Privacy Policy

Altostratus Solutions, S.L.U. (“Altostratus”), as the owner of this website, altostratus.es, informs you that the Telefónica Group companies are committed to respecting users’ privacy and the confidentiality and security of personal data, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data (General Data Protection Regulation), as well as Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights, and other applicable regulations..

Our principles are:

TRANSPARENCY

We will not process your data in an unexpected, unclear, or abusive way.

When we collect your personal data through our website, you will be properly informed about who processes your data, the purpose of the processing, the legal basis for doing so, your ability to exercise your rights, and other relevant information. In addition, your data will be deleted according to the defined retention policy, about which you will be informed, and in any case when you request it by exercising your right to erasure.

CONTROL

We will obtain your consent whenever required and provide you with the necessary tools to access and update your personal information, as well as decide how your data is managed by selecting the purposes for which we will process it.

SECURITY

We are committed to ensuring the security, confidentiality, and protection of your data. As part of this commitment, and in compliance with current legislation, we have adopted the most rigorous and robust security measures and technical safeguards to prevent loss, misuse, or unauthorized access to your data. We pledge to maintain confidentiality and guarantee the duty to protect your information by taking all necessary and reasonable measures to prevent its alteration, loss, or unauthorized processing or access, in accordance with applicable law.

For all these reasons, privacy is a priority at Altostratus, and we protect your information in accordance with the privacy policy you can read below. If you have any questions about it, please contact us at rgpd@altostratus.es —we will be happy to help you.

1. Who is responsible for processing the data?

Altostratus Solutions, S.L.U., a company with Tax ID (CIF) B-65383085 and registered office in Barcelona (Spain), 08006, Vía Augusta 48, 5th floor, will be the data controller responsible for processing your data in accordance with the information provided in this Privacy Policy.

Notwithstanding the above, in certain cases involving the provision of specific online platforms, Altostratus may act as a Processor or Sub-processor for the purposes of the applicable data protection regulations, particularly when it processes personal data on behalf of other Telefónica Group operators to which it belongs and/or on behalf of its B2B clients.

We also have a Data Protection Officer who ensures compliance with data protection regulations at Telefónica. You can contact them with any questions, doubts and/or complaints you may have regarding how we process your data by writing to DPO_telefonicasa@telefonica.com.

2. ¿What data is processed, for what purpose, and why do we process it?

Depending on the section of the Website, the data collection channel, or the way in which you interact with Telefónica, your data may be processed for the following purposes:

2.1 Handling queries submitted through forms or other contact channels

For what purpose? – Processing purposes The purpose of the processing is to handle and respond to queries submitted by users of the Website and/or, in general, by individuals who contact Telefónica through any of the channels made available for that purpose.

Why? – Applicable legal basis The legal basis we rely on to carry out this purpose is the consent you provide when you voluntarily contact us.

What data? – Types of data The data we process for this purpose include your identification, contact, and/or professional details (e.g., name and surname, email address, phone number, and/or the company you work for), your voice when using the telephone channel —as incoming calls may be recorded— as well as any information contained in the query you submit, insofar as its processing is necessary to provide you with a response.

Where did the data come from? – Source The data we process for this purpose are obtained from you when you fill in the contact forms available on the Website, call our Customer Service line, and/or send us an email using the contact addresses we provide to users, including those mentioned in this Privacy Policy.

Who do they belong to? – Categories of data subjects The data we process for this purpose relate to users of the Website or, in general, individuals who submit queries, as well as any other data subjects whose information may have been provided by the person submitting the query.

For how long are they processed? – Retention periods The data we process for this purpose will be subject to the general retention criteria outlined in Section 3 of this Policy and, in any case, will not be kept longer than necessary to address the queries and, where applicable, to meet any potential liabilities Telefónica may incur in relation to them.

2.2 Sending periodic informational bulletins or newsletters

For what purpose? – Processing purposes The purpose of the processing is to send periodic informational bulletins by email, upon the data subject’s request, regarding activities carried out by the Telefónica Group and content generated by its various areas. Depending on the newsletter you have requested to subscribe to, your data may be shared with the Telefónica Group companies responsible for that newsletter for the purposes of managing your subscription request and/or handling the associated communications.

¿Por qué? – Base legal aplicable The legal basis we rely on to carry out this purpose is the consent you provide when subscribing to the informational bulletins.

What data? – Types of data The data we process for this purpose are your identification, professional, and contact details necessary to send you the newsletter.

Where did the data come from? – Source The data we process for this purpose come mainly from the newsletter subscription forms available on the Website, as well as from any other contact channels enabled by Altostratus for this purpose.

