1. Data Controller Identification
This Privacy Policy governs the processing of personal data carried out through the official website of MASEG, in full compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation — GDPR) and Spanish Organic Law 3/2018 of December 5 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
Data Controller Profile
- Commercial Trade Name: MASEG.
- Corporate Entity: MASEG SOLUCIONES CORP.
- Contact Address: Av. del Saler, 9 Pta. B, 46460 Silla (Valencia), Spain.
- Designated GDPR Contact Channel: info@masegcorp.com (Ref: Protección de Datos)
- Direct Telephone: +34 651 12 73 72.
2. Principles Applied to Processing
In processing personal data, MASEG strictly applies the principles set out in Article 5 of the GDPR:
- Lawfulness, fairness, and transparency: Personal data is processed solely on legitimate legal grounds and with transparent information provided to the data subject.
- Purpose limitation: Data is collected only for specified, explicit, and legitimate engineering inquiry purposes, and not further processed in a manner incompatible therewith.
- Data minimization: Only data strictly necessary for technical and commercial inquiry handling is requested.
- Accuracy: Personal data is kept accurate and, where necessary, up to date.
- Storage limitation: Data is kept in an identifiable form for no longer than necessary for the purposes for which it is processed.
- Integrity and confidentiality: Appropriate security is maintained via HTTPS encryption in transit and restricted professional operational access.
3. Current vs. Planned Processing
In accordance with the transparency principle under GDPR, MASEG clearly distinguishes active data processing in the current platform stage from planned future platform integrations:
A. Currently Active Processing on the Website
1. Corporate Contact Form & Technical Lead Intake (S9): Personal data submitted voluntarily via the corporate contact form (name, email, company, direct phone, requested technical discipline, and project scope) are processed by the native intake backend and durably persisted in an isolated local SQLite database located outside public web access. Submissions are recorded with timestamp, accepted privacy version identifier, and cryptographic control hashes for anti-abuse and anti-spam protection.
2. Voluntary Direct Inquiries: If the user voluntarily initiates contact via our official email (info@masegcorp.com) or corporate telephone/WhatsApp, the provided contact details (name, job title, company name, phone, message) are processed solely to respond to the professional engineering inquiry.
3. Technical Server Logs: When browsing this static website (Astro SSG), the server records standard technical HTTP connection data (cryptographically hashed IP address, timestamp, browser User-Agent, requested URI) solely for operational diagnostics and infrastructure security.
B. Strict Differentiation of Legal Bases (S9 Lead Intake)
In accordance with the Spanish Data Protection Agency (AEPD) guidelines and GDPR, MASEG does not apply a blanket, indiscriminate legal basis across all form submissions:
- Technical inquiries, engineering proposals, and quotations: Grounded in pre-contractual measures taken at the request of the data subject (GDPR Art. 6.1.b) and legitimate interest in processing B2B contact details of individuals acting on behalf of legal entities (LOPDGDD Art. 19). The user is never required to agree to marketing communications in order to receive an engineering proposal.
- Voluntary commercial communications and technical updates: Grounded strictly in explicit consent (GDPR Art. 6.1.a), collected through an optional, un-ticked-by-default checkbox. Consent can be revoked at any time without impacting technical inquiry processing.
4. Purposes and Legal Bases
| Processing Purpose | Data Categories | Legal Basis (GDPR) | Runtime Status |
|---|---|---|---|
| Commercial & Technical Inquiry Handling: Responding to inquiries regarding industrial assembly, naval maintenance, civil works, or technical proposals. | Professional identification and contact details (name, email, company, telephone, inquiry text). | Art. 6.1.b GDPR: Taking steps at the request of the data subject prior to entering into a commercial contract. Art. 19 LOPDGDD: Processing of B2B individual contact details. | Active (Web form & direct channels) |
| Website Security & Infrastructure Diagnostics: Protecting against cyber attacks, rate limiting, and verifying server availability. | Technical connection data (cryptographically hashed IP, date, time, User-Agent). | Art. 6.1.f GDPR: Legitimate interest in maintaining the integrity and security of the website. | Active (server logs & rate-limiting) |
| Specialized Technical Newsletters & Publications (Optional): Voluntary receipt of engineering updates and industrial sector news. | Professional email address and name. | Art. 6.1.a GDPR: Explicit opt-in consent of the data subject via optional checkbox. | Active (optional form checkbox) |
5. Data Retention Periods
Personal data provided through voluntary communication channels will be retained strictly for the duration necessary to answer the engineering inquiry or conclude the precontractual assessment.
Once the inquiry has been resolved, if no ongoing contractual or business relationship is formalized, the data will be securely deleted or placed in restricted blocking status, remaining accessible exclusively to public authorities, courts, and tribunals for the discharge of potential liabilities arising from the processing during statutory limitation periods (generally between 3 and 5 years under Spanish civil and commercial legislation).
6. Recipients and Data Processors
MASEG does not sell, rent, or trade personal data to third parties. Personal data will only be communicated in legally mandated circumstances:
- To competent judicial or administrative authorities where required by mandatory law.
- To technical service providers acting as Data Processors under written data processing agreements in compliance with Article 28 of the GDPR:
- Web Hosting & Server Infrastructure: Hostinger International Ltd., with data centers situated within the European Economic Area (EEA), providing static file hosting and server uptime.
7. International Data Transfers
The website is hosted on servers located within the European Union / European Economic Area (EEA). Under the current operational architecture, no international transfers of personal data are carried out to third countries outside the EEA or to international organizations.
Should future technical components require data transfers to third countries, MASEG will ensure that such countries have been granted an adequacy decision by the European Commission, or that Standard Contractual Clauses (SCCs) approved by the European Commission are executed.
8. Rights of the Data Subject
Under the GDPR and Spanish LOPDGDD, you are entitled to exercise the following fundamental rights:
- Right of Access: Obtain confirmation as to whether your personal data is being processed, and receive a copy thereof.
- Right to Rectification: Request the correction of inaccurate or incomplete personal data.
- Right to Erasure ("Right to be Forgotten"): Request the deletion of your personal data when it is no longer necessary for the purposes collected.
- Right to Restriction of Processing: Obtain the suspension of processing under circumstances specified in Article 18 of the GDPR.
- Right to Data Portability: Receive your personal data in a structured, commonly used, and machine-readable format.
- Right to Object: Object to processing based on MASEG's legitimate interest on grounds relating to your particular situation.
- Right to Withdraw Consent: Withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
How to Exercise Your Rights
You may exercise any of these rights by submitting a formal written request via email to:info@masegcorp.com, indicating in the subject line"Data Protection — Exercise of Rights" and clearly describing the specific right you wish to exercise. To protect your confidentiality and prevent unauthorized disclosure, a copy of a valid identity document (ID or passport) may be requested.
10. Technical and Organizational Security
MASEG implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, preventing the alteration, loss, unauthorized access, or unlawful processing of personal data, in compliance with Article 32 of the GDPR.
All data transmissions between user browsers and the server infrastructure are encrypted via HTTPS using standard TLS certificates, protecting the confidentiality and integrity of network communications.