Privacy Policy

This policy explains how we handle your personal information when you browse mrmtribal.com, contact MRM Tribal, request a document, or subscribe to our communications.

Data processing is carried out in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights. This policy covers the processing of personal data carried out through the website and the forms described herein.

1. Data Controller

Company Name: MRM WORLDWIDE SPAIN S.A.
Tax ID: ESA78962750
Registered Address:
C/ Enrique Jardiel Poncela, 6
28016 Madrid (Spain)
Email for privacy and exercising rights: [email protected]

2. What Information We Collect

We collect the information you provide in the contact and download forms: first name, last name, email address, phone number, company, job title, and any information you include in your message. We also record the document you requested and your preference regarding the receipt of marketing communications.

The data comes from the information you provide to us and from your browsing activity on the site. We process only the data that is appropriate, relevant, and necessary for the stated purposes. You must provide accurate information and notify us of any changes to keep it up to date.

Fields marked as required are necessary to process your request. If you do not provide this information, we will not be able to process your request. The other fields are optional. You can submit your inquiry or download the document without providing optional information and without agreeing to receive marketing communications.

Filling out the forms is voluntary and does not, in and of itself, constitute a legal obligation to provide data. The requirement to fill out certain fields is limited to the processing of the specific request; it does not make the data available for other uses nor does it authorize its indefinite retention.

When you browse the site, technical data—such as your IP address, the date and time of your visit, and browser information—is collected to provide and protect the service. If you enable analytical cookies, data regarding your use of the website is also collected, as explained in the Cookie Policy.

Please provide only the information necessary for your application. Do not include health information, identification documents, or sensitive information or information about other people that is not necessary. These forms are not intended for submitting resumes.

3. How we use your data and on what basis

Inquiries. We use your data to respond to you and handle matters directly related to your request. If you request information prior to contracting a service with us, the processing is based on that request, in accordance with Article 6.1.b of the GDPR. For general inquiries or those made on behalf of a company, we rely on our legitimate interest in responding to the communications we receive and maintaining a professional relationship with the person contacting us, in accordance with Article 6(1)(f) of the GDPR.

When contacting individuals on behalf of a company, data processing is limited to the information necessary to locate you professionally and to maintain relations with the entity for which you provide services, within the limits set forth in Article 19 of Organic Law 3/2018. Responding to an inquiry does not, in and of itself, authorize the use of the data for marketing campaigns.

Downloads. We use the data to provide you with the document you have requested and to resolve access issues. The legal basis is our legitimate interest in fulfilling your request, in accordance with Article 6.1.f of the GDPR. Downloading does not constitute a subscription to marketing communications.

Marketing communications. We will only use your name and email address to send you information about MRM Tribal’s services, projects, resources, and news if you check the corresponding box. This is based on your consent, in accordance with Article 6.1.a of the GDPR. Subscription is voluntary, and you may cancel it at any time without affecting your access to our content or downloads.

Consent to receive communications is requested via a separate, optional checkbox that is not pre-checked, in accordance with Article 7 of the GDPR and Articles 21 and 22 of Law 34/2002. Reading the Privacy Policy and submitting a form do not constitute consent to receive advertising. Each communication will identify the sender and include a simple, free way to opt out.

Operation and Security. We use technical data to display the website, resolve issues, and prevent unauthorized access. The legal basis for this is our legitimate interest in maintaining a secure service and protecting data, in accordance with Article 6.1.f of the GDPR.

Analytics. If you consent, we use Google Analytics to track visits, sessions, and the use of content on mrmtribal.com. The legal basis is your consent, in accordance with Article 6.1.a of the GDPR. This consent pertains to informed measurement and does not include the receipt of commercial communications or other advertising purposes. You can withdraw your consent at any time via the Cookie Settings page.

Obligations and Claims. We process the data necessary to comply with legal obligations and to uphold your data protection rights, in accordance with Article 6.1.c of the GDPR. When necessary to establish, exercise, or defend legal claims, we rely on our legitimate interest in protecting our rights, in accordance with Article 6.1.f of the GDPR.

Preference Management. We record the choices you make regarding cookies and the minimum information necessary to respect those choices and, when applicable, to document your consent. The recording of the evidence necessary to comply with our obligations is based on Article 6.1.c of the GDPR. This information is not used to send you advertising.

We will not use your data for purposes incompatible with those described. If it becomes necessary to use your data for a different purpose, we will provide the relevant information in advance and obtain new consent when required. We do not make the handling of requests contingent on your authorization of data processing that is unnecessary for addressing those requests.

4. How long do we keep them?

Inquiries and Downloads. We retain the data for as long as necessary to address the request and resolve any directly related issues. Once the matter has been resolved, we no longer use the data for these purposes. If a contractual relationship is established, the necessary data will be processed in accordance with the privacy policy applicable to that relationship.

Marketing communications. We retain your data for as long as you remain subscribed. When you unsubscribe or withdraw your consent, we will stop using your data to send you communications and will retain only the information necessary to honor your choice and demonstrate the lawfulness of previous communications.

Security. We retain records for as long as necessary to detect and resolve incidents and protect the service. If a record is related to an incident, it will be retained for as long as necessary to investigate the incident and address any liabilities that may arise.

Analytics. Cookies are retained for the periods specified in the Cookie Policy. The retention period for user and event data in Google Analytics is 14 months.

