Skip to content

Privacy Policy

Privacy Policy

1. Who is the controller of your personal data?

The data controller in respect of personal data processed through the website www.moventia.es is:


MARFINA, S.L. (MARFINA)
Tax ID (NIF): B-59372755
Address: Passeig del Comerç, 100, Sabadell (Barcelona)
Data protection contact email address: rgpd@moventia.net


Data Protection Officer


MARFINA has appointed a Data Protection Officer, whom you may contact in connection with any matter relating to the processing of your personal data or the exercise of your rights: AURIS CONSULTORIA LEGAL I TRIBUTÀRIA, S.L.P.
Email: xavi@auris.legal

2. What personal data do we process?

Through this website, data relating to browsing and use of the website may be processed, such as: IP address, information relating to the device, browser or operating system used, technical data relating to connection and browsing, and technical information derived from the use of cookies that are strictly necessary for the operation of the website and to manage the user’s cookie preferences.


In addition, where the user voluntarily contacts MARFINA through any of the contact channels provided on the website, the user’s identification and contact details may be processed, together with any other information provided in the communication.


In relation to the Ethics Channel, the personal data provided by the reporting person where they choose to identify themselves may be processed, together with data relating to persons affected by the report, third parties referred to in it and any other data that may be obtained in the course of any analysis and investigation carried out.


Reports may be submitted through the Ethics Channel anonymously.


Given the nature of the reports that may be received through the Ethics Channel, they may contain special categories of personal data. Only data that are relevant and necessary for the management and investigation of the report will be processed. Personal data whose relevance to the handling of a specific report is not manifest will be deleted without undue delay.

 

MARFINA will process only personal data that are adequate, relevant and necessary for the purposes set out in this Privacy Policy.

3. For what purposes and on what legal bases do we process your data?

3.1. Website browsing, operation and security


MARFINA may process the technical data necessary to enable browsing and the proper operation of the website, as well as to maintain the security of the website and its systems, prevent fraudulent or unlawful use and diagnose technical errors or incidents.


The legal basis for this processing is MARFINA’s legitimate interest in ensuring the operation, integrity and security of its systems and the website, pursuant to Article 6(1)(f) of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).


3.2. Cookies and similar technologies


The website currently uses only technical or strictly necessary cookies for its proper operation and, in particular, to manage and remember the user’s preferences regarding the use of cookies.


These cookies do not require the user’s consent where they are necessary to provide the service requested or enable the operation of the website, in accordance with Article 22.2 of Law 34/2002 on Information Society Services and Electronic Commerce.


If cookies or similar technologies that are not strictly necessary are introduced in the future, their use will be subject to the user’s prior consent where such consent is legally required.


Up-to-date information on the cookies used, their purposes, providers and duration is available in the Cookie Policy.


3.3. Management of enquiries and communications


Where a person contacts MARFINA through any of the available contact channels, their personal data will be processed in order to manage, handle and respond to the enquiry, request or communication received.


The legal basis for the processing will depend on the nature of the communication:

  • where the enquiry relates to the performance of a contract or to steps taken at the data subject’s request prior to entering into a contract, the processing will be based on Article 6(1)(b) of the GDPR;
  • in all other cases, the processing will be based on MARFINA’s legitimate interest in managing and responding to communications addressed to it, pursuant to Article 6(1)(f) of the GDPR.

 

3.4. Management of the Ethics Channel


MARFINA operates an Ethics Channel through which potential breaches of applicable law or failures to comply with MOVENTIA’s internal rules and Compliance System may be reported, including anonymously, in accordance with applicable law and the Ethics Channel Usage Policy.


Personal data processed through the Ethics Channel will be used to receive, record, analyse and manage reports received, determine whether an investigation should be opened, investigate the facts reported and, where appropriate, adopt any corrective, disciplinary, contractual or legal measures that may be warranted.


Where processing is carried out within the Internal Information System provided for in Law 2/2023 of 20 February on the protection of persons reporting regulatory breaches and the fight against corruption, the legal basis will be compliance with a legal obligation, pursuant to Article 6(1)(c) of the GDPR and Article 30 of that Law.


Where it is necessary to process special categories of personal data in connection with a report, such processing may be carried out for reasons of substantial public interest, pursuant to Article 9(2)(g) of the GDPR and Article 30.5 of Law 2/2023.


The Ethics Channel allows reports to be submitted anonymously. Where the reporting person chooses to identify themselves, their identity will be kept confidential and will not be disclosed to the persons to whom the reported facts relate.


Further information on the operation of the Ethics Channel and the associated processing of personal data is available in the Ethics Channel Usage Policy.


In relation to the Ethics Channel, access to the data will be restricted to the persons and functions authorised in accordance with Law 2/2023 and the internal procedure governing the Channel, as well as, where necessary, to service providers involved in its management in their capacity as processors.

4. How long will we retain your data?

Personal data will be retained only for as long as necessary to fulfil the purposes for which they were collected.


