Ewala

Privacy policy

How Ewala IT Services S.L. processes the personal data provided through this website and other communication channels, in accordance with the GDPR and Spanish data protection law. Courtesy translation: the Spanish version prevails in case of discrepancy.

Content and compliance

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR"), Spanish Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights ("LOPDGDD"), and other applicable data protection regulations.

This Privacy and Personal Data Protection Policy (hereinafter, the "Privacy Policy") applies to the personal data provided through the website www.ewala.es (hereinafter, the "Website"), as well as through any other communication channel made available by Ewala IT Services S.L. (hereinafter, "Ewala" or "the company").

Any reference to the "Website" shall also be understood as a reference to www.ewala.es or any of its subdomains, related domains or dependent web pages.

"User" means the person who accesses, uses or browses the Website.

The User freely and voluntarily decides to provide their personal data through the Website or the various communication channels available. Where data is requested through forms or other means, certain personal data may be required in order to respond to and process the request.

The complete legal information of the Website is made up, jointly, of the Legal Notice, this Privacy Policy and the Cookie Policy, documents accessible through a link at the bottom of the Website (hereinafter, the "Complete Legal Information"). The legal information of the Website must be interpreted jointly with all the documents mentioned.

Where personal data is requested through forms, the User will be provided with a table of basic data protection information, as well as an acceptance checkbox stating that they have read and accept this Privacy Policy, with a direct link to it.

Users are advised to read the Complete Legal Information in full on a regular basis, as its content may be subject to changes, which will be duly published with reference to their version and date.

Identification of the data controller and contact details

In compliance with applicable regulations, you are informed that the controller of the data provided is:

Owner
Ewala IT Services S.L.
Tax ID (C.I.F.)
B42987651
Address
Calle Peña Brava 21, oficina 1B, PI de Silvota, 33192 Llanera (Asturias), Spain
General email
info@ewala.es
Data protection email
rgpd@ewala.es

To exercise data protection rights, data subjects may contact the postal or email address above, following the procedure described in section 13.

Principles applicable to the processing of personal data

Ewala applies the principles set out in article 5 of the GDPR to the processing of personal data:

Lawfulness, fairness and transparency
Personal data is processed lawfully, fairly and in a transparent manner in relation to the data subject.
Purpose limitation
Data is collected for specified, explicit and legitimate purposes and is not further processed in a manner incompatible with those purposes.
Data minimisation
Data is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
Accuracy
Data is accurate and, where necessary, kept up to date. Reasonable steps will be taken to ensure that inaccurate data is erased or rectified without delay.
Storage limitation
Data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes of the processing.
Integrity and confidentiality
Data is processed in a manner that ensures appropriate security through appropriate technical and organisational measures.

Ewala as data processor

In the course of providing its cybersecurity, technological innovation and IT services, Ewala may act as a data processor on behalf of its customers, processing personal data in accordance with the customer’s documented instructions and the data processing agreement (DPA) signed between the parties.

In such cases, the customer acts as data controller and Ewala undertakes to comply with the obligations set out in article 28 of the GDPR, including the application of appropriate technical and organisational measures, limiting processing to the controller’s instructions, the duty of confidentiality of authorised personnel, the sub-processor regime, assisting the controller in complying with its obligations and the deletion or return of data at the end of the service, unless retention is required by law.

Ewala will not access or process its customers’ personal data for purposes other than those set out in the corresponding data processing agreement.

Data protection information regarding customers

Controller
Ewala IT Services S.L. (contact details in section 2).
Data processed and source
Data comes from what is provided in the commercial and contractual relationship: quotes, contracts, invoices, requests, emails and any other communication arising from the customer relationship. The categories of data processed include: identification data (first name, surname, ID/tax ID, position), contact data (address, telephone, email), commercial data (services contracted, proposals, quotes), economic, financial and banking data (invoicing, payment method, payment history) and technical data arising from the provision of the service (IP addresses, activity logs, configurations).
Purpose
Contracting of products and/or services and their management, provision and support of the contracted services, incident management, invoicing and collection, and preparation of aggregated and anonymised statistical reports on the company’s activity.
Legal basis
Performance of a contract or pre-contractual measures (art. 6.1.b GDPR), compliance with legal, tax and accounting obligations (art. 6.1.c GDPR) and legitimate interest in processing the data of contact persons of legal entities, sole traders and professionals (art. 6.1.f GDPR and art. 19 LOPDGDD).
Categories of recipients
Tax, accounting and labour advisers; the Spanish Tax Agency (AEAT) and other competent Public Administrations; financial institutions for the management of collections and payments; professionals and providers whose involvement is necessary to provide the service, with a data processing agreement in place; and, where legally required, State Security Forces and Bodies and Courts and Tribunals.
International transfers
None are generally foreseen. Where they are necessary to provide the service, the safeguards described in section 12 will apply.
Retention periods
For the duration of the contractual relationship and, afterwards, for the periods legally established for compliance with tax, accounting and commercial obligations, as well as for the establishment, exercise or defence of legal claims.
Automated decisions
No automated decision-making or profiling is carried out with customer data.

