In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data (GDPR), as well as Organic Law 3/2018 (LOPDGDD) and the rest of the current legislation on data protection, we inform you of the following:

Identity: REFRESCOS DEL ATLÁNTICO, S.L. (hereinafter “the Entity”)
Tax ID (NIF): B36181766
Address: Lugar Moledo Ardan 123 – 36912 Marín (Pontevedra)
Phone: 986 70 20 70
Email: protecciondedatos@refrescosdelatlantico.com

By accessing and using this website, enjoying our services, or using any means involving the processing of personal data, you accept this Privacy Policy, along with the provisions in the Legal Notice and the Cookie Policy.

At Refrescos del Atlántico, we will provide you with information so that, before entering your personal data, you can access this Privacy Policy and any other relevant information regarding data protection.

This Privacy Policy may be modified by the website owner when necessary. You will be notified via the website or another communication channel so that you are aware of any changes and can continue to use our services. Continuing to use our services after being notified of these changes will be considered acceptance, except where express consent is required.

A) Data collected through the “Tell us your idea” form

Purpose: Management, control and resolution of issues raised through this contact form by users of the website.
Obligation to provide data: Only fields marked with * are required to carry out the stated purpose.
Legal basis: Consent freely, specifically, and unequivocally given by the data subject.

B) Images collected by the video surveillance and alarm system

Purpose: Security of people, property and facilities, as well as monitoring the commission of crimes or offences.
Legal basis: Legitimate interest of the controller (Art. 6.1.f GDPR) to ensure security and prevent crime.

C) Client/supplier data mainly received by email for contracting, order management, etc.

Purpose: Managing contracts for the provision of services and sale of manufactured and/or distributed products, including orders, invoicing, payments, collections, and related administrative management.
Legal basis: Necessary for the performance of a contract to which the data subject is party, or for compliance with a legal obligation (Arts. 6.1.b and 6.1.c GDPR).

D) Data collected through the “Work with us” form

Purpose: To store your CV in our database for possible current or future recruitment processes.
Obligation to provide data: Only fields marked with * are required.
Legal basis: Consent freely and explicitly given by the data subject and the adoption of pre-contractual measures within a recruitment process.

E) Data collected through the “Whistleblowing channel” form

Purpose: Management of the whistleblowing channel implemented by the Entity.
Obligation to provide data: Only fields marked with * are required.
Legal basis: Compliance with a legal obligation.

We store your data for as long as necessary to comply with the legal obligations set out by administrative regulations and always for at least the minimum retention period required by law (5 years).

Images collected by the alarm and video surveillance systems are kept for a maximum of 4 weeks unless a crime has been reported, in which case they will be retained for as long as necessary.

Reports submitted through the whistleblowing channel will be kept for as long as necessary to fulfill the purpose for which they were collected and to determine possible liabilities arising from that purpose and the processing of the data (maximum 10 years).

The legal basis for data processing is the consent obtained from the data subject, the performance of contracted services, compliance with legal obligations, and the legitimate interest of the Data Controller in maintaining professional contact and sending commercial communications about its products and services.

Any personal data collected will be treated with absolute confidentiality. We are committed to maintaining secrecy regarding such data and ensuring their protection by adopting all necessary measures to prevent alteration, loss, unauthorized processing, or access, in accordance with applicable law.

You declare that you have been informed of the terms regarding the protection of personal data and that you accept and consent to the processing of your data by Refrescos del Atlántico in the manner and for the purposes stated in this Privacy Policy.

1. Public Administrations and their various agencies whenever necessary to fulfill the purposes mentioned above, provided there is a legal basis for doing so.

2. Data processors for the use of software applications or subcontracted services, according to the data processing agreement signed between the parties.

3. Banking institutions for the management of collections and payments.

4. Tax and accounting advisors to ensure compliance with the company’s fiscal and accounting obligations.

5. Images collected by the alarm and video surveillance systems may be shared with the Law Enforcement Authorities and Seguritas Direct.

