1. Who is responsible for the processing of your data?

Corporate name: LIGHT CONCEPT APPS SL
Tax ID (CIF): B05273487
Address: Paseo de la Castellana 194, 28046, Madrid
Email: info@lcapps.es

2. What kind of data do we have about you and how have we obtained it?

The categories of personal data we process from clients and suppliers are:

Identification data
Postal or email addresses
Commercial information
Economic and transaction data

All the aforementioned data has been obtained either directly from you through the submission of a commercial offer, contractual proposal, etc., or through your company by providing us with the identification data and other necessary information to carry out the object of the contractual relationship between the parties. It is your or your company's obligation to provide us with updated data in case of modification.

3. For what purposes do we process your data?

We process the data provided by interested parties to manage various activities derived from specific procedures carried out in sales, after-sales service, supplier management, quality of services, etc. In this way, we will use your data to carry out some of the following actions:

Sending information you request via the contact form on our website or any other means of contacting our company,
Providing both potential customers and our clients with offers of products and services of interest to them,
Managing the administrative, fiscal, and accounting aspects of our customers and/or suppliers.
Conducting satisfaction surveys, market research, etc., to offer you the most appropriate offers and optimized service quality.
Employee labor management.

4. How long will we keep your data?

The retention periods for your personal data will depend on the category of data and applicable legal obligations:

Operational client data from the service: will be deleted within a maximum period of 30 calendar days from the effective date of service cancellation.
Tax and fiscal data: 4 years, in accordance with Article 66 of the Spanish General Tax Law.
Accounting and commercial documentation: 6 years, in accordance with Article 30 of the Spanish Commercial Code.
Employee data: will be retained for the duration of the employment relationship and, after its termination, for the legally established periods (4 years for Social Security obligations, in accordance with Article 21 of the LGSS).
Potential customer data without contractual relationship: 24 months from the last interaction, unless new consent is obtained.
Data obtained through contact forms: 12 months from the resolution of the inquiry, unless a contractual relationship is established.

Once the indicated periods have elapsed, the data will be permanently deleted or, where applicable, irreversibly anonymized for exclusively statistical purposes.

5. What is the legal basis for the processing of your data?

Depending on the type of data processing, the legal basis is as follows:

Processing	Legal basis
Accounting management: billing management with clients and/or suppliers	Maintenance, development, and control of the contractual relationship between the parties
Tax management: application of withholdings, bonuses, etc.	Maintenance, development, and control of the contractual relationship between the parties; Compliance with legal obligations
Administrative management: logistics management, warehouse, customer deliveries, goods reception, etc.	Maintenance, development, and control of the contractual relationship between the parties
Marketing: Commercial actions regarding our products or services aimed at our clients or those who have requested information about our products and services in the past, including conducting customer satisfaction surveys.	Free and unequivocal consent of the interested party (potential customers); the company's legitimate interest in promoting and marketing products or services similar to those obtained or requested by interested parties in the past.
Labor management: administrative, accounting, and tax management of employees. Workday registration management.	Execution of a labor contract. Legal compliance

In the event that you do not provide your personal data, your contract cannot be executed, nor can legal obligations or those arising from public authorities be fulfilled.

6. To whom will your data be communicated?

We will not transfer your personal data to any third-party company that intends to use it for direct marketing actions, except in cases where you have expressly authorized us to do so.

We inform you that we may provide your personal data to public administration bodies and competent authorities in cases where we are legally required to do so or in cases where, in good faith, we believe such action is reasonably necessary to comply with a judicial process; to respond to any claim or legal demand; or to protect the rights of the company or its clients and the general public.

We inform you that your data will not be transferred or communicated to third parties; the company is solely responsible for their processing and custody.

However, we may provide your personal data to third parties (e.g., Internet service providers who help us manage our website or provide contracted services, IT support and maintenance companies, logistics companies, accounting and tax advisory firms, etc.).

In addition, we inform you that for the provision of certain services, it is necessary to subcontract third parties. Specifically, we indicate below a list of subcontractors that are currently contracted by us:

OVH HISPANO S.L.U. (B83834747) Calle Alcalá, 21, 5th floor, 28014, Madrid (Activity: Servers, Hosting, and Storage)
AMAZON WEB SERVICES EMEA SARL (W0185696B) Calle Ramírez de Prado, n 5, 28045, Madrid (Activity: Servers, Hosting, and Storage)
GOOGLE CLOUD EMEA LIMITED (IE3668997OH) Clanwilliam Place, 2, Dublin, Ireland (Activity: Email Service, Storage)

In any case, these third parties and/or subcontractors must always maintain the same levels of security as us in relation to your personal data, and, when necessary, they will be bound by legal commitments to keep your personal data private and secure, as well as to use the information only following the company's specific instructions.

7. Are there any data transfers to third countries?

Your personal data is stored and processed exclusively within the European Economic Area (EEA). No data transfers to third countries are carried out.

8. What are your rights as an interested party?

Any person has the right to obtain confirmation about whether we are processing personal data concerning them, or not.

Specifically, interested parties may request the right of access to their personal data, as well as receive them in a common, machine-readable format if the processing is carried out by electronic means (right to data portability).

Likewise, interested parties may request the right to rectify inaccurate data or, where appropriate, request their deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

Additionally, under certain circumstances, interested parties may request the limitation of the processing of their data or, under certain circumstances and for reasons related to their particular situation, interested parties may exercise their right to object to the processing of their data. We will stop processing the data, except for legitimate, compelling reasons, or the exercise or defense of possible claims, or in the exceptions established by applicable regulations.

Likewise, we inform you that you have the right to withdraw your consent at any time, without affecting the legality of the processing based on the consent prior to its withdrawal.

Furthermore, the User is informed that at any time they may exercise the aforementioned rights by writing to us using the contact details provided in point 1, attaching a copy of their ID.

The exercise of these rights is free of charge. LCApps will respond to your request within a maximum period of one month from receipt, which may be extended by a further two months in the case of particularly complex requests, upon prior notification to the data subject. We inform you that no automated decisions are made nor profiles created based on your personal data within the meaning of Article 22 of the GDPR.

You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD), especially when you have not obtained satisfaction in exercising your rights: https://www.aepd.es

Furthermore, in accordance with the provisions of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce, we commit not to send commercial information if you have informed us of your preference not to receive it.

9. Data Protection Officer

For any questions regarding the processing of your personal data, you may contact our data protection officer at: info@lcapps.es.

10. Security Measures

LCApps has adopted the necessary technical and organizational measures to ensure the security and integrity of the personal data it processes, in accordance with Article 32 of the GDPR. These measures include, but are not limited to: encryption of data in transit and at rest, role-based access controls, periodic security audits, regular backups, and security incident management procedures.

In the event of a security breach that may pose a risk to your rights and freedoms, LCApps will notify the Spanish Data Protection Agency within a maximum of 72 hours in accordance with Article 33 of the GDPR and, where appropriate, the affected data subjects in accordance with Article 34 of the GDPR.