Privacy Policy

Privacy Policies

This privacy policy of TASTELAB S.L. (hereinafter “TASTELAB”) aims to protect and respect users' privacy and is part of our General Terms and Conditions. Therefore, it applies to the “Apps” provided by TASTELAB, specifically the app “SENSESBIT” (hereinafter “the App”).

Consequently, in accordance with personal data protection regulations, and in compliance with the provisions of Regulation EU 2016/679, General Data Protection Regulation (“GDPR”) and the Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPD”), by means of this Privacy Policy, the User is informed of the following:

Data Controller:

TASTELAB, S.L. (hereinafter TASTELAB, or the Data Controller), with registered office at C/. Vázquez Seijas nº2, entreplanta 5, 27002, Lugo, Spain and CIF number B70453402, is responsible for processing the data provided by users (“Users”).

Purpose of data processing:

You can contact TASTELAB by postal mail at the above address, by email at rgpd@sensesbit.com, or by phone at +34 982 818 019.
As we reserve the right to modify or adapt this Privacy Policy at any time, we recommend periodic review of it.

For the purposes of this Privacy Policy, the following definitions will apply:

Client: company that contracts TASTELAB’s service through the SENSESBIT app, committing to use it in accordance with the corresponding contract and the Terms of Use of the Website and App.
App User: third party who accesses the SENSESBIT service by registering in the app or through a code provided by the client, responding to the survey(s) or tasting(s) provided by the Client or, if applicable, directly by TASTELAB.

FUNCTIONALITY OF THE App:

This Privacy Policy will apply to the processing of personal data by the SENSESBIT App, which is presented as a SaaS solution that allows for the management and integral sensory analysis, generating corresponding reports and statistical analyses from the obtained responses. The App has three access modes:

Administrator Access: provided to the Client, who can manage the sensory analysis in all aspects provided by the App: send surveys to third parties, view results, generate new questions, generate reports, etc.
Registered User Access: provided to users who access the App by creating an individual, personal account, through which they can access their private area and, voluntarily, respond to the surveys sent to them.
Non-Registered User: provided to certain users by a Client, for a specific survey. In this case, the user does not provide any personal data to TASTELAB, answering only the questions without the need to provide personal details.

By means of this, the Registered User agrees to complete the registration form with truthful, accurate, complete, and up-to-date mandatory data, being informed at that time of the required fields and the inability to access the App if the corresponding fields are not filled in. Furthermore, by accepting this Privacy Policy, the user acknowledges that the information and personal data collected with their registration are accurate and truthful. We kindly ask that you immediately inform TASTELAB of any changes to your personal data so that the information in our files is always updated and error-free.

The submission of personal data to TASTELAB or to the Client is mandatory to contact, become part of the database, and participate in future sensory studies with TASTELAB or the Client. Therefore, if the requested personal data is not provided in the various contact and/or registration forms or if this Privacy Policy is not accepted, the activities for which this App was developed cannot be carried out.

The Administrator User, i.e., the Client who formalizes the corresponding Order with TASTELAB, will be responsible for the truthfulness of the data communicated to TASTELAB during the registration process, committing to keep them updated at all times and to inform of any changes. Additionally, they will be responsible for obtaining the necessary consent regarding any personal data of third parties they may include in the App, acting as the Data Controller with respect to such data.

Data subject to processing by the App:

Our “App” may have access to the following personal data if accessed with the role of Administrator or Client of TASTELAB:

Company data.
Corporate email.
Name and surname.

SENSESBIT may have access to the following personal data if accessed by a Registered User:

Email account and encrypted password used by the user to log in.
User's name.
Last name (if provided by the user).
Age.
Year of birth.
Postal code.

Personal data provided by a Registered User using a company code will be owned and processed by the company associated with that code, and TASTELAB will have no direct knowledge of it.

The responses provided by the Registered User to surveys sent through the SENSESBIT App will be communicated to the Company/Client with which the user registered using the corresponding company code. Therefore, we inform you that TASTELAB is not responsible for the questions formulated through the App by the Company/Client, as it is exclusively the responsibility of the Client, as established in the General Terms of the App. Therefore, both the Client and TASTELAB will know the responses provided by the Registered User to each of the questions asked, although TASTELAB will not have direct access to the Registered User’s personal data, keeping them pseudonymized and only available to the Client.

