IMTO PACK SL wishes to inform Data Subjects of its policy regarding the processing and protection of personal data. We want to maintain a transparent relationship with you by informing you about how we securely collect and process any data you provide to us. To that end, we have developed this Privacy Policy (hereinafter, the Policy), which will allow you to access the information you need and clarify any questions you may have.

We also inform you that your data will be processed in accordance with the provisions of current regulations on personal data protection, and specifically, in accordance with the provisions of Regulation (EU) 2016/679 of April 27, 2016 (GDPR) concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data, and Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights.

It is important that you read this Policy carefully, as it will provide you with the information you need to make an informed decision when providing us with your personal data. In addition, please note that this Policy applies to all processing of personal data carried out by any company within the IMTO Group.

If required by the country in which you are located, this Policy may be further supplemented by local provisions. This Policy does not apply to third-party websites, including those that you may access via a link from our website.

We hope this information is helpful to you; however, if you need clarification on any additional points, please feel free to contact us.

1. Who is responsible for processing your personal data?

The information and/or personal data you provide to us, including, where applicable, specially protected data, will be processed under the responsibility of:

Identity: IMTO PACK SL (hereinafter, IMTO)

Tax ID Number: B45632874

Mailing Address: Carretera CM-400, KM 22.600, 45430, Mascaraque (Toledo)

Phone: 925 324 000

Data Protection Officer Contact Information: protecciondedatos@imto.com

2. For what purpose and on what legal basis do we process your personal data?

At IMTO, we process your personal data in connection with the contractual or business relationship you have with us for the following purposes and on the following legal grounds:

• To fulfill the contracts you enter into with IMTO. This includes the management, maintenance, fulfillment, and oversight of the contractual relationship you have established with IMTO, as well as any precontractual relationships that have been or will be established as a result of such contracts.
• Compliance with the obligations imposed on IMTO by the laws and regulations applicable in each case.
• If you have given your consent, we will process your data in order to offer you personalized IMTO products and services based on your profile—which is created using your personal data, the products you have purchased, and the operations, activities, or transactions associated with your products.
• In the legitimate interest of IMTO to continuously improve the quality and functionality of the services we offer you, we will use your usage patterns across the various channels, products, and services for statistical purposes. In addition, we may inform you, by any means, about products or services we offer that are similar to those you have purchased. You may exercise your right to object at any time by contacting us at the address indicated in this document.
• Management of inquiries, complaints, incidents, and requests submitted by users. IMTO will process the data necessary to address the user’s request. In this way, we will process data such as your first name, last name, email address, phone number, province, and ZIP code, as well as information regarding whether or not you are an IMTO customer.
• Computer-based monitoring of the website. IMTO will monitor and control the use of the website in order to prevent and detect any fraudulent use, with the aim of avoiding, preventing, and/or detecting any unauthorized access, alteration, or loss of information relating to third parties other than the user that could give rise to civil, criminal, and/or administrative liability for IMTO.
• Cookie Data Processing: For more information, please see IMTO’s cookie policy.

3. How do we handle your personal data?

We are committed to processing your data in accordance with applicable regulations and, in particular, to process the data to which we have access by applying appropriate technical and organizational measures to ensure an adequate level of security, guaranteeing at all times the ongoing confidentiality, integrity, availability, and resilience of the processing systems and services.

4. How long will we retain your data?

IMTO will process your data for as long as necessary to fulfill the request made by the customer. In this regard, we will keep your personal data on file for the statute of limitations period applicable to any legal actions that may arise from our relationship with you or to comply with any requests from the authorities.

5. Who will we share your information with?

No data will be disclosed to third parties, unless required by public agencies.

In order to properly manage the services provided and the personal data of its users, IMTO may rely on the assistance of third-party service providers who may have access to your personal data and who will process such data on behalf of IMTO as part of their service provision. IMTO undertakes to enter into the corresponding data processing agreement with them, through which it will impose, among others, the following obligations: to implement appropriate technical and organizational measures; to process personal data for the agreed-upon purposes and solely in accordance with IMTO’s documented instructions; and to delete or return the data to IMTO once the provision of services has ended.

6. How did we obtain your data?

The personal data that IMTO processes regarding the user on its website consists of the information the user provides in the forms provided.

7. How does IMTO obtain user consent?

When necessary, as noted above, IMTO will obtain users’ consent through the specific checkboxes located on the forms—both online and on paper—as well as through other means deemed appropriate for that purpose.