When it is necessary to retain data to comply with obligations or fulfill responsibilities, the data will remain blocked for the applicable limitation periods and will be deleted upon their expiration. While blocked, the data will not be used for any other purposes. Statistics may be retained without identifying individuals when they have been irreversibly anonymized.

Blocking involves setting the data aside and preventing its ordinary processing, including its display, except when it is made available to the competent authorities and bodies to fulfill the corresponding obligations, in accordance with Article 32 of Organic Law 3/2018. Retention periods are determined based on the purpose, the proven need for retention, and the statutory limitation periods, and not as minimum periods for commercial use.

5. Who We Share Data With

Data may be accessed by providers who offer hosting, website maintenance, form management, email, and communication delivery services, solely to the extent necessary to provide their services and in accordance with the safeguards required by law. Hosting is provided by WP Engine, with servers located in Germany. Google Analytics tracks website usage when you authorize it. Formidable Forms provides the functionality for sending and receiving information via forms.

When these providers act on our behalf as data processors, their access will be subject to the conditions and obligations set forth in Article 28 of the GDPR, including confidentiality, compliance with our instructions, and data protection. The mere fact that a company belongs to the same group does not, in and of itself, permit the use of the data for its own purposes other than those disclosed.

We may also provide data to authorities and judicial bodies when there is a legal obligation to do so. We do not share your data with other companies so that they can carry out their own marketing campaigns without a specific legal basis and specific information.

6. International Transfers

The fact that the data is hosted in Germany does not preclude certain providers from accessing or processing the data from other countries. If data is transferred outside the European Economic Area, an adequacy decision or the safeguards provided for in the regulations—such as the standard contractual clauses approved by the European Commission—will apply, as appropriate for each transfer. You may request information and a copy of the applicable safeguards by emailing our privacy team.

Transfers will be carried out in accordance with Chapter V of the GDPR. When based on an adequacy decision, Article 45 of the GDPR will apply; when based on appropriate safeguards, Article 46 will apply, along with any necessary supplementary measures. The specific information identifies the countries, the recipients, and the safeguards corresponding to each data flow. Authorizing cookies does not, in and of itself, constitute general consent to any international transfer.

Suppliers, countries, and applicable warranties:

7. Your Rights

You may request access to your data, the correction of inaccurate data, its erasure, the restriction of processing, and, where applicable, data portability. You may also object to processing based on legitimate interests for reasons related to your particular situation. In that case, we will cease processing the data unless there are compelling legitimate grounds that take precedence or are necessary to address claims. You may object at any time to the use of your data for direct marketing purposes.

The right of access allows you to find out whether we process data about you and to obtain a copy of that data and the corresponding information. The right to rectification allows you to correct inaccurate or incomplete data. The rights to erasure and restriction apply in the cases provided for by law. Data portability applies when the processing is based on consent or a contract and is carried out by automated means; it allows you to receive the data you have provided in a structured, commonly used, and machine-readable format, or to request its transmission to another controller when technically feasible.

You also have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you, in accordance with Article 22 of the GDPR. These rights may be exercised within the scope and limits set forth in Articles 15 through 22 of the GDPR, while respecting the rights of others.

You may withdraw your consent without affecting the lawfulness of the processing that took place prior to the withdrawal. To unsubscribe from marketing communications, use the unsubscribe link included in each email or send an email to our privacy address. To change your cookie settings, use “Manage Cookies.”

Please send your request to the privacy email address or to the data controller’s mailing address, specifying the right you wish to exercise. We will only ask you for additional information to verify your identity if there are reasonable doubts about your identity.

We will respond within one month of receiving your request. If necessary—due to the complexity of the request or the number of requests—we may extend this period by an additional two months, and we will inform you of the reasons within the first month. This process is free of charge, except in cases provided for by law, such as manifestly unfounded or excessive requests.

If we do not process your request, we will inform you within the applicable timeframe of the reasons for this and of your options to file a complaint with the supervisory authority and to seek judicial redress. Withdrawing your consent is as simple as giving it, and you are not required to justify your decision.

You may file a complaint with the Spanish Data Protection Agency at https://www.aepd.es if you believe that the processing of your data violates your rights. You are not required to contact us first.

8. Automated Decisions

We do not use your data to make decisions based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. We will not create profiles of our contacts, assign them credit scores, or personalize advertising based on their browsing activity or the data they provide.

9. Minors and Data Protection

The website is intended for a professional audience, and its forms are not designed to collect data from minors. If we detect data from minors that was obtained without the necessary authorization or legal basis, we will take the appropriate measures to delete it or ensure its processing complies with the law. You can report these situations to our privacy email address.

When the processing of a minor’s personal data requires consent, the age and representation requirements set forth in the regulations shall apply. For minors under the age of fourteen, the consent of their legal representatives is required, without prejudice to cases in which the law also requires their involvement beginning at that age.

We implement appropriate technical and organizational measures to protect your data from unauthorized access, loss, or alteration. If a security breach occurs, we will take the necessary steps and issue the appropriate notifications in accordance with applicable regulations.

Individuals who access the data in the course of their duties shall be subject to a duty of confidentiality. The protective measures shall be reviewed in accordance with the nature of the information, the circumstances of the processing, and the risks to the rights and freedoms of individuals.

10. Changes to This Policy

We will update this policy whenever there are changes to how we process your data or to the information we are required to provide. If we wish to use your data for a new purpose, we will inform you in advance and request your consent when necessary. External sites that you access through links on this website have their own privacy policies.