PURPOSE OF THE PROCESSING OF DATA PROVIDED BY THE REGISTERED USER OR ADMINISTRATOR IN THE App:

The Data Controller will process the identifying and contact data that the Registered User or Administrator provides through the App's registration form or, where applicable, the contact form on the Website or when contacting the Data Controller via email, as well as any other data the Administrator includes when establishing contact with the Data Controller, with the following purposes:

Registration, access, and use of the App in the role of Administrator or Registered User.
Responding to and managing queries, requests, or petitions made by the Client to the support service, as well as providing information via electronic means regarding a request.
Providing information to the Client about improvements and updates to TASTELAB's services if the newsletter subscription is made.
Conducting analysis and improvements on the Website or App regarding TASTELAB's products and services based on the usage by the User.
Improving TASTELAB's commercial strategy.
Proactive contact by TASTELAB to offer technical support or technical-commercial advice to the Client.

Data processing is legally based on the free acceptance and consent of the interested party as a Registered or Administrator User, based on the processing information provided in this Privacy Policy. In cases where filling out a form is necessary to make a request and clicking the submit button, the act will necessarily imply that the user has been informed and has expressly given their consent for the processing of the provided data, all based on this privacy policy.

Therefore, we inform you that if you do not check the checkbox accepting the Privacy Policy, sending the information will not be allowed.

In addition to the purposes outlined in the previous paragraphs, TASTELAB may process the responses made by Registered Users in the tastings they have conducted anonymously and without re-identifying the user, for the purpose of improving the App and making statistical projections.

If the purpose is modified or it becomes necessary to expand or delete such data, the user will be informed so they can give their consent for the renewal or, alternatively, their withdrawal.

PROCESSING OF PERSONAL DATA ON THE WEB:

You can freely access our website www.sensesbit.com without any personal data processing occurring. However, we recommend you check our cookie policy to learn about its application. However, if the user accesses the services provided by the SENSESBIT App, it is possible that their personal data will be communicated to TASTELAB S.L., so we recommend reviewing the data processing policy of the mentioned App. The data collected automatically when you visit our website or the personal data entered by the user when using our services will be processed in accordance with the current legal provisions for the protection of personal data.

User Rights:

Data protection regulations grant users several rights:

To know if their data is being processed.
To access the personal data subject to processing.
To request the rectification of inaccurate data.
To request the deletion of data if they are no longer necessary for the purposes they were collected for or if the user withdraws their consent.
To request the limitation of data processing in certain cases, in which case the data will only be kept in accordance with current regulations.
To request data portability, which will be provided in a structured, commonly used, or machine-readable format; or they may be sent to the new designated controller. This is only valid in certain cases.
To file a complaint with the Spanish Data Protection Agency or the competent control authority.
To revoke consent for any processing for which they have consented at any time.

To facilitate the process and comply with the principle of data accuracy, if any data of the interested party subject to processing is modified, the Data Controller appreciates communication of such modifications as previously mentioned.

To exercise the aforementioned rights, the user can request a form from TASTELAB at the email address rgpd@sensesbit.com or use forms provided by the Spanish Data Protection Agency or third parties. These forms must be signed electronically or accompanied by a photocopy of the ID; if there is representation, a copy of the user’s ID must be attached, or it can be signed with their electronic signature. The forms can be submitted in person, sent by mail, or by email to the Responsible party at the address provided at the beginning of this text.

Depending on the exercised right, TASTELAB will respond within a maximum of one month from the receipt of the request, unless it is a complex case that requires more time, in which case the user will be notified as soon as possible. In any case, the Responsible party will take the necessary measures to protect the rights, freedoms, and legitimate interests of the interested party.

Processing of Third-Party Data:

As a general rule, the Responsible party will only process data provided by their holders. If data from third parties is received, the User must inform and request the consent of the data subjects in advance. If consent is not obtained, TASTELAB will be exempt from any responsibility for non-compliance with this requirement.

Minor’s Data:

TASTELAB will not process data from minors under 16 years old. Therefore, the user must refrain from providing such data if they are not of that age or, if applicable, from providing third-party data from individuals who do not meet that age requirement. TASTELAB is exempt from any responsibility for non-compliance with this provision.

Commercial Communications by Electronic Means:

If the Administrator User gives their explicit consent by checking the corresponding checkbox, TASTELAB will send commercial communications to the email address provided by the Customer. The Responsible party will store the email in the database and send emails periodically until the user requests to unsubscribe, which will be available in any communication. We may keep the data provided for the time necessary to comply with any legal obligations to which TASTELAB may be subject. Data will not be shared with third parties, except those listed as Data Processors in Annex I, and no international transfers will be made.