8. What are your rights when you provide us with your personal information?

You have the right to request the following from IMTO:

• The right to access your personal data, including confirmation of whether IMTO is processing personal data concerning you, as well as the right to access such data and information related to the processing being carried out (right of access).
• The correction of your personal data that is inaccurate, incomplete, or out of date (right to rectification). IMTO may also update your data when it becomes aware of such inaccuracy or lack of updates.
• The erasure of your data when, among other reasons, it is no longer necessary for the purposes for which it was collected; in such cases, IMTO will cease to process it except to exercise or defend against potential claims or to comply with a legal obligation (right to erasure).
• The restriction of the processing of your data under certain circumstances; you may request the suspension of the processing of your data or the retention thereof, in which case your data may only be processed with the appropriate consent, except for its retention and use for the purpose of asserting or defending claims, complying with legal obligations, or protecting the rights of another natural or legal person, or for reasons of substantial public interest of the European Union or a specific Member State (right to restriction of processing).
• You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, unless the circumstances provided for by law apply; in any case, you have the right to request human intervention, to express your point of view, and to challenge the decision.
• The right to object to the processing of your data; in such cases, IMTO will cease processing your data, except for compelling legitimate reasons or to defend against potential claims (right to object).
• Data portability, which allows you to receive a file in a structured, commonly used, and machine-readable format containing the personal data concerning you that you have provided to IMTO, or to request that IMTO transmit such data directly to another data controller, when technically feasible (right to data portability).
• The withdrawal of any consent granted, if applicable, for the purpose described in section “2. For what purpose and on what legal basis do we process your personal data?”, without this affecting the lawfulness of the processing based on consent prior to its withdrawal (right to object).

9. What happens if you provide us with third-party data?

If, in the course of your relationship with us, you provide us with data regarding third parties, please be advised that you are solely responsible for obtaining their prior consent to disclose the data to IMTO for the purpose specified in each case, as well as for informing them of the contents of this Policy.

You agree to hold IMTO harmless from any liability arising from a failure to provide information and/or consent to the Third Party.

10. How do we handle your data on social media?

We recommend that you avoid including personal information—whether your own or that of third parties—when interacting with us on social media. However, if you nevertheless decide to include personal information, please be aware that we will process your data in accordance with this Policy.

Specifically, the data you provide us through any social media platform will be processed for the purpose of connecting and interacting with you on various social media platforms so that you can get to know us better, as well as our activities and values. This channel is not the appropriate one for submitting complaints or suggestions; however, if you send us any type of request, claim, suggestion, or complaint related to another IMTO company through social media, please be advised that we will forward the minimum necessary information so that our customer service department can assist you and properly process your request.

The legal basis for this processing is the fulfillment of your status as a user, friend, or follower of our social media profile, or the need to respond to you if you mention our profile in your comments, even if you are not a follower; in the latter case, we will process only the minimum amount of data necessary to respond to you.

Therefore, it is important to note that when you interact with us through social media, the terms of use established by the social media platform operator are beyond our control. Consequently, they are not covered by this Policy. We recommend that you ensure you are familiar with and agree to their legal terms and privacy policies before continuing to use their services or providing any personal information.

11. Can we change the terms of the Policy?

We may modify this Policy at any time, but we will always notify you of any significant changes through the appropriate notice. Whenever we make minor changes to our Privacy Policy, we will update it with a new effective date, which will be included in the document. Our processing of your data will be carried out in accordance with the provisions of that new version of the Privacy Policy from its effective date forward. We recommend that you review the Policy periodically.

12. What are your responsibilities?

You are responsible for all the data you provide to us, including its accuracy, correctness, timeliness, and authenticity, as well as for the consent you provide for its use and/or processing. You are also responsible for any third-party data you provide to us and are required to obtain the consent of those third parties. And don’t forget that you are responsible for periodically reviewing this Policy and any updates that may be made to it.

13. To whom can you file a complaint regarding the processing of your personal data?

You may contact the IMTO Data Protection and Privacy Officer to file a complaint or for any questions regarding the processing of your personal data by emailing protecciondedatos@imto.com

In addition, you may file a complaint with the Spanish Data Protection Agency (AEPD) by sending a written notice to the following address: C/ Jorge Juan, No. 6, 28001 – Madrid, or through the website www.aepd.es, particularly if you believe that your rights have not been adequately addressed after having previously contacted the IMTO Data Protection and Privacy Officer.

Last updated: November 2, 2021.