In particular:

  • data relating to enquiries or communications will be retained for as long as necessary to manage and respond to them and, thereafter, for the periods required by applicable law in order to address any potential liabilities arising from the processing;
  • technical data relating to website browsing and security will be retained for the period necessary to ensure the proper operation and security of the systems and to manage any incidents;
  • data associated with strictly necessary cookies will be retained for the period specified for each cookie in the Cookie Policy and in the relevant cookie manager.
  • data processed through the Ethics Channel will be retained within the Internal Information System only for the period strictly necessary to determine whether an investigation should be opened and, in all cases, in accordance with the time limits laid down in Law 2/2023. If three months have elapsed since receipt of the report without any investigative action having been initiated, the data must be deleted from the Ethics Channel, unless they are retained for the purpose of evidencing the operation of the system. Where an investigation is initiated, the necessary data may continue to be processed outside the Channel for as long as necessary to conduct the investigation and address any liabilities that may arise from the facts. Data entered in the information register will not, in any event, be retained for more than ten years. Reports that have not been acted upon may only be retained in anonymised form, in which case the blocking requirement laid down in Article 32 of Organic Law 3/2018 will not apply.

 

Once the applicable retention periods have expired, the data may remain duly blocked for the periods required by applicable law in order to address potential legal liabilities and will be deleted once those periods have elapsed.

5. To whom may your data be disclosed?

As a general rule, personal data will not be disclosed to third parties except where necessary to comply with a legal obligation or to respond to requests from public authorities, administrative bodies, law enforcement authorities, courts or tribunals, in accordance with applicable law.


In the case of reports submitted through the Ethics Channel, the reporting person’s identity may only be disclosed to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or administrative sanctioning investigation and subject to the safeguards provided for by law.

6. International data transfers

Some of the service providers used by MARFINA may provide their services from countries outside the European Economic Area or may involve access to personal data from those territories.

Where the use of any such service provider involves an international transfer of personal data, the transfer will be carried out in accordance with the mechanisms and safeguards provided for in Articles 44 et seq. of the GDPR.

Where applicable, such transfers may be based, among other mechanisms provided for by law, on an adequacy decision adopted by the European Commission, standard contractual clauses approved by the European Commission or any other mechanism recognised under applicable data protection law.

The data subject may request further information about any international transfers that may be carried out by contacting rgpd@moventia.net.

7. Links to other websites and digital environments

The website may contain links to other websites, platforms or digital environments that have their own terms of use and privacy policies.

In particular, certain services relating to recruitment processes, employees, intranets, the Ethics Channel or other specific services may be managed through separate platforms or environments.

MOVENTIA’s Ethics Channel is managed through a platform specifically designed for the receipt and handling of reports. The processing of personal data carried out through that Channel will also be governed by the specific data protection information and the Ethics Channel Usage Policy available in that environment.

Likewise, processing carried out through the other separate platforms or environments will be governed by the data protection information specifically provided in each of them.

MARFINA recommends that users review the relevant data protection information before providing personal data through these websites, platforms or environments.

8. What are your rights?

The data subject may exercise at any time the rights recognised under data protection law and, in particular:

  • Right of access: to ascertain whether MARFINA is processing their personal data and, where applicable, to obtain information about such processing and a copy of the data.
  • Right to rectification: to request the correction of inaccurate or incomplete data.
  • Right to erasure: to request the deletion of their data where the circumstances provided for by law apply.
  • Right to object: to object to the processing of their data where the processing is based on legitimate interests.
  • Right to restriction of processing: to request that the processing of their data be restricted in the circumstances provided for by law.
  • Right to data portability: to receive the personal data they have provided in a structured, commonly used and machine-readable format and to transmit those data to another controller where the requirements laid down by law are met.
  • Right to withdraw consent: where processing is based on consent, consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise these rights, the data subject may contact: rgpd@moventia.net

The request must contain the information necessary to identify the applicant and specify the right they wish to exercise.

The data subject may also contact MARFINA’s Data Protection Officer in connection with any matter relating to the processing of their personal data: AURIS CONSULTORIA LEGAL I TRIBUTÀRIA, S.L.P.
xavi@auris.legal

If you consider that the processing of your personal data does not comply with applicable law, you also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

In relation to processing carried out through the Ethics Channel, the exercise of rights will be subject to the specific provisions and limitations laid down in Law 2/2023. In particular, the person to whom the reported facts relate will not have the right to know the identity of the reporting person. Likewise, where the affected person exercises the right to object, it will be presumed, unless proven otherwise, that there are compelling legitimate grounds justifying the continuation of the processing.

9. Security of personal data

MARFINA will implement appropriate technical and organisational measures to protect personal data, taking into account the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of natural persons, in accordance with applicable data protection law.

10. Amendments to the privacy policy

MARFINA may update this Privacy Policy where necessary as a result of legislative, technical or organisational changes, or changes to the processing of personal data carried out through the website.


The version of the Privacy Policy in force from time to time will be the version published at www.moventia.es.


Last updated: September 2026.