The purposes of this specific processing are:

To manage the requested service.
Information via electronic means related to the request.
Commercial or event-related information via electronic means, with explicit authorization.
To analyze and improve email sending strategies to enhance commercial strategies.

In any case, you can exercise your rights to access, rectification, deletion, opposition, limitation of processing, and portability as mentioned earlier. You also have the right to withdraw consent at any time, without affecting the lawfulness of the processing carried out before that.

Security Measures Applied:

Regarding security measures, TASTELAB will adopt all necessary security measures in accordance with Article 32 of the GDPR. In this regard, TASTELAB, considering the state of the art, application costs, nature, scope, context, and purposes of processing, as well as the risks to the rights and freedoms of individuals, will implement the appropriate technical and organizational measures to ensure an adequate level of security in relation to the identified risks.

In any case, it must implement mechanisms to:

Ensure the confidentiality, integrity, availability, and resilience of processing systems and services.
Restore the availability and access to personal data quickly in case of physical or technical incident.
Regularly verify, evaluate, and assess the effectiveness of the implemented technical and organizational measures to ensure processing security.
Pseudonymize and encrypt personal data, if applicable.

Communication to Third Parties:

We inform you that the personal data of users may be transferred to:

The Client whose company code is linked by the Registered User upon accessing the App. In this case, TASTELAB will not have direct knowledge of the Registered User's personal data, only the responses provided.
Public authorities when necessary, banks and financial institutions for payment processing, and in all cases required by legal obligation or judicial request.
Data Processors necessary for providing the contracted service, who will guarantee that they maintain the same level of privacy as the Responsible party in compliance with the GDPR and LOPD. A list of Data Processors used by TASTELAB can be found in Annex I of this Privacy Policy.

Cookies:

TASTELAB's website uses Cookies. If you wish to learn more, you can access our Cookie Policy.

Retention of Personal Data:

Personal data will be retained in TASTELAB’s systems and facilities as long as the User is linked to the Responsible party and has not requested its deletion.
Once the user is no longer linked, the data processed for each purpose will be anonymized for the legally required periods, including the period during which a judge or court may request it, according to the statute of limitations for legal actions.
Processed data will be kept until the expiration of the previously mentioned legal periods, if there is a legal obligation to retain them.
If no such legal period exists, the data will be retained until the interested party requests its deletion or revokes their consent.
TASTELAB will retain all information and communications related to the service provision while the product or service guarantees remain in place to address any potential claims.

Data Retention:

TASTELAB informs you that, as a data hosting service provider and in accordance with Law 34/2002 of July 11, on Information Society Services and Electronic Commerce (LSSI), it will retain the minimum necessary information to identify the origin of the hosted data and when the service started, for a maximum period of 12 months. This retention is made to comply with possible legal and judicial obligations regarding the User and can only be communicated by judicial request, safeguarding the utmost respect for the confidentiality of communications and personal data protection regulations.

ANNEX I: DATA PROCESSORS:

OVH HISPANO SL
CONTACT DETAILS:	Social address: C/ Alcalá 21, 5th floor, 28014 Madrid, Spain. NIF: B-83834747, Contact: 91 758 34 77 - soporte@ovh.es
PROCESSING PURPOSE:	Backup storage for the SENSESBIT Platform.
DATA SUBJECT TO PROCESSING:	Data stored on the SENSESBIT Platform, including personal data provided by the Customer.
INTERNATIONAL DATA TRANSFERS:	No international data transfers are made.
GDPR COMPLIANCE:	OVH HISPANO S.L. guarantees compliance with the GDPR, as established in the Personal Data Processing Agreement signed between the parties in accordance with Article 28 of the GDPR.
CPC SERVICIOS INFORMATICOS SL
CONTACT DETAILS:	Address: C/ Nardo, 12 28250 - Torrelodones - Madrid. info@mailrelay.com
PROCESSING PURPOSE:	Provider used by the SENSESBIT Platform for sending emails to clients/interested parties, operating under the commercial name “MAILRELAY”.
DATA SUBJECT TO PROCESSING:	Email addresses provided by the client for sending communications.
INTERNATIONAL DATA TRANSFERS:	No international data transfers are made.
GDPR COMPLIANCE:	They ensure compliance with GDPR.