1. Identification details of the data controller
In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD), we hereby inform you that the controller responsible for processing your personal data is:
Data controller: Terralupa Spain SL
Trading name: TerraLupa
Tax ID / VAT number: B21905153
Registered address: Calle Goiri 4, 1D, Madrid
Email address: hello@terralupa.com
Website: www.terralupa.com
2. Information on the processing of personal data
2.1. What data do we collect?
Through the contact form available on the Website, we collect the following personal data:
Name: to identify the user and personalise communications.
Email address: to manage and respond to the enquiry submitted.
Comment or message: to understand the content of the request or enquiry.
No sensitive personal data or special categories of personal data within the meaning of Article 9 of the GDPR are collected.
2.2. For what purposes do we process your data?
The personal data provided through the contact form are processed exclusively for the following purposes:
- To respond to and manage enquiries, requests for information or other requests submitted by the user.
- To maintain the necessary communication within the framework of the pre-contractual or professional relationship arising from such contact.
The data will not be used for any purpose other than those stated above without first informing the user and obtaining their consent where applicable.
2.3. What is the legal basis for the processing?
The legal basis that legitimises the processing of personal data is the consent of the data subject (Article 6.1(a) of the GDPR), given freely, specifically, knowingly and unambiguously when completing and submitting the contact form.
The user may withdraw their consent at any time, without affecting the lawfulness of the processing carried out before its withdrawal.
2.4. How long do we retain your data?
Personal data will be retained for the time strictly necessary to manage the enquiry or request submitted and, once it has been resolved, for the legally established periods required to address any potential liabilities arising from the processing.
Once these periods have expired, the data will be securely deleted or anonymised.
2.5. With whom do we share your data?
Personal data will not be transferred or disclosed to third parties, except in the following cases:
- Where disclosure is required by law.
- Where it is strictly necessary to provide a service requested by the user, in which case the appropriate safeguards required under the GDPR will be implemented.
The Website does not use third-party tracking or analytics tools, such as Google Analytics or similar services, and therefore no transfer of data takes place as a result of browsing the Website.
2.6. Are international data transfers carried out?
No data transfers are made to third countries outside the European Economic Area.
3. Rights of data subjects
In accordance with the GDPR and the LOPD-GDD, users may exercise the following rights at any time:
Right of access: to know what personal data concerning them are being processed.
Right to rectification: to correct inaccurate or incomplete data.
Right to erasure (“right to be forgotten”): to request the deletion of their data when, among other reasons, they are no longer necessary for the purposes for which they were collected.
Right to object: to object to the processing of their data on grounds relating to their particular situation.
Right to restriction of processing: to request that the processing of their data be restricted under certain circumstances.
Right to data portability: to receive the personal data concerning them in a structured, commonly used and machine-readable format, and to transmit those data to another controller.
Right to withdraw consent: at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
How can these rights be exercised?
Users may exercise any of the above rights by sending a written request to the email address hello@terralupa.com, specifying the right they wish to exercise and attaching a copy of their identity document or another supporting identification document.
The request will be handled within a maximum period of one month from receipt. This period may be extended by a further two months in particularly complex cases, in which case the data subject will be informed of the extension.
Complaint to the supervisory authority
If the user believes that the processing of their data does not comply with the applicable regulations, they have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
Electronic office: www.aepd.es
Postal address: C/ Jorge Juan, 6. 28001, Madrid
4. Security measures
The data controller has implemented the necessary technical and organisational measures to ensure the security and integrity of personal data and to prevent their loss, alteration or unauthorised access, taking into account the state of the art, the nature of the stored data and the risks to which they are exposed.
5. Confidentiality
The personal data collected will be treated with the utmost confidentiality. The data controller undertakes to comply with the duty of secrecy regarding users’ personal data, in accordance with the applicable regulations. This obligation will remain in force after the relationship with the user has ended.
6. Updates to the Privacy Policy
This Privacy Policy may be amended as a result of legislative changes, case law or criteria issued by the Spanish Data Protection Agency. Users will be informed of any relevant changes affecting their personal data. Users are advised to review this document periodically.
Last updated: May 2026