Data protection information regarding supplier management

Controller
Ewala IT Services S.L. (contact details in section 2).
Data processed and source
Data comes from the commercial and contractual relationship with suppliers. The categories of data include: identification data (first name, surname, ID/tax ID, position), contact data (address, telephone, email), commercial data (proposals, contracts, terms), economic, financial and banking data (account details, invoices, payment history) and supplier performance evaluations.
Purpose
Management of the relationship with suppliers, approval, selection and evaluation, contract management, invoicing and compliance with payment obligations.
Legal basis
Performance of a contract (art. 6.1.b GDPR), compliance with tax and accounting obligations (art. 6.1.c GDPR) and legitimate interest in administrative management and in processing the data of contact persons of legal entities (art. 6.1.f GDPR and art. 19 LOPDGDD).
Categories of recipients
Tax and accounting advisers, AEAT and financial institutions.
International transfers
None are generally foreseen. Should they become necessary, the safeguards described in section 12 will apply.
Retention periods
For the duration of the contractual relationship and, afterwards, for the periods legally established for compliance with tax, accounting and commercial obligations, as well as for the establishment, exercise or defence of legal claims.
Automated decisions
No automated decision-making or profiling is carried out.

Data protection information regarding recruitment and receipt of résumés

Controller
Ewala IT Services S.L. (contact details in section 2).
Data processed and source
Data comes from applications received through recruitment processes, unsolicited résumés or professional job platforms. The categories of data include: identification data (first name, surname, ID/NIE), contact data (address, telephone, email, professional profile), academic data (education, degrees, certifications), professional data (experience, references, technical skills) and data arising from the evaluation and selection processes.
Purpose
Evaluating applications in recruitment and hiring processes: receipt and assessment of résumés, conducting interviews and tests and maintaining a talent pool.
Legal basis
Consent of the data subject, expressed by voluntarily submitting their application (art. 6.1.a GDPR), and adoption of pre-contractual measures at the request of the data subject (art. 6.1.b GDPR). Maintaining the talent pool is based on the candidate’s consent, which may be withdrawn at any time.
Categories of recipients
Internal Ewala staff involved in recruitment processes and, where applicable, providers of application management platforms with a data processing agreement in place. No data is disclosed to third parties for any other purpose.
International transfers
None are generally foreseen. Should they become necessary, the safeguards described in section 12 will apply.
Retention periods
Candidates’ data will be kept for a maximum of twenty-four (24) months from receipt or last update. After that period, if the résumé has not been updated or used, it will be securely deleted, unless it must be kept for longer to comply with a legal obligation or for the establishment, exercise or defence of legal claims. If the candidate is hired as a result of the selection process, their data will become part of their employment file.
Automated decisions
No automated decision-making or profiling is carried out in recruitment processes.

Data protection information regarding sending and receiving emails

Controller
Ewala IT Services S.L. (contact details in section 2).
Data processed and source
Data comes from emails sent and received by Ewala through its corporate email accounts. Any information or personal data included in those emails is incorporated into the company’s processing systems.
Purpose
To manage, handle and respond to enquiries raised and to maintain the relationship generated through corporate email. Providing data by email is voluntary; depending on the subject, only the necessary data will be requested, so refusing to provide mandatory data may prevent the request from being handled or the service from being provided.
Legal basis
Performance of the contract or services requested (art. 6.1.b GDPR), consent expressed by sending the email (art. 6.1.a GDPR), compliance with legal obligations (art. 6.1.c GDPR) and legitimate interest in processing the contact data of legal entities, sole traders and professionals (art. 6.1.f GDPR and art. 19 LOPDGDD).
Categories of recipients
Third parties to whom disclosure is necessary by legal obligation or arising from the relationship itself; Public Administrations with competence in the matter; State Security Forces and Bodies; Courts and Tribunals; and service providers with which Ewala has signed the corresponding data processing agreement.
International transfers
None are generally foreseen. Should they become necessary, the safeguards described in section 12 will apply.
Retention periods
For the duration of the relationship and, afterwards, for the periods legally established for compliance with legal obligations or for the establishment, exercise or defence of legal claims.
Automated decisions
No automated decision-making or profiling is carried out.