Who do they belong to? – Categories of data subjects The data we process for this purpose relate to users of the Website and, in general, individuals who subscribe to the newsletters.

For how long are they processed? – Retention periods The data we process for this purpose will be subject to the general retention criteria outlined in Section 3 of this Policy.

2.3 Maintenance and management of the Altostratus-owned Website, its security, and user access to it

For what purpose? – Processing purposes The purpose of the processing we carry out is to keep the Altostratus-owned Website—visited by the user and subject to this Policy and any applicable Specific Terms—active and technically managed, to protect it against security incidents and potential malicious attacks, and, in general, to enable free and uninterrupted access to it for all internet users. The user may obtain further information about the scope of this purpose in the Cookie Policy applicable to the Altostratus website.

Why? – Applicable legal basis The legal basis we rely on to carry out this purpose is Altostratus’s legitimate interest, as the owner, in ensuring the availability and security of its Website for all internet users who visit it, in accordance with the relevant legal and usage notices.

What data? – Types of data The data we process for this purpose are those—generally pseudonymized—obtained directly from the devices used by the user to access and browse the Altostratus-owned Website. The processing of this data is strictly necessary to fulfil the purpose described.

Among this browsing data on the Website, the following may be included: the user’s IP address; the date and time of connection; aggregated data about the type of audience browsing the Website, such as geographic information, the device used for browsing, technology, etc.; browsing behaviour on the Website, such as the number of pages viewed, average time on page, bounce rate, whether content is shared through social networks, etc.; as well as aggregated data about the channels through which the audience arrives: organic search, direct search, social media, or referrals.

Where did the data come from? – Source The data we process for this purpose come from the devices the user uses to access and browse the Altostratus-owned Website.

Who do they belong to? – Categories of data subjects The data we process for this purpose relate to the users who access and browse the Altostratus-owned Website.

For how long are they processed? – Retention periods The data we process for this purpose will be subject to the general retention criteria outlined in Section 3 of this Policy.

2.4 Maintenance, management, access, and security of the Cloud platforms and/or services accessible through the Website for authorised users

For what purpose? – Processing purposes The purpose of the processing we carry out is to keep active and manage the services, platforms, and/or, in general, the private areas that may be accessible at any given time through the Altostratus-owned Website and which, in addition to this Policy, are subject to the terms expressly accepted or agreed upon within collaboration and/or service provision contracts—such as those related to Cloud services—signed with third parties (Altostratus client companies). This also applies to cookies generated within the private areas as a result of browsing by users authorised by those third parties.

Why? – Applicable legal basis The legal basis we rely on to carry out this purpose—processing the data of authorised users who access certain Altostratus online services and/or platforms as employees of an Altostratus client company—is the proper performance of the contractual relationship between Altostratus and that company, within which the authorised user carries out their activities.

What data? – Types of data The data we process for this purpose include all information necessary to create, manage, and maintain the authorised user’s account on the Altostratus service or platform accessible through the Website, as well as any other data obtained directly from the devices used by the user to access and browse it

Where did the data come from? – Source The data we process for this purpose are usually provided either by the users themselves and/or, where applicable, by the client companies in which those users carry out their professional activity, as well as by the devices the user uses to access and browse the Altostratus-owned Website. The processing of this data is strictly necessary to fulfil the stated purpose.

Who do they belong to? – Categories of data subjects The data we process for this purpose relate to the users authorised by Altostratus’s client or partner companies to access and browse the private areas of the Website.

For how long are they processed? – Retention periods The data we process for this purpose will be subject to the general retention criteria outlined in Section 3 of this Policy.

2.5 Management of the relationship with users through Altostratus’s social media channels

For what purpose? – Processing purposes The purpose of the processing we carry out is to interact and maintain contact with users who engage with Altostratus through the various social networks on which Altostratus has an official account. This includes publicly responding to messages or comments made by those users, mentions, handling and replying to private messages through those platforms, processing requests addressed to the relevant Altostratus area or the competent Telefónica Group company, etc. If strictly necessary, your data may be shared with the Telefónica Group companies responsible for processing and appropriately responding to your request.

Why? – Applicable legal basis The legal basis we rely on to carry out this purpose is the consent you give when interacting with Altostratus through the social network on which Altostratus has an official account.

What data? – Types of data Tje data we process for this purpose are your public profile data on that social network—identifying and contact information—as well as any other information you voluntarily share during interactions on the platform or that is necessary to address the request you have made.

Where did the data come from? – Source The data we process for this purpose come from the social network through which you contact us, as well as the information we obtain directly from you during that interaction.

