Latest update: March 2025

BASIC INFORMATION ON DATA PROTECTION

Responsible: TALISMAN-XAPO, S.L.
Purpose: We use your data to respond to various types of requests from the User.
Legitimation: The legitimacy for the processing of your data lies in the provision of your consent to TALISMAN-XAPO, S.L.
Recipients: Your data will be processed by other companies of the Group and third party partners who work with us, whether they are located inside or outside the European Union.
Rights: You have the right to access, rectify, delete, oppose, limit and request portability of your personal data.
Additional information: You can find additional and detailed information about how we handle your personal data and the rights you have by consulting the full text of the Privacy Policy below continuation, as well as the Cookies Policy.

ADDITIONAL INFORMATION ON DATA PROTECTION

TALISMAN-XAPO, S.L. (hereinafter, “the Company”) undertakes, as the Data Controller of your personal data, to adopt the necessary technical and organisational measures to ensure that the processing of your data is in accordance with the provisions of Regulation (EU) 2016/679 (hereinafter, “GDPR”) and Organic Law 3/2018.

The Company processes your personal data lawfully and fairly, ensuring that it receives adequate protection and that it is not subject to misuse. Likewise, the Company’s intention is to be transparent in the field of the management of the personal data of its customers and users, making available to the former all the necessary information about the collection and processing of their data.

The purpose of the Privacy Policy is to inform you about who will process your personal data, why we collect this data, how long we will keep the data collected, to whom we will transfer it and what your rights are in this area.

By providing us with your personal information and using our Website, we understand that you have read and understood the information on personal data protection set out in this Privacy Policy and the Cookies Policy.

1. WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?

The Data Controller of your personal data is:

Company name: TALISMAN-XAPO, S.L.
N.I.F: B62906920
Telephone: 93 209 09 19
Postal address: Vía Augusta 251, 1º2ª-. 0817, Barcelona
Email: info@talismangroup.es

2. FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

Depending on the services or functionalities requested by clients and users, the Company will need to process with some data or others, which in general will be the following:

• Identification and contact data: name, surname, email, among others;
• Data collected automatically: When you interact with our Website, certain browsing data is collected automatically. This information is collected through cookies, the regulation of which is detailed in the Company’s Cookie Policy ;
• The information we may collect automatically relates to your use of our Website and the devices you use to access and interact with it. Some of the data we collect are: the IP address of the device you are using, the browser you are using, your operating system, the date and time of access to the Website, the Internet address of the website through which you accessed our Website, geolocation data, information about the pages visited by the user within the Website and the time spent browsing on each page;

The personal data collected is processed for the following purposes:

• Quality analysis: conducting surveys on customer and user satisfaction in relation to the quality of the products and services offered by the Company;
• Customer and user service: channelling and attending to their requests, queries and complaints for their management and resolution;
• Improve the user experience on the Website: conduct analytical and statistical studies on how users navigate the Company’s Website.

3. WHAT IS THE LEGAL BASIS FOR THE PROCESSING OF YOUR DATA?

The legal basis that allows us to process your personal data depends on the purpose for which we process it, as detailed below:

• Quality analysis. The legitimacy of the processing of your data lies in the legitimate interest of the Company to analyze the degree of satisfaction of customers and users, in order to be able to offer them services of the best quality;
• Attention to users and customers. The legitimacy of the processing of your data lies in the legitimate interest of the Company to attend to your requests and claims in order to be able to adequately attend to you and resolve your requests. In the event of queries related to the exercise of its legally recognized rights in terms of data protection, the Company requires the processing of your data in order to comply with the legal obligations that bind it in this area;
• Improve the user experience on the Website. The legitimacy of the processing of your data lies in the legitimate interest of the Company to know the degree of satisfaction of users and to adopt the appropriate corrective measures to improve the quality of our services.

4. HOW LONG WILL WE KEEP YOUR DATA?

Your personal data will be duly kept for the time necessary to be used according to the purpose for which they were collected.

Personal data will be stored in accordance with appropriate security measures to ensure their accuracy and integrity, for as long as their processing is necessary for the purpose for which they were collected or as long as you do not exercise your right to erasure or restriction of processing.

In such cases, we will keep your personal information blocked, without any treatment, for the periods provided by law to meet any liabilities and to be able to prove compliance with our legal and contractual obligations. Subsequently, the Company will permanently delete your personal data.

