updated or deleted.
• Data is stored in an identifiable format for no longer than necessary.
• Data is processed securely through appropriate and effective technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by implementing appropriate technical and organizational measures (“integrity and confidentiality”).
• We are committed to the principles of data protection by design and data protection by default.
• How we collect and use your personal data.
• Directly from the data controller: We may collect personal data when you submit an inquiry through our contact forms, or when you are assigned an access account, among other things.
• From cookies: We may collect information from “cookies” that we may store on the user’s device. Cookies are small data files stored on the device’s hard drive or memory. For more information on the use and purposes of cookies, please see our cookie policy.
• Logs: In the context of our website activity, we may record certain information and store it in log files when the user interacts with our Services. This information may include your Internet Protocol (IP) address or other device addresses or identification numbers, as well as your browser type, Internet service provider, etc.
• Situations where our website requests your personal data
• When you submit inquiries through the contact form or via email.
• When you request any of the services and/or products we offer.
• Purposes for which we process your personal data.

At CRISTALERIA Y ALUMINIOS GRAU SL we process the data necessary to manage and optimize our services and business relationships with our users and clients. In addition, we also use this information to send users advertising of interest related to our products and services.

Personal data is collected and processed for the following purposes:

Category of Interested Parties	Purpose
Cookies	The Website uses technology to place files called cookies on the User’s device. Cookies are used to improve your browsing experience on our website, analyze user navigation, and offer you personalized content. In any case, they can be blocked or disabled through your browser settings. For more information, please see our Cookie Policy.
Web Inquiry User	To attend to and respond to communications or requests received either through email or the website contact form https://cristalumjavea.com/

• Legal basis for processing and whether processing is mandatory or optional

The legal bases are linked to the purposes of the previous point according to the letters assigned in the table.

Category of Data Subjects	Legal Basis for Data Processing
Cookies	Consent given by accepting the cookies of CRISTALERIA Y ALUMINIOS GRAU SL,except for cookies considered technical and necessary for the optimal functioning of the Website.
Consultation User Web	Consent requested when you contact us through the website. You may withdraw your consent at any time. Under no circumstances will the withdrawal of consent affect the provision of other services.

• Data provided voluntarily by the data subject

Category of data subjects	Data provided by the data subject
Cookies	IP address, browsing data, statistics, etc.
Web Inquiry User	Name, Surname, email, subject, message,

• Retention of personal data.

CRISTALERIA Y ALUMINIOS GRAU SL only stores your personal data to the extent necessary to use it for the purposes of point 5, and according to the legal basis for its processing and in accordance with applicable law. Your personal information will be kept for as long as a contractual and/or commercial relationship exists or until you exercise your right to erasure, cancellation, and/or restriction of the processing of your data. Once the relationship with you has ended for any of the reasons indicated, the information will be duly blocked, without being used for any purpose, for as long as it may be necessary for the exercise or defense of claims or until any type of judicial, legal, or contractual liability may arise from its processing that must be addressed and for which its retrieval is necessary. Data processed for direct marketing purposes will be kept indefinitely until the data subject requests its erasure. In specific:

Category of Interested Parties	Data Retention Period
	Cookies	According to the periods indicated in the cookie policy
	Web Inquiry User	3 years from last contact

• Recipients or third parties to whom we may communicate personal data.

9.1 Personal Data may be shared for the purposes set out in point 5 in the following cases:

In general, personal data may be shared with all categories of interested parties:

1. For compliance with our legal obligations: when disclosure is necessary to comply with our obligations under applicable laws, regulations, legal processes, or governmental requests.
2. For the establishment, exercise or defense of legal claims or when courts are acting in the exercise of their judicial function:In certain circumstances, the disclosure of personal data may be mandatory because it is subject to a court order, subpoena or summons.
3. In sales, mergers, acquisitions, or similar transactions: In the event of a merger, acquisition, sale of all or a substantial part of our assets, or other similar sale transaction, personal data may be transferred as part of that transaction. Where applicable, the data subject will be notified of this circumstance.
4. For the provision of services by suppliers acting on our behalfOccasionally, we enter into contracts with carefully selected third parties to help us provide the Website services such as:
   1. Hosting Services for the purpose of providing hosting and email services.
   1. IT consulting and web design services:  to offer technical support for the code created for the website
5. Aggregated or Non-Identifiable Data: We may share aggregated or other non-personal information that does not identify the data subject in order to improve your experience with our Services.

9.2 Personal Data may be shared outside the EU for the purposes set out in point 5 in the following cases:

No International Data Transfers are made outside the EEA

1. Security measures adopted in relation to the processing of personal data

CRISTALERIA Y ALUMINIOS GRAU SL implements and applies appropriate technical and organizational security mechanisms and measures to ensure a level of security appropriate to the risk.