Who do they belong to? – Categories of data subjects The data we process for this purpose relate to users who contact Altostratus through the social network, as well as any other individuals whose data are provided by the social network user when contacting Altostratus.

For how long are they processed? – Retention periods The data we process for this purpose will be subject to the general retention criteria outlined in Section 3 of this Policy.

2.6 Management of events organised by or in collaboration with Altostratus

For what purpose? – Processing purposes The purpose of the processing we carry out is to manage attendance and facilitate entry to the event venue for those interested users who voluntarily choose to register. In addition, we may send evaluation surveys for the events in which you decide to participate.

Why? – Applicable legal basis The legal basis we rely on to carry out this purpose is the consent you provide when requesting to attend or participate in the corresponding event.

What data? – Types of data The data we process for this purpose are your identifying, professional, and contact details necessary to manage your event registration.

Where did the data come from? – Source The data we process for this purpose come from the event registration forms created for that purpose, whether provided by Altostratus and/or, where applicable, by any co-organisers involved.

Who do they belong to? – Categories of data subjects The data we process for this purpose relate to the interested users who contact Altostratus expressing their interest in attending or participating in events.

For how long are they processed? – Retention periods The data we process for this purpose will be subject to the general retention criteria described in the following section of this Policy.

2.7 Sending commercial or advertising communications about Altostratus products and services

For what purpose? – Processing purposes The purpose of the processing we carry out is to send commercial information, including by electronic means, about Altostratus’s products and services.

Why? – Applicable legal basis The legal basis we rely on to carry out this purpose is the recipient’s express consent as a general rule, all in accordance with the applicable regulations.

What data? – Types of data The data we process for this purpose are your identifying, professional, and contact details necessary to send these communications.

Where did the data come from? – Source The data we process for this purpose come from the forms and/or other data collection methods made available by Altostratus for this purpose.

Who do they belong to? – Categories of data subjects The data we process for this purpose relate to users who contact Altostratus and express interest in receiving commercial information.

For how long are they processed? – Retention periods The data we process for this purpose will be subject to the general retention criteria described in the following section of this Policy.

3. How long is the data retained?

As a general rule, we will retain your data for the period necessary to fulfil the purpose described for each processing activity and to determine any potential liabilities that may arise from that purpose.

By way of example, Altostratus has established a series of retention periods that will apply depending on the purpose and the legal basis applicable to each processing activity, unless a different period has been specified in this Policy and/or in the specific terms or service conditions of each Altostratus product or service:

For processing activities related to the performance of contracts signed with B2B clients, the data will be retained for the time strictly necessary to fulfil the purposes required by each contracted product or service. For example, data obtained from the B2B client will be kept while the client remains active.
Recordings of telephone calls received by our Customer Service will be retained for a period of 7 calendar days from the time they are made, as a general rule, in accordance with the information provided in the corresponding notices.
In accordance with civil, commercial, and tax legislation, data related to the contracting and billing of the products and services purchased from Altostratus will generally be stored for a minimum period of 6 years from the date the B2B client is deactivated.
In compliance with Spanish Law 25/2007, traffic and location data associated with IoT mobile lines will be retained for 12 months, to be made available to authorised authorities when necessary upon presentation of the corresponding judicial request. In the case of IoT lines provided by Telefónica Group operators in other countries, the legal retention period indicated by those operators based on their applicable local legislation will apply.

En todo caso, tus datos serán conservados según los criterios de conservación o plazos concretos que te informemos en cada caso, descritos en cada actividad de tratamiento de tus datos y, en su caso, mientras no retires el consentimiento otorgado y/o te opongas a su tratamiento. En ese sentido, haremos nuestros mejores esfuerzos para facilitarte una mecanismo automático y sencillo para que puedas retirar el consentimiento otorgado y/o para que te opongas al tratamiento y, en todo caso, estamos a tu disposición en el correo de ejercicio de derechos informado en el apartado 5 de esta Política.

In any case, your data will be retained according to the retention criteria or specific periods communicated to you in each case, as described in each data processing activity and, where applicable, for as long as you do not withdraw the consent granted and/or object to the processing. To that end, we will make every effort to provide you with an easy and automatic mechanism to withdraw your consent and/or object to the processing. In any case, we remain available to you at the rights-exercise email address provided in section 5 of this Policy.

4. Who receives the data? Are international data transfers carried out?

To carry out the processing purposes described, we may use authorised subcontractors acting on behalf of Altostratus as data processors (e.g., internet service providers, data hosting and technical support providers, platform providers, email service providers, security service providers, etc.). These processors are contractually bound to follow our instructions, act only for the lawful purposes described, and process the data only for the period strictly necessary.

