PRIVACY POLICY
Data controller information
ONEBOX IBÉRICA, S.L. (hereinafter, “ONEBOX” or the “Company”), with tax ID (CIF) B-65315954 and registered office at C/ Via Augusta, 21-23, floor 7, Sarrià-Sant Gervasi District, 08006 Barcelona, is the controller of the personal data collected through its platforms, in accordance with Regulation (EU) 2016/679 (GDPR). For any matter relating to the processing of personal data, you may contact us at the email address [email protected].
ONEBOX acts as data controller only in those cases where it directly collects personal data from representatives or contact persons of other entities with which it maintains a contractual, operational or commercial relationship. In those cases where the processing is carried out on behalf of third parties — for example, in the sale of tickets for events organised or promoted by ONEBOX clients — the data provided in the registration forms will be incorporated into the files of those organisers, who will be duly identified on the event information page and in the purchase conditions that the user must accept beforehand. In these cases, ONEBOX will act as data processor in accordance with what is contractually established with each responsible entity.
How will personal data be processed?
Your personal data will be processed in accordance with the provisions of the regulations in force on privacy. In particular, and without limitation, this includes:
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter, “GDPR”);
Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (hereinafter, “LOPDGDD”);
Any national regulation, of any country, governing the processing of personal data;
Or any regulation that amends, develops or replaces the foregoing.
Information on the purpose of processing
Your personal data will be processed by ONEBOX for the following specific purposes:
To handle general contact requests sent through the forms available on the Website.
Legal basis: your consent.
To manage commercial demo requests through the “Book a demo” form.
Legal basis: application of pre-contractual measures or performance of a contract.
To manage conversations initiated through the Chatbot channel.
Legal basis: your consent.
To answer queries raised through the frequently asked questions (FAQs) channel.
Legal basis: your consent.
To send electronic commercial communications relating to services or promotions offered by ONEBOX, where there is no prior contractual relationship.
Legal basis: your consent.
To manage participation in quality surveys and to analyse satisfaction with the services offered.
Legal basis: ONEBOX’s legitimate interest in the continuous improvement of its processes.
The main purpose of the processing of your personal data is not conditional upon the informed consent you have given us for the use of cookies on our Website. For more information, you may consult our Cookies Policy.
Categories of personal data processed
ONEBOX processes personal data in different contexts, depending on the relationship established with users:
a) When acting as data controller (direct interactions with ONEBOX):
We process personal data provided voluntarily by users who interact with us through our website, email or commercial channels, including:
• Platform demo requests
• Contact or quote requests
• Registration for webinars, promotional events or training sessions
• Download of technical or commercial content (for example, whitepapers)
• Subscription to newsletters
• Participation in satisfaction surveys or support forms
In these cases, the data processed may include:
• Identifying data: first name, surname
• Professional data: company, position
• Contact data: email address, telephone
• Information about the request and contact preferences
• Technical browsing data (IP, device type, interaction logs)
This data is processed for the purpose of handling the request, carrying out commercial follow-up, providing access to content or managing relationships with current or potential clients.
b) When acting as data processor (users purchasing tickets):
ONEBOX provides technological services to event organisers/promoters. In this context, we process personal data on behalf of the data controller.
The data includes: first name, surname, email address, contact details, selected event and purchase options. Additional data may be required by the organiser (affiliations, preferences, etc.) under its own privacy policy.
Third-party recipients of personal data
Depending on the purposes for which the personal data has been collected, the following categories of recipients may access it:
• Public administrations, competent authorities and law enforcement agencies, in those cases where there is a legal obligation, a judicial requirement, or sufficient evidence to consider that a criminal offence has been committed.
• Third-party providers that render services to ONEBOX as data processors, such as web hosting services, CRM solutions, commercial automation tools or analytics platforms. These providers will only access the data to the extent necessary to render the contracted service and in accordance with the instructions documented by ONEBOX.
• Collaborators with operational access to ONEBOX systems or infrastructure, provided that such access is governed by a data processing agreement in accordance with Article 28 of the GDPR and specific confidentiality, security and use-limitation clauses.
• Collaborating entities or technology partners, only where such access is justified by the provision of integrated services and processing in accordance with the applicable contractual and legal safeguards is ensured.
Under no circumstances will your personal data be transferred to third parties for purposes other than those indicated here without your prior consent, except where required by law.
International transfers
No international data transfers are carried out.