Data protection information regarding electronic commercial communications

In compliance with article 21 of Spanish Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSICE), the GDPR and the LOPDGDD:

Controller
Ewala IT Services S.L. (contact details in section 2).
Data processed and source
Email address and, where applicable, first name, surname, company and professional position.
Purpose
Sending electronic commercial communications about Ewala’s products, services, news and activities.
Legal basis
Consent of the data subject (art. 6.1.a GDPR). For customers, sending communications about products or services similar to those originally contracted is based on the company’s legitimate interest (art. 6.1.f GDPR), under the terms of article 21.2 LSSICE. Every communication will offer the recipient the possibility to object to the processing.
Categories of recipients
Providers of electronic communication sending and management services, with a data processing agreement in place.
International transfers
None are generally foreseen. Should they become necessary, the safeguards described in section 12 will apply.
Retention periods
Data will be kept as long as the data subject does not withdraw consent or object to the processing and, afterwards, for the period necessary to demonstrate compliance with applicable legal obligations.
Automated decisions
No automated decision-making or profiling is carried out.

Data subjects may unsubscribe from commercial communications at any time, easily and free of charge, by sending an email to rgpd@ewala.es or through the unsubscribe link included in each communication.

Data protection information regarding data obtained through use and management of the Website

Controller
Ewala IT Services S.L. (contact details in section 2).
Data processed and source
Data comes from completing the contact forms and using the means of communication available on the Website. The data processed includes first name, surname, location, email, telephone, company, IP address and message content, as well as information obtained through cookies, which, unless technical, are only installed with the User’s prior consent. Where fields are marked with an asterisk (*) or indicated as mandatory, completing them is necessary; if they are not provided, Ewala may not accept or handle the enquiry.
Purpose
To manage, handle and respond to enquiries received through the Website, as well as to send administrative, technical, organisational or commercial information about the products and services that are the subject of the request, and to prepare aggregated and anonymised statistical reports on the use of the Website.
Legal basis
Consent of the data subject (art. 6.1.a GDPR), adoption of pre-contractual measures at the request of the data subject (art. 6.1.b GDPR) and legitimate interest in processing professional contact data (art. 6.1.f GDPR and art. 19 LOPDGDD).
Categories of recipients
Hosting, maintenance and information management service providers, with a data processing agreement in place. In particular, submission of the contact form is handled through Netlify, Inc. (website hosting and form processing) and Resend, Inc. (email delivery), both based in the United States, acting as data processors. Also, the other categories indicated in the previous sections where applicable.
International transfers
Submitting the contact form involves a transfer to Netlify, Inc. and Resend, Inc. (United States), under the safeguards described in section 12.
Retention periods
For the time necessary to handle the enquiry and, afterwards, for the periods legally established for compliance with legal obligations or for the establishment, exercise or defence of legal claims.
Automated decisions
No automated decision-making or profiling is carried out.

Data protection information regarding the use of cookies

The Website uses cookies. The categories of data processed include online identifiers, browsing data and user preferences. Cookies that are not strictly necessary, such as Google Analytics analytics cookies, are only installed with the User’s prior consent.

The purpose, legal basis, categories of cookies used, recipients and how to manage them are detailed in the Cookie Policy, accessible through a link at the bottom of the Website.

International data transfers

In general, Ewala does not carry out international transfers of personal data, except those arising from the use of providers based in the United States: Netlify, Inc. and Resend, Inc., for handling the contact form, and Google LLC, for web analytics, the latter only if the User has given consent (see the Cookie Policy).

Should personal data be transferred internationally as a result of its processing, such transfers will be carried out in accordance with applicable data protection regulations and, in particular, to countries whose level of protection has been declared adequate by an Adequacy Decision adopted by the European Commission, including, where the recipient has joined it, the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795).

Where the European Commission has not adopted an Adequacy Decision for a given country or recipient, Ewala will adopt other safeguards provided for in data protection regulations, in particular by signing Standard Contractual Clauses, accompanied, where appropriate, by any supplementary measures that may be necessary.

Data protection rights

Ewala informs data subjects of the existence of the following rights:

Right of access
To obtain confirmation of whether personal data concerning you is being processed and, if so, to access it and the information on the purposes of the processing, the categories of data, the recipients, the expected retention periods, the existence of other rights and the source of the data where it was not obtained from the data subject.
Right to rectification
To obtain rectification of inaccurate personal data or completion of incomplete data.
Right to erasure
To obtain erasure of data when it is no longer necessary for the purposes for which it was collected, consent is withdrawn, you object to the processing, the data has been unlawfully processed or must be erased to comply with a legal obligation.
Right to restriction of processing
To obtain restriction of processing when the accuracy of the data is contested, the processing is unlawful, the data is no longer needed by the controller but the data subject needs it for legal claims, or the data subject has objected to the processing.
Right to data portability
To receive the personal data provided in a structured, commonly used and machine-readable format and to transmit it to another controller, where the processing is based on consent or on the performance of a contract and is carried out by automated means.
Right to object
To object at any time, on grounds relating to your particular situation, to the processing of your personal data based on legitimate interest, as well as, in all cases and without needing to give reasons, to processing for direct marketing purposes.
Right not to be subject to automated individual decisions
Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.
Right to withdraw consent
To withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint with a supervisory authority
Data subjects may lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid, Spain — www.aepd.es), especially where they have not obtained satisfaction in the exercise of their rights.

