Privacy Policy

1. Scope and our role

This Privacy Policy explains how we collect, use, disclose and retain personal data in connection with our website and our downloadable business databases. “We” and “our” mean the owner of the profesionalretail.com website, the controller of the personal data described in this Policy. In particular, Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”; in Spanish, “RGPD”), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (“LOPDGDD”) apply.

The Policy covers two different groups: people who visit our website, open an account, place an order or contact us; and people whose publicly accessible professional or business contact details appear in a Database. You do not need to be our customer to ask for information about a record that concerns you, to correct it, to object to its processing or to request its deletion.

Information that relates only to a legal entity may not be personal data. The business e-mail of an identified employee, the details of a sole trader or self-employed person, or another record that identifies an individual may be personal data even when published in a business context. The fact that data is publicly accessible does not by itself allow its unrestricted collection, resale or commercial use.

We determine the purposes and means of our own collection, preparation and licensing of the Databases and are the controller of that processing. Customers who download a Database normally determine their own subsequent uses and act as independent controllers. A customer does not become our processor merely by buying a Database. We do not pass our own privacy obligations on to customers.

This Policy is a transparency notice (Articles 13 and 14 GDPR). Visiting the website, accepting our Terms and Conditions or buying a Database does not by itself constitute consent to all the uses of personal data described here.

2. Data of website users and customers

Depending on how you use the service, we process the following categories of data:

• Account and contact data: name, e-mail, company, professional contact details, account identifier and authentication data.
• Order and billing data: products purchased, prices, currency, invoice details, billing address, relevant tax details (such as the Spanish NIF/CIF tax ID), transaction references, payment status and refund history.
• Acceptance and delivery records: the version of the Terms accepted, the required choices about immediate supply, timestamps, Database identifiers, access and download events, file transfer status and related technical records.
• Customer support data: messages, attachments you choose to provide, details of complaints or refunds, privacy requests and our replies.
• Technical data: IP address, browser and device information, operating system, session identifiers, pages requested, security events and approximate location derived from the IP address.
• Preferences: cookie choices, subscriptions to commercial communications and unsubscribe or exclusion records.

Optional analytics or advertising, when enabled, may generate additional information about interaction with the website or identifiers, as explained in Section 7 and in the Cookie Policy. We do not use private customer account, billing or payment dispute data as material for the contact Databases we license.

Payments are processed through the payment provider indicated at checkout. We use the transaction references, payment status and billing data needed to manage orders. Do not send us your full card details or security code in messages to customer support. The payment provider's own privacy policy explains its processing and responsibilities.

The data needed to process an order, deliver a file or meet a legal billing requirement is necessary for those purposes. If it is not provided, we may be unable to complete the order. Optional commercial communications and tracking are not conditions for buying a Database.

3. Data in the databases and where it comes from

Our Databases contain the business information described on each product's pages. Depending on the Database, records may include a business's name, its sector, location, business address, website, professional e-mail, telephone and published professional contact details. Records relating to an individual (for example, a shop run by a self-employed person) may also include their trade name, activity, professional connection, a link to a professional profile and information about the source.

The sources are public business listings (in particular, Google Maps), publicly accessible company websites, business directories, public registers and publicly visible professional profiles, where their collection and further use are lawful. A person or a business may also provide corrections to us directly. The product description indicates the relevant categories of sources; you can ask us for the information available about the specific source of a record that concerns you.

The intended scope of our Databases is professional and business information. We do not intentionally collect for these Databases special categories of data (Article 9 GDPR), private credentials, private messages or information obtained by circumventing account access restrictions. If you believe a record contains inappropriate or sensitive personal information, contact us so that we can investigate and, where appropriate, delete or restrict it.

Information from the sources may be inaccurate, incomplete or outdated. Our Terms and Conditions explain the limitations of public-source data and the commitments specific to each product. Those limitations do not remove the rights of individuals, including the rights to rectification and erasure.

4. Purposes and legal bases

We process data only for a specified purpose and on a legal basis provided for in Article 6 GDPR:

Our interest in processing the Databases consists of organizing relevant professional information into useful business directories, supporting lawful commercial research and supplying the data products described. Commercial benefit or public accessibility alone do not constitute a valid legal basis.

5. Recipients

We disclose only the data necessary for the relevant purpose and subject to the applicable legal requirements:

• Service providers: providers of hosting, storage, account infrastructure, e-mail delivery, customer support, security and payment processing; and analytics or advertising providers only when those tools are lawfully enabled. Depending on the service, they act as processors or as independent controllers.
• Database customers: businesses and professionals who buy the relevant Database for commercial research and other permitted professional activities. The delivery of a Database may include the professional contact details described in Section 3.
• Professional advisers and authorities: legal, accounting or other advisers, courts and tribunals, supervisory authorities and public administrations where necessary and lawful.
• A business successor: a potential or actual buyer in a merger, acquisition or restructuring, with appropriate safeguards, the applicable restrictions and the notice or consent required by law.

