This policy explains how we process the personal data you give us through this website, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and the guarantee of digital rights (LOPDGDD).

1. Data controller

Owner
THE BOX FULFILLMENT, S.L.
Tax ID (NIF)
B27609098
Registered office
Calle de las Palmeras, 4, Nave B14, 28350 Ciempozuelos (Madrid), Spain
Email
marketing@barosalabs.com
Registration details
[Pending: Commercial Registry details]
Website
theboxfulfillment.com

2. What data we process

When you request a quote with our form:

  • About your business: the type of products you sell, where you sell them, your approximate order volume, the services you are interested in, when you would like to start and, if you write them, the details you add under “Other”.
  • Contact details: full name, company, work email and, if you provide them, phone number and any message you leave us.
  • Campaign through which you found us, if you arrive from an ad: the campaign identifiers in the page address (for example, utm_source or gclid) and the page from which you submit the form.

When you browse, our server records technical connection data (IP address, date and time, requested page and browser) to keep the website secure and prevent automated or fraudulent submissions. If we enable analytics or advertising tools in the future, they will only be used if you accept them; see the cookie policy.

Fields marked with an asterisk are required for us to handle your request. If you give us someone else’s data (for example, a colleague’s), you confirm that you have informed them and have their permission.

3. Why we use it and on what legal basis

  • Handling your request and preparing a quote — pre-contractual measures taken at your request (art. 6.1.b GDPR).
  • Recording the request in our CRM and following it up commercially — legitimate interest in managing the business contacts we receive (art. 6.1.f GDPR).
  • Keeping the website secure and preventing spam and fraud — legitimate interest (art. 6.1.f GDPR).
  • Measuring traffic and our campaigns — only with your consent, which you can withdraw at any time (art. 6.1.a GDPR).

We will not send you commercial emails unless you authorise us to or, if you become a client, about services similar to those you have contracted (art. 21 LSSI-CE). You can object at any time, free of charge, from the message itself or by writing to us. We do not make automated decisions or build profiles with legal effects on you.

4. For how long

  • Requests that do not lead to a contract: up to 2 years from the last contact, so we can resume the conversation; after that they are deleted.
  • Clients: for the duration of the relationship and, afterwards, for the periods required by law (for example, 6 years for commercial records).
  • Technical security logs: 90 days at most.

5. Who else accesses your data

We do not sell or disclose your data to third parties, except where required by law. We work with providers who process it only on our behalf, under a contract compliant with article 28 GDPR:

  • IONOS SE — website hosting · Germany (EU).
  • Odoo S.A. — business management software and CRM where requests are recorded · Belgium (EU).

Our providers process data within the European Economic Area. If any of them transferred it outside the EEA (for example, to its parent company in the United States), it would do so with the safeguards required by the GDPR: an adequacy decision, such as the EU-US Data Privacy Framework, or standard contractual clauses approved by the European Commission.

6. Your rights

You may exercise the following rights at any time, free of charge:

  • Access — find out what data of yours we process.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — ask us to delete it when it is no longer needed.
  • Objection — object to processing based on legitimate interest or for commercial purposes.
  • Restriction — ask us to stop using it temporarily.
  • Portability — receive it in a structured, commonly used format.
  • Withdraw your consent, where given, without affecting prior processing.

Write to us at marketing@barosalabs.com with the subject “Data protection”, stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it. We will reply within one month at most.

If you believe we have not processed your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Minors

Our services are aimed at companies and professionals. We do not knowingly process data of children under 14; if we find that we have received it, we will delete it.

8. Security

We apply technical and organisational measures appropriate to the risk: encrypted connection (HTTPS), restricted access to the systems where data is stored, protection against automated submissions and providers offering sufficient guarantees. Your browser never connects directly to our business management systems.

9. Changes to this policy

We may update this policy to reflect legal changes or changes to our services. The date of the latest update is always shown at the top of this page. This English version is provided for convenience; in case of discrepancy, the Spanish version prevails.