6. The email service provider, for email communication management.

International data transfers: No data transfers are made outside the EU.

Under no circumstances will your personal data be shared with third parties without complying with legally established requirements.

We work with service providers who may have access to your data and will process it on behalf of and under the instructions of REFRESCOS DEL ATLÁNTICO. These providers are selected through a thorough verification process to ensure adequate control in terms of data protection. Furthermore, a contract will be signed in accordance with Article 28 of the General Data Protection Regulation (GDPR), requiring these providers to apply appropriate technical and organizational measures and to process personal data solely according to the documented instructions of the controllers.

If any of these processors are located outside the European Economic Area, the controllers will enter into Standard Contractual Clauses with them, providing adequate guarantees and ensuring that any access these third parties may have to your data is protected at all times.

As the data subject, you have control over your personal information. This also helps us ensure that the data we process is accurate and up to date.

The rights you may exercise are those recognized by current legislation, including:

• Access: You have the right to know what data the COMPANY is processing about you.

• Rectification: You have the right to request the correction of inaccurate data.

• Erasure: You have the right to request the deletion of your data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

• Restriction of processing: In certain circumstances, you may request the restriction of data processing, in which case we will only retain the data for the exercise or defense of legal claims.

• Objection: In certain circumstances, you may object to the processing of your data. In that case, the COMPANY will stop processing your data, except for compelling legitimate reasons or for the exercise or defense of possible claims.

• Data portability: This applies only to automated data and involves transferring data from the COMPANY to another Data Controller (not to the data subject and only upon their request).

You can exercise your rights, including the right to withdraw your consent (if previously given), by sending a written request to the address indicated above or by emailing protecciondedatos@refrescosdelatlantico.com.

You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD), the Supervisory Authority:
https://sedeagpd.gob.es/sede-electronica-web/vistas/formReclamacionDerechos/reclamacionDerechos.jsf

The company has adopted both technical and organizational security measures based on a Risk Analysis and Compliance Audit carried out under the GDPR and LOPDGDD, and considering the type of personal data managed.

The actions described in this section, designed to ensure an adequate level of security appropriate to the identified risks, include, where necessary, the following measures:

• Pseudonymization and encryption of personal data.

• Measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.

• Measures to restore the availability and access to personal data promptly in the event of a physical or technical incident.

• Existence of a regular verification, evaluation, and assessment process to ensure the effectiveness of technical and organizational security measures.

• Periodic assessment of the risk of accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

• Measures to ensure that any person acting under the authority of REFRESCOS DEL ATLÁNTICO and having access to personal data only processes such data following the company’s instructions.

The user declares that they have been informed about the terms relating to personal data protection and that they accept and consent to the processing of their data by REFRESCOS DEL ATLÁNTICO as set out in this Privacy Policy.

This version of the Privacy Policy corresponds to an update published and effective as of March 2025.
You may contact REFRESCOS DEL ATLÁNTICO through the established communication channels for any inquiries related to this policy.

In accordance with the provisions of the current personal data protection regulations, Organic Law 3/2018 (LOPDGDD) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, we inform you that your personal contact data will be processed under the responsibility of REFRESCOS DEL ATLÁNTICO, S.L. for the purpose of sending communications regarding services provided, incidents, or enquiries made.

The legal basis for processing is your consent or the legitimate interest of the controller (Art. 6.1.f GDPR), namely to maintain relationships and provide the best possible service to our clients and/or suppliers, as well as compliance with a legal obligation (Art. 6.1.c GDPR).

Your data will not be shared with third parties, except where legally required.

You may exercise your rights of access, rectification, erasure, restriction and objection by sending an email to protecciondedatos@refrescosdelatlantico.com.

The information contained in this message is confidential and may include privileged data. It is intended solely for its recipient. Access or use by any unauthorised person may be unlawful. If you are not the intended recipient, please delete its contents. You can find additional information on data protection in our website’s privacy policy: www.refrescosdelatlantico.com