5. WHO MAY WE SHARE YOUR DATA WITH?

Your personal data will be processed by members of the Company who act on behalf of the organization and in relation to whom the corresponding contracts have been concluded, which include specific obligations of confidentiality and diligent management of personal data in accordance with the legislation in this area.

In certain cases, in order to be able to comply with the purposes set out in this Privacy Policy, the Company needs to share your personal data with other companies in the Group and with the following third parties:

• financial institutions;
• technology and analytics service providers;
• providers of customer service-related services;
• public authorities and bodies to: respond to a judicial order, subpoena or investigation, or for any other reason required by law; deal with possible liabilities arising from the processing of personal data; prevent illegal uses of our Website or violations of our Website policies; dealing with third-party claims; contribute to the prevention and investigation of cases of fraud, among others.

These third-party partners only have access to the personal information necessary to carry out the corresponding services and are required not to use it for any purpose other than that requested. The Company also requires these third parties to the same degree of protection and confidentiality that we apply in the management of your personal information. In addition, all of them are subject to the obligations set forth in their respective data processing contracts concluded with the Company.

Certain third-party partners are located in countries or territories outside the European Union. In these cases, the Company transfers your data to you in accordance with the guarantees required by law for this type of situation:

• we verify whether the third party is located in a country or territory that has been declared to have an adequate level of protection by the European Commission;
• In the absence of the above, we verify whether any of the following guarantees are present:
  • entering into a contract containing standard data protection clauses approved by the European Commission;
  • implementation of binding corporate rules, approved by the competent supervisory authority;
  • the third party’s adherence to a Code of Conduct or certification mechanisms;
• In the absence of the above, in order to carry out the transfer of your data, we ask for your express consent or we request the express authorization of the competent supervisory authority.

6. WHAT ARE YOUR RIGHTS?

You are entitled to exercise the following rights in relation to the processing of your personal data:

• Access (art. 15 GDPR): allows you to obtain certain information about the purposes for which your data is being processed, the recipients to whom it is communicated or the categories of data being processed, among others.
• Rectification (art. 16 GDPR): allows you to contact the Data Controller to modify any personal data that may be inaccurate and to complete any that may be incomplete.
• Deletion (Art. 17 GDPR): allows you to request the deletion, without undue delay, of your personal data that is being processed by the Data Controller.
• Restriction of processing (Art. 18 GDPR): allows you to obtain from the Data Controller the restriction of the processing of your data.
• Portability (Art. 20 GDPR): allows you to receive your personal data or have it sent to a third party, in a structured, commonly used and machine-readable format.
• Objection (Art. 21 GDPR): allows you to object to the processing of your data by the Data Controller. However, you may only exercise this right in relation to processing based on the legitimate basis of a public interest or a legitimate interest of the Data Controller.
• Objection to automated processing (Art. 22 GDPR): allows you not to be subject to decisions based solely on the automated processing of your data, including profiling, which produce legal effects on you or similarly significantly affect you.

6.1. How can I exercise my rights?

In order to exercise your data protection rights, the Company provides you with the following means:

• By means of a written and signed request addressed to the Company (VÍa Augusta 251, 1º2ª-. 0817, Barcelona), indicating the reason for your request and the right you wish to exercise, attaching a photocopy of your ID card or equivalent document that proves the identity of the applicant;
• By sending a completed and signed form, attaching a photocopy of the ID card or equivalent document that proves the identity of the applicant, to the following email address: info@talismangroup.es.

Below are the forms to be able to exercise the different rights:

• Right of access: https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-acceso.pdf
• Right to rectification: https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-rectificacion.pdf
• Right to erasure: https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-supresion.pdf
• Right to restriction of processing: https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-limitacion.pdf
• Right to portability: https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-portabilidad.pdf
• Right to object: https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-oposicion.pdf
• Right to object to automated processing: https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-oposicion-decisiones-automatizadas.pdf

You also have the right to contact the corresponding competent supervisory authority in the field of data protection, for any complaint arising from the processing of your personal data: the Spanish Data Protection Agency (Complaint Submission Form).

7. CHANGES TO THE PRIVACY POLICY

This Privacy Policy is subject to continuous review by the Company, and may be modified whenever necessary in order to adapt it to current legislation or to any variation on our Website.

In the event that the update of the Policy involves a material change in the processing of your personal data, we will notify you of such change through our Website (by means of a banner, a pop-up or a push notification) so that you can review and evaluate it.

For this reason, we recommend that you periodically review the Privacy Policy to stay informed about any developments related to the processing of your personal data.