How to exercise your rights

Rights may be exercised before Ewala, free of charge, by either of the following means:

  • Letter addressed to: Ewala IT Services S.L., Calle Peña Brava 21, oficina 1B, PI de Silvota, 33192 Llanera (Asturias), Spain.
  • Email to: rgpd@ewala.es

To exercise rights, the data subject must provide:

  • A signed written request stating the right they wish to exercise.
  • A copy of their identity document (national ID, passport or equivalent), only where there are reasonable doubts about the applicant’s identity.
  • If acting through a representative: documentation proving the representation (power of attorney, express authorisation or proof of parental authority or guardianship).

Ewala will handle requests within a maximum of one month from receipt, which may be extended by two further months in the case of complex or numerous requests, informing the data subject of the extension within the first month. Ewala may request additional information when necessary to verify the applicant’s identity or to locate the data covered by the request.

Data quality and accuracy

Ewala only requests personal data that is adequate, relevant and not excessive in relation to the purpose for which it is processed.

The User guarantees the truthfulness, accuracy, currency and authenticity of the personal data provided, and is liable for any damages that may result from breach of this guarantee. The User also undertakes to notify Ewala of any change or correction to their data through the means indicated in section 13.

Impersonation, adopting false identities, providing third-party data as one’s own and providing any untruthful data are expressly prohibited, and records made under such conditions may be cancelled, without prejudice to appropriate legal measures.

Third-party data

If the User provides personal data of third parties, they must first have informed those third parties expressly, precisely and unequivocally of the content of this Privacy Policy and have the necessary authority to provide such data.

In the event of non-compliance with this section, Ewala is exempt from any liability arising from the processing of data provided by the User in breach of legal requirements, the User being liable to Ewala or any third party for the damages caused.

Data of minors

Ewala’s Website and the services offered by the company are aimed exclusively at persons over eighteen (18) years of age with sufficient legal capacity to contract.

Ewala does not knowingly collect or process personal data of minors. If it becomes aware that data of a person under 18 has been collected without the consent of their legal representatives, it will delete it immediately.

If a legal representative becomes aware that a minor under their responsibility has provided personal data to Ewala, they may contact us at rgpd@ewala.es to request its deletion.

If data of minors or persons without legal capacity is provided through the Website, the person providing it and acting on their behalf declares responsibly that they hold legal representation, parental authority or guardianship, or have the express authorisation of whoever holds it, and the company may require supporting documentation.

Legal representatives shall in any case be considered responsible for the acts of the persons in their care, in accordance with applicable regulations.

Security measures

Ewala adopts and implements the technical and organisational measures necessary to guarantee the security of personal data, as required by article 32 of the GDPR, with the aim of ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services.

The measures applied include, among others: encryption in transit and at rest, multi-factor authentication (MFA), access management based on the principle of least privilege, continuous monitoring, encrypted and verified backups, data leakage prevention measures, periodic access reviews, confidentiality agreements with all staff and periodic training in data protection and information security.

However, the User should be aware that security measures on the Internet are not infallible. Ewala will process personal data with due confidentiality and duty of secrecy.

Ewala shall not be responsible for the processing and subsequent use of personal data that may be carried out by third-party information society service providers acting outside the Website.

Social media

Ewala maintains a presence on professional social networks in order to inform users about its activity, products and services. The processing of personal data of those who follow the corporate profiles is based on the consent expressed by following those profiles or interacting with them (art. 6.1.a GDPR).

The processing of personal data carried out on those networks is also subject to each platform’s terms of use, legal terms and privacy policies, which Users are advised to consult. Ewala is not responsible for the processing carried out by the platforms themselves on their users’ data.

Duration and modification of the Privacy Policy

The applicable Privacy Policy will be the one published on the Website at any given time. Ewala reserves the right to modify, in whole or in part, at any time, the content of this Privacy Policy by way of expansion, improvement, clarification or updating, whether due to legislative or case-law changes or changes in business strategy, without such modification having retroactive effect.

The Privacy Policy will always be accessible through a link at the bottom of the Website, indicating its version and publication date.

Invalidity and effectiveness

If any of the clauses included in this document is declared null, the rest of the document shall remain fully effective and binding on the same terms, provided it can subsist without the clause declared null.

Governing law and jurisdiction

The applicable law is Spanish law. Unless specific regulations establishing another jurisdiction apply, in particular consumer and user protection regulations, the parties submit to the Courts and Tribunals of Gijón (Spain) for any dispute, without prejudice to Ewala’s willingness to resolve any dispute amicably beforehand.

Last updated: October 26, 2026