Specifically, this involves granting access to your data to:

Providers —as well as any subcontracted companies they may engage— who help fulfil the purposes described in section 3 of this Policy and/or enable us to communicate with you and stay in contact (e.g., Google as our provider of Google Cloud tools).
If we need to share your information with other third parties (e.g., event sponsors for events you have voluntarily registered for, or another Telefónica Group company for proper event management), we will inform you accordingly and obtain the necessary authorisations to do so. Such access will only be for lawful purposes and for the period strictly necessary.

In line with the above, we also inform you that, to the extent strictly necessary to fulfil the purposes described, your data may be shared with other companies or entities belonging to or affiliated with the Telefónica Group. These entities will process your data under their responsibility and always for the purposes described in this Policy.
The companies or entities belonging to or affiliated with the Telefónica Group with whom your data may be shared can be consulted in the “About Telefónica,” “About the Company,” or the equivalent section available on the website www.telefonica.com.

In addition, if there is a legal obligation or requirement to do so, we may disclose your data to the competent public authorities in accordance with that obligation or legal requirement.

When authorised subcontractors acting on behalf of Altostratus, or the mentioned recipients, are located outside the European Economic Area or process your data outside it, we will be carrying out an international data transfer in accordance with data protection regulations. As a general rule, we avoid making international transfers and ensure that your data is processed within the European Economic Area. However, if such transfers are necessary, we will adopt the organisational, technical and contractual measures required to guarantee the protection and security of your data, such as the signing of the European Commission’s Standard Contractual Clauses with the authorised subcontractor or third-party recipient, the completion of impact assessments on the specific international transfer to evaluate the risk and adopt mitigation measures, the encryption of data in transit or at rest, the pseudonymisation of the data subject to international transfer, and the possibility for the data subject to claim damages directly from the authorised subcontractor or third-party recipient.

5. What rights do you have as the data subject?

As a data subject, data protection regulations grant you certain rights over your personal data which, where applicable, you may exercise before Altostratus. Below, we explain what these rights are and how you can exercise them. Additionally, we inform you that on the website of the Spanish Data Protection Agency (www.aepd.es) you can find more detailed information about these rights and download templates to exercise each of them.

Right to withdraw consent: this is your right to withdraw the consent you have given for the processing of your data for purposes based on that legal basis, at any time and in an easy manner.
Right of access: this is your right to request details of the data we hold about you and how we process it, as well as to obtain a copy of that data.
Right to rectification: this is your right to have any inaccurate or incorrect data corrected, as well as to have incomplete data completed.
Right to erasure: this is your right to request the deletion or removal of your data and information in certain circumstances. However, please note that there are specific situations in which we are legally entitled to continue retaining and processing your data, such as when it is necessary to comply with a legal data retention obligation.
Right to restriction: this is your right to restrict or limit the processing of your data in certain circumstances. For example, if erasure would normally apply but, instead of having your data deleted, you prefer us to block it and process it solely for retention purposes because you may need it later to file a claim. Again, please note that there may be situations in which we are legally entitled to refuse your request for restriction.
Right to object: this is your right to oppose the processing of your data for a specific purpose, in certain circumstances established by law and related to your personal situation.
Right to data portability: this is your right to request to receive your personal data in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another data controller, provided that we process your data by automated means.
Right not to be subject to automated individual decision-making: this is your right to request, in certain circumstances, not to be subject to a decision based solely on the automated processing of your data, including profiling, that produces legal effects concerning you or similarly significantly affects you.

As a general rule, you may exercise these rights at any time and free of charge by contacting Altostratus at rgpd@altostratus.es. Likewise, in general, automated unsubscribe mechanisms for communications and other options for withdrawing consent and lodging objections will be made available to the user.

To do so, it is important to note that when you exercise a right, in most cases you must clearly specify which right you are exercising and provide a copy of a document proving your identity.

Any exercise of your rights will be responded to within a maximum period of one month. This period may be extended by two additional months if necessary, taking into account the complexity of the request and the number of requests received.

Finally, if you do not agree with the way Altostratus processes your data, you have the right to file a complaint with the national supervisory authority, the Spanish Data Protection Agency, whose contact details are as follows:

Spanish Data Protection Agency

C/ Jorge Juan, 6 – C.P. 28001, Madrid (España)

www.aepd.es

6. Further processing of data and changes to the Privacy Policy

Altostratus reserves the right to update this Privacy Policy at any time. Any such update will be published by Altostratus with the legally required advance notice before it enters into force. In addition, it will be communicated directly to the data subject if it affects their rights or freedoms, or when, for example, the inclusion of a new processing activity requires the data subject’s consent or modifies the scope of the legitimate interest that justifies the processing.