Automated individual decisions
ONEBOX IBÉRICA, S.L. does not make decisions that may produce significant legal effects on users based solely on the automated processing of personal data, including profiling, in accordance with Article 22 of Regulation (EU) 2016/679 (GDPR).
Should systems involving this type of automated decision be implemented in the future, prior information will be provided in a clear, transparent and specific manner about their operation, the logic applied and the foreseen consequences, and appropriate mechanisms will be made available to guarantee the rights of the data subject, including the possibility of requesting human intervention.
Retention period
Your personal data will be processed for the period necessary to fulfil the purposes established in this Privacy Policy, as well as to retain your personal information in compliance with the provisions of the relevant laws and regulations, especially in relation to the legal limitation periods, and for the formulation, exercise or defence of claims.
What are your rights?
It is the User’s responsibility to provide all up-to-date data required as mandatory for the use and enjoyment of the services and products offered. The data and information provided will be assumed to be true, accurate and current, and it is the User’s responsibility to modify and/or update such information at all times; otherwise, the data will be deemed unchanged, accurate and current.
If you have provided us with the personal data of a third party, you must, prior to its inclusion, have informed them and obtained their consent regarding the matters set out herein.
At any time, you may exercise your rights of access, rectification, erasure and objection, restriction of processing and portability regarding your personal data, by sending a communication with a photocopy of your ID document to ONEBOX IBÉRICA, S.L. at the email: [email protected]; In the case of marketing or direct electronic communications, the mailings will offer an automatic system to reject the receipt of future commercial communications; all of this without retroactive effect on the previous processing and transfer of data to third parties, and without prejudice to the obligations and legal consequences arising therefrom for the file controllers.
Specifically, the general content of your rights is as follows:
(1) Right of access. The right to confirm whether we are processing your personal data and, if so, to obtain a copy of that data and complete information about the processing.
(2) Right of rectification. The right to correct errors, modify inaccurate or incomplete data and ensure the accuracy of the information being processed.
(3) Right of erasure. The right to request the erasure of your data without undue delay, where the processing is unlawful or the purpose that motivated its processing or collection has ceased to exist.
(4) Right to restriction of processing. The right to request the suspension of processing where it is unlawful or where the accuracy of the data has been contested.
(5) Right to object. The right to object to the processing of your data where it is intended for direct marketing or where the processing must cease for reasons relating to your personal situation, unless a legitimate interest is demonstrated or it is necessary for the exercise or defence of claims.
(6) Right not to be subject to individualised decisions. The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or affects you, unless it is necessary for the performance of a contract, permitted by law or you have given your explicit consent.
(7) Right to portability. The right to receive the personal data concerning you, where a ticket distribution and management service has been contracted, in a structured, commonly used and machine-readable format, and to transmit it to another controller where the processing is carried out by automated means.
The exercise of these rights is free of charge, unless requests are manifestly unfounded or excessive, in which case the data subject may be required to bear the cost of processing the request.
In any case, you may contact the Data Protection Officer (DPO) appointed by ONEBOX IBÉRICA, S.L. for any matter relating to the processing of your personal data or the exercise of your rights, by sending a communication to:
Email: [email protected]
Postal address: Pº de la Castellana, No. 95, FLOOR 15, Madrid (28046), Madrid-Spain.
We also remind you that, in accordance with EU Regulation 2016/679, you have the right to lodge a complaint regarding any legal breach before the data protection supervisory authorities.
Security and confidentiality
ONEBOX will process the data with the utmost confidentiality and will maintain professional secrecy with respect to all of it, undertaking not to disclose it to unauthorised third parties without the respective consent, not even for its storage — an obligation that will subsist even after the commercial relationship with the User ends; all of this in accordance with the regulations in force, adopting the technical, organisational and security measures necessary to guarantee the security of the personal data processed and to prevent its alteration, loss or unauthorised processing, taking into account the state of the art, the cost of implementation, the nature of the data stored, and the scope, context and purposes of the processing, as well as the risks of varying likelihood and severity to which they are exposed and which the processing entails for the rights and freedoms of natural persons.
ONEBOX reserves the right to modify this Privacy Policy in order to adapt it to legislative developments, industry practices or internal decisions that entail changes to the purposes or means of processing personal data.
Should substantial changes be introduced that affect users’ rights, notice will be given in due course through the website, by email or through the contact means provided by the user, with reasonable advance notice of their entry into force. We recommend reviewing this policy periodically to stay informed about how we protect your information.
