Privacy Policy

1. Data controller

The data controller responsible for the personal data collected through the Website is:

2. Purposes of processing

We process the personal data you provide for the following purposes:

• Handling enquiries and commercial proposals: answering enquiries sent through the contact form, email, phone or WhatsApp, and preparing and sending customised quotes.
• Managing the contractual relationship: formalising, executing, invoicing and following up on contracted logistics services (intake, storage, picking, packing, shipping and returns).
• Compliance with legal obligations: issuing invoices, retaining accounting and tax documentation, and meeting other legal obligations applicable to our activity.
• Commercial communications: sending information about services, news or content related to SPO Logistics' activity, provided the User has expressly consented or there is a prior contractual relationship for similar products or services.
• Improving the Website and user experience: compiling usage statistics and analysing User behaviour, in accordance with our Cookie Policy.

3. Legal basis for processing

The legal basis for processing depends on the specific purpose:

• Performance of a contract (art. 6.1.b GDPR): for managing the commercial relationship and delivering contracted services.
• Compliance with a legal obligation (art. 6.1.c GDPR): to meet tax, accounting and commercial obligations.
• Consent (art. 6.1.a GDPR): for sending commercial communications and for the use of non-essential cookies.
• Legitimate interest (art. 6.1.f GDPR): for pre-contractual enquiry handling and direct marketing of similar products or services to existing clients.

4. Retention period

Personal data will be kept for as long as necessary to fulfil the purpose for which it was collected and to determine any liabilities that may arise from said purpose and processing. Specifically:

• Commercial contact data: until the User requests its deletion or for a maximum of 2 years from the last contact if no contractual relationship is formalised.
• Client data: for the duration of the contractual relationship and afterwards, for the legally required periods to address potential liabilities (minimum 6 years under the Spanish Commercial Code for commercial and accounting documentation).
• Data for commercial communications: until consent is withdrawn by the data subject.

5. Recipients and disclosures

Your personal data may be disclosed to the following categories of recipients when necessary for service delivery or by legal obligation:

• Transport and parcel companies hired for shipment delivery.
• Banks and payment service providers for managing collections and payments.
• Competent public authorities (Tax Agency, Social Security, etc.) when legally required.
• Technology suppliers providing services to the Company (hosting, management software, communications, etc.), with whom the corresponding processor agreements have been signed under art. 28 GDPR.
• External advisors (legal, tax, accounting) when strictly necessary to comply with legal obligations.

6. International data transfers

Some of the technology suppliers contracted by the Company may be located outside the European Economic Area. In these cases, adequate data protection is guaranteed through the safeguards provided for in articles 44 to 49 of the GDPR (adequacy decisions, standard contractual clauses, etc.).

7. Your rights

You can exercise the following rights at any time:

• Access: to know what data is being processed and for what purpose.
• Rectification: to request modification of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to request deletion of data when no longer necessary.
• Objection: to object to processing for reasons relating to your particular situation.
• Restriction of processing: to request the restriction of processing in certain cases.
• Portability: to receive your data in a structured, commonly used and machine-readable format.
• Withdrawal of consent: to revoke consent given, without affecting the lawfulness of prior processing.

To exercise these rights, you may send a written request, accompanied by a copy of your ID or equivalent document, to:

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe the processing does not comply with current regulations.

8. Security measures

The Company has implemented the technical and organisational measures necessary to guarantee the security of personal data and prevent its alteration, loss, unauthorised processing or access, in accordance with the state of the art, the nature of the data stored and the risks to which they are exposed.

9. Data of minors

The Website is not intended for minors under 14 years of age. The Company does not knowingly collect personal data from minors. If we become aware that data has been collected from a minor without parental or guardian consent, it will be deleted immediately.

10. Changes to this Privacy Policy

The Company reserves the right to modify this Privacy Policy to adapt to legislative or case-law developments, as well as to industry practices. Each change will be notified with reasonable notice before it comes into effect.