Privacy policy
Last updated: October 2026
At CRISTACER we take the protection of your data seriously. This policy explains how we process the personal data you provide through this website and in the context of our business relationship, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD) and Law 34/2002 (LSSI-CE).
Summary
| Item | Information |
|---|---|
| Controller | CRISTAL CERÁMICAS, S.A. — Tax ID A12086195 |
| Purposes | Answering enquiries and requests; managing relationships with customers, distributors and suppliers; managing job applications; sending commercial communications if you have consented; managing the whistleblowing channel; web analytics with your consent. |
| Legal basis | Consent, performance of a contract or pre-contractual measures, compliance with legal obligations and legitimate interest. |
| Recipients | No data is disclosed to third parties unless legally required. Service providers acting as processors on behalf of CRISTACER. |
| International transfers | Only to providers offering adequate safeguards (adequacy decision or standard contractual clauses). |
| Rights | Access, rectification, erasure, objection, restriction of processing and portability, withdrawal of consent, and the right to lodge a complaint with the Spanish Data Protection Agency (AEPD). |
1. Data controller
- Identity: CRISTAL CERÁMICAS, S.A.
- Tax ID: A12086195
- Address: Ctra. Viver – Puerto de Burriana, km 55.5 (P.O. Box 64), 12200 Onda (Castellón), Spain
- Telephone: +34 964 602 852
- Email: cristacer@cristalceramicas.com
2. Purposes, legal basis and retention periods
| Processing | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Contact form and enquiries | Answering your enquiries and requests for information on products, catalogues, stock or distribution. | Consent (6.1.a) and, where applicable, pre-contractual measures (6.1.b). | As long as needed to handle the enquiry and then up to 1 year, unless a business relationship begins. |
| Customers, distributors and suppliers | Sales and order management, invoicing, accounting, tax and administrative obligations. | Performance of a contract (6.1.b) and legal obligation (6.1.c). | For the duration of the contract and thereafter for the legally required periods (6 years under the Spanish Commercial Code; 4 years under the General Tax Law). |
| Job applications | Managing your application and current and future recruitment processes. | Consent (6.1.a) and pre-contractual measures (6.1.b). | 1 year from receipt or last update of your CV, unless you request erasure earlier. |
| Commercial communications | Sending you news, catalogues and information about CRISTACER products and events. | Consent (6.1.a) or legitimate interest regarding customers (Art. 21.2 LSSI-CE). | Until you withdraw consent or object. |
| Whistleblowing channel | Managing reports received through the internal reporting system. | Legal obligation (6.1.c) — Spanish Law 2/2023. | Only for the time necessary to decide whether to investigate and, at most, the periods set out in Article 32 of Law 2/2023. |
| Web analytics | Obtaining aggregated website usage statistics. | Consent (6.1.a) given through the cookie panel. | As set out in the Cookie Policy. |
| Social media | Interacting with users who follow our profiles. | Consent (6.1.a) / legitimate interest (6.1.f). | For as long as the relationship on the social network is maintained. |
We do not create commercial profiles or take automated decisions with legal effects on you. The “Favourites” feature is stored only in your browser and CRISTACER does not access it.
3. Data processed and source
We process the data you provide directly: identification and contact details (first name, surname, company, position, email, telephone, address, country), the content of your message and, for customers, tax, bank and transaction data. For job applications, the academic and professional data included in your CV. Please do not include special categories of data (health, beliefs, etc.) in your CV.
Fields marked as mandatory in the forms are required to handle your request. You guarantee that the data is accurate and that, if you provide third-party data, you have their authorisation to do so.
4. Recipients
Your data will not be disclosed to third parties unless legally required (Tax Authorities, banks for the management of collections and payments, Courts and Tribunals, law enforcement agencies). For distribution enquiries, your data may be shared with CRISTACER’s agents or distributors in your area in order to handle your request.
To provide its services, CRISTACER uses providers that access data as processors (web hosting and maintenance, email, IT services, consultancy, web analytics), with whom it has signed the agreements required by Article 28 GDPR.
5. International transfers
Some technology providers (for example, Google LLC for web analytics, Adobe Inc. for the website fonts or Meta Platforms for Instagram) may process data outside the European Economic Area. In such cases, transfers are based on the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or on the standard contractual clauses approved by the European Commission.
6. Your rights
You may exercise the following rights at any time:
- Access: find out whether we process your data and obtain a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion of your data when it is no longer needed.
- Objection: object to processing, including commercial communications.
- Restriction of processing: in the cases provided for in the GDPR.
- Portability: receive your data in a structured, commonly used format.
- Withdraw your consent at any time, without affecting the lawfulness of prior processing.
To exercise them, write to cristacer@cristalceramicas.com or to our postal address, stating the right you wish to exercise and proving your identity. We will reply within one month, which may be extended by two further months in complex cases.
If you consider that your rights have not been properly respected, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es) or with the supervisory authority of your Member State of residence.
7. Minors
This website is not aimed at children under 14. In accordance with Article 7 LOPDGDD, we do not process data of children under that age without the consent of their parents or guardians.
8. Security
CRISTACER applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk (Art. 32 GDPR), such as HTTPS encrypted communication, access control and backups, in order to prevent loss, alteration or unauthorised access to your data.
9. Changes to this policy
We may update this Privacy Policy to reflect legislative changes or changes in our processing activities. The current version will always be the one published on this page, together with the date of its last update.