We license the Databases for a fee. Where a Database contains protected personal data, its supply to customers is a disclosure of data to third parties subject to the GDPR. We do not present it as something else because it is structured as a license or because the original source was public.

Our license prohibits unauthorized redistribution and requires customers to use the data lawfully. It does not give them consent to contact a person and does not remove our responsibilities for our own disclosure.

6. Processing and international transfers

Our service is international. Data may be processed by us or by our providers in Germany, where our servers are hosted, and Georgia, where we are established. Delivering a Database to a customer in another country may also constitute an international transfer of personal data where the applicable law treats it as such.

Where a transfer outside the European Economic Area requires safeguards, we put an appropriate legal mechanism in place before making it: depending on the destination, an adequacy decision of the European Commission, the standard contractual clauses approved by the Commission or another safeguard or derogation provided for in Articles 45 to 49 GDPR. A recipient's contract with us does not by itself meet all the requirements for international transfers.

You can ask us for information about the applicable safeguards and how to obtain a copy or an explanation, with the necessary redactions. The governing law clause of our Terms does not override mandatory privacy protections or restrictions on transfers.

7. Cookies, analytics and commercial communications

Cookies and similar technologies may be used for authentication, account security, remembering necessary settings, managing checkout and recording your privacy choices. Optional analytics or advertising technologies are used only when enabled and in accordance with Article 22.2 of the LSSI-CE.

Where consent is required, optional tracking is not enabled before it is obtained, and you can refuse or withdraw it without losing access to the normal purchasing functions. We list the names or categories, providers, purposes and duration of the active technologies in the Cookie Policy and in the “Cookie settings” panel, available from the link in the footer of every page.

You can also manage cookies in your browser, although blocking necessary cookies may affect account access or purchasing. Browser settings do not replace a consent mechanism where one is mandatory.

When we send commercial communications, you can unsubscribe using the method indicated in the message itself or by contacting us (Article 22.1 of the LSSI-CE). Essential notices about orders, security and legal matters may still be sent. Unsubscribing from our commercial e-mails and asking for your contact to be removed from a Database are different requests; you can make either or both.

If your browser sends the Global Privacy Control signal, we respect it by keeping optional analytics and advertising cookies disabled. If a browser signal does not make it possible to identify a specific Database record, you can give us the minimum professional contact details needed to locate it through the procedure in Section 10.

8. Retention and deletion

We keep personal data only for as long as reasonably necessary for its purpose and to comply with the applicable legal obligations. The criteria depend on the type of record:

• Account data: while the account is active and, after it is closed, only to the extent necessary for pending orders, legal obligations or the establishment or defence of claims (with the data blocked in accordance with Article 32 of the LOPDGDD).
• Billing and transaction records: for the applicable tax and accounting retention period, and longer only where justified by a legal retention obligation or a pending claim.
• Evidence of delivery and acceptance: for the periods applicable to payment disputes and legal claims, limited to the information reasonably necessary to verify an order and protect rights.
• Ordinary technical and security logs: for 14 days, unless specific entries must be kept because of an active security incident, a legal obligation or a dispute.
• Database records: for as long as they remain relevant and lawful for the business information purpose described, taking into account how current and reliable they are, their collection date, changes in the sources and requests for rectification, restriction or erasure. Historical snapshots are kept only for a continuing lawful purpose and are identified as historical where appropriate.
• Exclusion and preference records: the minimum data necessary to keep respecting an unsubscribe, an objection or an erasure request and to avoid accidental re-inclusion.

Deleting an account does not automatically require deleting an invoice, a necessary exclusion record or other information we must or may lawfully keep. We explain the applicable exceptions when responding to a request.

9. Your rights

Under Articles 15 to 22 GDPR and the LOPDGDD, and depending on the legal basis of the processing, you have the right to:

• access: obtain information about the processing and a copy of the personal data concerning you;
• rectification: correct inaccurate or incomplete data;
• erasure (the “right to be forgotten”) and restriction of processing;
• object to processing based on legitimate interest;
• portability: receive or transmit, in a structured format, the data for which this is possible;
• withdraw your consent at any time, without affecting the lawfulness of prior processing;
• not be subject to decisions based solely on automated processing with legal or similarly significant effects;
• act through an authorized representative; and
• lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or another competent supervisory authority, without needing our prior permission.

