Privacy Policy

  1. Introduction

This Privacy Policy informs users of the website https://greinfort.com (hereinafter, the “Website”) about the processing of their personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the General Data Protection Regulation (GDPR), Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD), and other applicable legislation.

The Website is owned by GREINFORT, S.L., a company belonging to Inprosec Group.

Responsibility for processing personal data collected through the Website lies with REMOTE CONSULTING SERVICES, S.L., the parent company of Inprosec Group, in accordance with the management model and internal agreements established between the companies within the group.

  1. Identity of the Data Controller

Data Controller: REMOTE CONSULTING SERVICES, S.L. Tax Identification Number (NIF): B27746502 Registered office: C/ María Berdiales, No. 20, 4th Floor, 36203 Vigo (Pontevedra), Spain. Corporate website: https://inprosec.com

Data Protection Officer (DPO) Email: dataprotection@inprosec.com

Data subjects may use this email address to make enquiries regarding the processing of their personal data and to exercise the rights recognised under data protection legislation.

  1. Relationship Between GREINFORT, S.L. and Inprosec Group

GREINFORT, S.L., with Tax Identification Number B27851443 and registered office at C/ María Berdiales, No. 20, 4th Floor, 36203 Vigo (Pontevedra), Spain, is the company that owns the Website and forms part of Inprosec Group.

Inprosec Group is headed by REMOTE CONSULTING SERVICES, S.L., which performs corporate management and coordination functions for the group and, in accordance with its internal organisation, assumes the role of data controller for personal data collected through this Website.

GREINFORT, S.L. may participate in responding to enquiries, managing commercial requests, maintaining customer relationships and providing its services within the organisational and legal framework established by the group.

The involvement of GREINFORT, S.L. and other Inprosec Group companies in data processing activities shall be governed by the functions they actually perform and the applicable agreements.

This Privacy Policy applies to personal data processing carried out through this Website and to the communications and relationships arising from such processing. It does not, in itself, imply that REMOTE CONSULTING SERVICES, S.L. is responsible for any other processing activities independently carried out by the companies within the group.

  1. Personal Data That May Be Processed

Depending on the data subject’s relationship with the Website and the services used, the following categories of data may be processed:

  • Identification and contact data: First name, surname, company, professional position, email address, telephone number and other information voluntarily provided.
  • Enquiry and request data: Information included in forms, messages, quotation requests or communications submitted through the available channels.
  • Professional and commercial data: Company or organisation, business sector, commercial interests, services requested and communication history.
  • Browsing and technical data: IP address, online identifiers, device information, browser information, pages visited and other data obtained through cookies or similar technologies, in accordance with the user’s settings and preferences.
  • Recruitment data: Professional and CV information where the Website provides specific channels for submitting job applications.

Users are requested to provide only data that is adequate, relevant and necessary for the corresponding purpose and to avoid including special categories of personal data when they are not necessary.

  1. Purposes of Processing and Legal Bases

Personal data may be processed for the following purposes:

5.1. Responding to Enquiries and Requests

Purpose: To respond to enquiries, requests for information, contact requests and communications received through the Website.

Legal basis: Taking steps prior to entering into a contract at the request of the data subject, where the request relates to potential contractual arrangements, or legitimate interest in responding to communications related to business activities, depending on the circumstances of each case.

5.2. Managing Commercial Requests and Quotations

Purpose: To prepare proposals, provide information about services, manage business opportunities and take the necessary steps to respond to requests from data subjects.

Legal basis: Taking steps prior to entering into a contract at the request of the data subject and, where applicable, performance of a contractual relationship.

5.3. Managing Contractual Relationships

Purpose: To manage commercial and contractual relationships arising from the services offered, including communications with representatives and contact persons of customers and suppliers.

Legal basis: Performance of a contract where the data subject is a party to it, compliance with legal obligations and legitimate interest in maintaining professional relationships with contact persons of organisations, as applicable.

The identification of REMOTE CONSULTING SERVICES, S.L. as the controller of data collected through the Website does not, in itself, change the identity of the company entering into service agreements.

5.4. Sending Marketing Communications

Purpose: Where a valid legal basis exists, to send information about services, activities, news, professional content, events and marketing communications related to the activities of GREINFORT, S.L. and, where users have been informed and there is sufficient legal authorisation, other companies within Inprosec Group.

Legal basis: Consent of the data subject where required or, in cases provided for by law, the exception applicable to certain marketing communications addressed to existing customers concerning similar products or services, in accordance with Article 21 of the LSSI-CE.

Where consent is requested to receive marketing communications, it must be freely given, specific, informed and unambiguous, and may be withdrawn at any time.

Sending marketing communications from other companies or concerning services other than those initially requested shall require an appropriate assessment of the legal basis and, where applicable, specific consent.

5.5. Managing Job Applications

Purpose: To manage job applications and recruitment processes where the data subject submits their CV or professional information through a channel provided on the Website.

Legal basis: Taking steps prior to entering into a contract at the candidate’s request and, where applicable, compliance with legal obligations.

Where an application is addressed to a specific company within the group, the data subject shall be informed of the conditions applicable to that recruitment process, including any potential additional recipients and data controllers.

5.6. Website Security and Operation

Purpose: To ensure security, prevent misuse, manage technical incidents and maintain the proper functioning of the Website.

Legal basis: Legitimate interest in protecting the security of systems and services, and compliance with legal obligations where applicable.

5.7. Cookies and Similar Technologies

Purpose: To enable the technical operation of the Website and, where authorised by the user, carry out audience measurement, personalisation or advertising activities.