To this end, CRISTALERIA Y ALUMINIOS GRAU SL, based on an objective assessment, has identified, analyzed, and evaluated risks of varying likelihood and severity to the rights and freedoms of natural persons and, consequently, has implemented appropriate and effective security mechanisms, safeguards, and measures to eliminate or mitigate the identified risks. Specifically, appropriate and effective technical and organizational measures are adopted to mitigate the risks of accidental or unlawful destruction, loss, or alteration of personal data transmitted, stored, or otherwise processed, or unauthorized disclosure of or access to such data.

Likewise, CRISTALERIA Y ALUMINIOS GRAU SL guarantees compliance with the duty of professional secrecy and confidentiality for all its employees, contractors, and third-party users of personal data.

1. Data Subject Rights.

Users may direct their communications and exercise their data protection rights following the formalities imposed by data protection regulations.

In all our operations related to your privacy, we strive to comply with current regulations, which contain a series of rights for the data subject that we list below:

Furthermore, we inform you that if you are not satisfied with the exercise of your rights or the manner in which they were exercised, you may file a complaint with the Supervisory Authority. For more information on this right and how to exercise it, you can contact the Spanish Data Protection Agency (AEPD): http://www.agpd.es/ Tel. 901 100 099 and 91 266 35 17. C/Jorge Juan, 6 28001-Madrid. Please do not hesitate to contact us by any of the means indicated below before filing a complaint with the competent data protection authority.

Your Rights	What does it mean?
Right to Information	You have the right to receive clear, concise, transparent, and easy-to-understand information about how we use your personal data and about your rights. We provide this information in section 5 of this Policy.
Right of Access	You have the right to access the personal data we hold about you (with certain limitations). Manifestly unfounded, excessive, or repetitive requests may not be fulfilled. To exercise this right, please contact us using any of the methods indicated below.
Right to rectification	You have the right to have your personal data rectified when it is inaccurate or outdated, or completed when it is incomplete. To exercise this right, please contact us using any of the methods indicated below. If you have an account, it may be easier to correct it yourself by modifying your profile.
Right to erasure/right to be forgotten	In certain cases, you have the right to have your personal data erased or deleted. It should be noted that this is not an absolute right, as we may have legal or legitimate reasons for retaining it. If you wish us to delete your personal data, please contact us using any of the methods indicated below.
Right to withdraw consent at any time when data processing is based on consent	If you have given your consent for any of the purposes described in the processing activities we refer to, we inform you that you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on consent before its withdrawal. For information on which processing activities are based on consent, please refer to section 5 of this policy. If you wish to withdraw your consent, please contact us using any of the methods indicated below.
Right to object to processing based on legitimate interests	You may object at any time to our processing of your data when the processing is based on legitimate interests. To learn which processing activities are based on consent, please refer to section 5 of this policy. If you wish to exercise this right, please contact us using any of the methods indicated below.
Right to lodge a complaint with a supervisory authority
Right to data portability	You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, so that you can transmit it to another data controller, where the processing is based on the performance of a contract or on your consent and the processing is carried out by automated means. To learn which processing activities are based on consent, please refer to section 5 of this policy. For more information, please contact us by any of the means indicated below.
Right to restriction of processing	You have the right to request the restriction of the processing of your data. If you exercise this right, the processing of your data will be subject to limitations, meaning we can store it, but we cannot continue to use or process it. This right can only be exercised in certain circumstances defined by the General Data Protection Regulation (GDPR), as follows: when the data subject contests the accuracy of the personal data, for a period enabling the controller to verify its accuracy; when the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead; when the controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise, or defense of legal claims; or when the data subject has objected to processing pursuant to Article 21(1) pending the verification of whether the legitimate grounds of the controller override those of the data subject. If you wish to exercise this right, please contact us using any of the methods indicated below.
Right to Disable Cookies	You can disable cookies at any time. Internet browsers are generally configured by default to accept cookies; however, you can easily disable them by changing your browser settings. Many cookies are used to improve the usability or functionality of websites. Therefore, disabling them may prevent you from enjoying all or part of the services provided through our website, cause usability problems, or lead to issues with your session when logging in. If you wish to limit or block all cookies set by our websites (which may prevent you from using certain parts of the website) or by any other websites/applications, you can do so through your browser settings.

How can you exercise your data protection rights?