The rights are subject to the conditions and exceptions of the applicable law. Exercising them is free of charge; we do not impose a general waiver through our Terms and do not charge you because you are not our customer.

10. How to exercise your rights or request exclusion

Write to [email protected] with a subject such as “Privacy request”, “Correction of a record”, “Remove my contact” or “Objection to processing”. Include a short description of the request and the minimum details needed to locate the account or the Database record, such as the e-mail address, the name of the business or the link to the public source. You do not need an account or to have bought anything.

We may take proportionate steps to confirm identity or representation where necessary and permitted by law, but we do not routinely require an identity document or unrelated sensitive information. We may ask limited questions to find the right record.

We respond within one month of receiving the request (Article 12(3) GDPR), extendable by two further months where necessary given the complexity or number of requests, in which case we will inform you within the first month, with the reasons. If we refuse a request in whole or in part, we explain the reasons and your right to complain to the AEPD.

If a request to erase or restrict a record is upheld, we delete or restrict the corresponding information in the copies and future supplies under our control and keep only the minimum lawful exclusion or audit data. Where the law requires it (Article 19 GDPR), we notify recipients of the erasure or rectification. We cannot physically retrieve a file already downloaded by an independent customer, but that technical limitation does not exempt us from any notification, cooperation or other obligation that falls on us. Independent recipients remain responsible for their own use and for handling the requests that concern them.

11. Additional information (GDPR and LOPDGDD)

The controller, purposes, legal bases, categories of sources, recipients, retention criteria, transfer safeguards and rights are described in the sections above. As a controller established outside the European Union that offers services to people in the Union, we appoint a representative under Article 27 GDPR where required; their details appear in the contact box at the top.

Where we do not obtain the data directly from the data subject (Article 14 GDPR), the information in this notice is made available on this website. Under Article 14(5)(b) GDPR, we do not send an individual notice to each business included where this proves impossible or would involve a disproportionate effort; instead, we publish this Policy and handle any request without the need for a purchase.

Article 19 of the LOPDGDD presumes lawful, on the basis of legitimate interest, the processing of the contact details of people who provide services within a legal entity and of the details of sole traders and self-employed professionals when they relate to them solely in that capacity and are not processed in order to establish a relationship with them as individuals. We apply that framework to the professional contact details in the Databases.

Legal exemptions or presumptions for a particular record or relationship are assessed on the actual facts and are not presumed from the “business data” label.

12. Security and automated processing

We apply technical and organizational measures appropriate to the information and the risks (Article 32 GDPR) and limit access to the people and providers who need it for authorized purposes. No online system, e-mail delivery or downloaded file can be guaranteed to be completely secure. Customers are responsible for protecting the files they download, and we remain responsible for the security obligations of our own processing.

Automated tools may help collect, organize, deduplicate or classify business information and detect security or payment anomalies. Such processing may produce errors. If an automatic security restriction affects your account or your order, contact customer support to request a review.

Our Database service is not intended for making decisions about a person's eligibility for employment, credit, insurance or another equally significant outcome. If we introduce processing involving legally regulated automated decisions, we will provide the additional information and safeguards required before using it; this Policy alone does not authorize that activity.

13. Minors

The service is intended for professional users and people capable of entering into a valid purchase contract, and is not directed at minors. Under Article 7 of the LOPDGDD, we do not process the data of children under 14 on the basis of their consent. We do not intentionally include the personal data of minors in the contact Databases we license. If you believe a minor has provided us with data or appears in a Database, contact us so that we can investigate and take the measures required by law.

14. Third-party websites and use by customers

Our website and our Databases may refer to third-party websites. Their privacy practices are governed by their own notices. A public source website does not automatically endorse our service or a customer's use of its information.

Database customers must have the legal bases, notices, permissions for commercial communications and international transfer safeguards needed for their own processing, including the information to data subjects under Article 14 GDPR. Before an advertising campaign they must consult the advertising exclusion systems (such as the Lista Robinson, Article 23 of the LOPDGDD) and comply with the LSSI-CE for electronic communications and the General Telecommunications Law (Ley General de Telecomunicaciones) for commercial calls. A license to use data is not equivalent to a person's consent to receive communications. These customer responsibilities do not limit our obligations in collecting, preparing or supplying a Database.

15. Changes to this Policy

We update this Policy when our processing or our legal obligations change and show the revision date above. Before a material change takes effect, we give additional notice or obtain new consent where mandatory. Continued use of the website is not considered consent to a new activity that legally requires separate consent.

16. Contact

For any question or to exercise your rights, write to us at [email protected]. If your message concerns an order, you may include its number. If it concerns a Database record, you do not need an order number, an account or proof of purchase.