Legal basis: Legitimate interest or technical necessity in strictly necessary cases where legally permitted, and user consent for purposes that are not exempt, in accordance with applicable legislation.

Additional information is available in the Cookie Policy.

  1. Mandatory Nature of Data

Where applicable, the Website’s forms shall identify the fields required to process a request.

Failure to complete mandatory fields may prevent the enquiry from being addressed or the requested service from being provided.

Users guarantee that the information provided is accurate and undertake to communicate any relevant changes.

  1. Recipients and Disclosure of Data

Personal data may be accessible, to the extent necessary for the purposes described, to the following categories of recipients:

  1. a) GREINFORT, S.L.

As the owner of the Website and a member of Inprosec Group, GREINFORT, S.L. may participate in managing enquiries, requests, business opportunities and services related to its activities.

Its involvement shall be organised according to the functions actually performed and the applicable internal data protection agreements.

  1. b) Other Inprosec Group Companies

Where necessary to respond to a request, provide a service or manage a commercial relationship, data may be disclosed to other companies within the group, provided that an appropriate legal basis exists and the data subject is informed where required.

Membership of the same corporate group does not, in itself, constitute general authorisation to share personal data for any purpose.

  1. c) Service Providers

Service providers offering web hosting, email, IT maintenance, form management, customer relationship management tools, analytics, communication platforms or other services necessary for business activities may have access to the data.

Where they act on behalf of the data controller, their involvement shall be governed by the corresponding data processing agreements, in accordance with Article 28 of the GDPR.

  1. d) Public Authorities and Competent Bodies

Data may be disclosed where there is a legal obligation or a valid request from a competent authority.

Data shall not be disclosed for purposes incompatible with those communicated to data subjects without an appropriate legal basis.

  1. International Data Transfers

Certain technology providers may provide their services from countries outside the European Economic Area or allow access to personal data from those countries.

Where international transfers take place, REMOTE CONSULTING SERVICES, S.L. shall ensure that they comply with Chapter V of the GDPR, either through an adequacy decision by the European Commission or, failing that, through legally recognised appropriate safeguards, such as Standard Contractual Clauses, accompanied by any additional measures that may be necessary.

Data subjects may request further information about the applicable safeguards by contacting dataprotection@inprosec.com.

  1. Data Retention Periods

Personal data shall be retained for as long as necessary to fulfil the purpose for which it was collected and subsequently for the periods required by applicable legal obligations or for as long as liabilities may arise from the relationship maintained.

As a general rule:

  • Enquiries and requests: For the time necessary to respond to them and carry out reasonable follow-up, and subsequently for the periods necessary to address potential liabilities.
  • Commercial and contractual relationships: For the duration of the relationship and the applicable statutory retention periods.
  • Marketing communications: Until the data subject withdraws consent, objects to processing or there is no longer a legal basis permitting such communications.
  • Job applications: During the recruitment process and subsequently only where a legal basis justifies further retention.
  • Browsing data and cookies: In accordance with the periods indicated in the Cookie Policy and the actual settings of the tools used.

Where appropriate, data may be retained in a duly restricted form for the legally required periods.

  1. Rights of Data Subjects

Data subjects may exercise the following rights under the conditions established by applicable legislation:

  • Right of access: To find out whether their personal data is being processed and obtain information about such processing.
  • Right to rectification: To request the correction of inaccurate or incomplete data.
  • Right to erasure: To request the deletion of their data where any of the legally established circumstances apply.
  • Right to object: To object to certain processing activities, particularly those carried out for direct marketing purposes.
  • Right to restriction of processing: To request restrictions on the use of their data in the circumstances provided for by law.
  • Right to data portability: To receive their data in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller.
  • Right to withdraw consent: To withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
  • Right not to be subject to decisions based solely on automated processing: Where the circumstances provided for in Article 22 of the GDPR apply.

To exercise these rights, data subjects may contact the Data Protection Officer by email at:

dataprotection@inprosec.com

The request must allow the data subject to be identified and specify the right they wish to exercise. Where reasonable doubts exist regarding their identity, additional information that is proportionate and necessary to verify it may be requested.

Requests shall be handled within the time limits established by applicable legislation.

Furthermore, if data subjects consider that their rights have not been properly addressed, they may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) through https://www.aepd.es.

  1. Data Protection Officer

Inprosec Group provides a contact channel for its Data Protection Officer (DPO), whom data subjects may contact regarding any matter related to the processing of their personal data or the exercise of their rights.

DPO email: dataprotection@inprosec.com

  1. Information Security

REMOTE CONSULTING SERVICES, S.L. shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks associated with processing activities, taking into account the nature of the data, the purposes of processing, the state of the art and the risks to individuals’ rights and freedoms.

These measures may include access controls, permission management, confidentiality measures, incident response procedures and other safeguards appropriate to each processing activity.

  1. Minors’ Data

The Website is primarily intended for individuals interested in the professional services of GREINFORT, S.L. and is not specifically designed for minors.

Where processing is based on the consent of a minor, the age and legal representation requirements established by applicable legislation shall apply.

  1. Links to Third-Party Websites

The Website may contain links to external websites or services that have their own privacy policies.

Users are advised to review these policies before providing personal data to third parties.

  1. Updates to the Privacy Policy

REMOTE CONSULTING SERVICES, S.L. may update this Privacy Policy to adapt it to legislative changes, guidance issued by supervisory authorities, organisational changes or new processing activities carried out through the Website.

The current version shall be available on this page, together with the date of its latest update.

Last updated: October 2026.