To exercise your rights, you must submit a written request to the following address: C. del Lector Romero, 8, 46702 Gandia, Valencia, or to the following email address: [email protected] indicating in the subject line “GDPR Valencia”. You must specify which right you wish to exercise. If you are acting through a legal or voluntary representative, you must also provide documentation proving the representation and the representative’s identification document. If you would like a template for this, you can:

1. It is good to use an official Agency model: https://www.aepd.es/reglamento/derechos/index.html
   1. Well, ask us for a model: info@ cristalumjavea.com

1. Processing of special categories of personal data and personal data relating to criminal convictions and offenses

When filling out free text fields, you are not allowed to enter personal information relating to data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or to process genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation, as well as personal data relating to criminal convictions and offenses. If you enter any information relating to the aspects mentioned in any of our forms or via email, it will be immediately deleted from our information systems, and we will be unable to process your inquiry, as such data is neither necessary nor relevant for the purposes specified in the data processing activities on this website.

1. Links to other websites

We sometimes provide links to other websites, but these websites are not under our control. Therefore, we will not be liable for any problems that arise in connection with the use of personal data, the content of the website, or the services offered by these websites.

1. Data Quality

The User declares that the data provided, whether their own or that of third parties they represent, is true and accurate, and is responsible for communicating any modifications or updates to said data. The user will be liable for any damage or loss, direct or indirect, that may be caused to CRISTALERIA Y ALUMINIOS GRAU SL or any third party as a result of providing false, fraudulent, inaccurate, incomplete, or outdated personal data. The data requested from the user and marked with an asterisk (*) are strictly necessary to contact the user. Under no circumstances will providing only the strictly necessary data result in a reduction in the quality of service.

1. Data of Minors or Incapacitated Persons

Use of the Service is not permitted to minors. If you are under 16 years of age, please refrain from using our website’s services.

CRISTALERIA Y ALUMINIOS GRAU SL may request additional information or documentation for the purpose of Verify the age of the interested party, taking into account the available technology.

1. Data Update

The user is the sole source of information regarding their personal data. Therefore, CRISTALERIA Y ALUMINIOS GRAU SL requests that, in order to keep your data updated and current at all times in accordance with the principles of the GDPR, you notify the address indicated for exercising your rights of access, rectification, erasure, and objection of any changes to said data, as well as the cessation of your activity in the entity you represent, if applicable, so that we may proceed with the erasure and/or archiving of said data.

1. Consent for advertising mailings.

According to the LSSI Law, CRISTALERIA Y ALUMINIOS GRAU SL will not send commercial communications by email or other equivalent electronic means that have not been previously authorized by the recipient through the authorization systems used by CRISTALERIA Y ALUMINIOS GRAU SL

.

In the case of users with whom there is a prior contractual relationship, CRISTALERIA Y ALUMINIOS GRAU SL is authorized to send commercial communications regarding products or services of the organization that are similar to those initially contracted by the client. In any case, the user can voluntarily opt out of receiving further commercial information through Customer Service channels after verifying their identity, or by unsubscribing directly from the promotional email.

Personal data will be kept in our information systems indefinitely to carry out commercial communications about the company’s products and services, unless the right to object to such advertising mailings is exercised.

1. Social Networks

By becoming a fan, As a follower or similar of CRISTALERIA Y ALUMINIOS GRAU SL on various social media platforms, and in the context of this data processing, you should be aware that CRISTALERIA Y ALUMINIOS GRAU SL can only access or delete your data in a limited way, as it has a specific profile. Any corrections to your data or restrictions on information or publications must be made through your profile or user settings on the social media platform itself. By default, you consent:

a) The processing of your personal data within the environment of said social network and in accordance with its Privacy Policies.

b) CRISTALERIA Y ALUMINIOS GRAU SL‘s access to the data contained in your profile or biography. Depending on your privacy settings on each network, this access will be more or less extensive.

c) That news published about our events, or our comments, may appear on your wall or biography.

d) To receive communications about our products/events.

If you want to unfollow us, just click the “Unfollow” or “Stop following” option.

1. Modification of this privacy policy

CRISTALERIA Y ALUMINIOS GRAU SL reserves the right to modify this policy to adapt it to future legislative or jurisprudential developments, as well as industry practices, informing users in advance of any changes.

Continuous use of CRISTALERIA Y ALUMINIOS GRAU SL by the User will constitute ratification of this document, including any modifications and changes that may have been introduced.

For the same reasons mentioned above, CRISTALERIA Y ALUMINIOS GRAU SL reserves the right to modify or discontinue the Service in whole or in part, with or without prior notice to the user. CRISTALERIA Y ALUMINIOS GRAU SL will not be liable to the User or to third parties for exercising its right to modify or discontinue the Service.