Privacy Policy

Version October 2026

1. Legal references

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

LOPDgdd: Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights.

LSSI: Spanish Law 34/2002 of 11 July on information society services and electronic commerce.

2. Data controller

• Company name: SENSORY VALUE S.L. (“Sensory Value” or “we”).
• Address: C/ Toledo, 10, Casa 1, 08195 Sant Cugat del Vallès (Barcelona, Spain).
• Tax ID (NIF): B75270009.
• Email: info@sensoryvalue.com.

3. Sources and categories of data

We will process the data you provide to us through the Website’s contact form, by email or by telephone, and the data generated while handling your enquiry. We may also obtain professional contact data from the sources indicated below. Specifically:

• Contact form data: name and email address, which are mandatory, and, where applicable, company, product category, services of interest and the content of your enquiry. We also record that you have read the Privacy Policy and the language of the form. Please do not include personal information that is not necessary to handle your enquiry.
• Correspondence data: the data you provide to us by email or by telephone (for example, job title or contact telephone number) and the data generated in following up your enquiry.
• Candidate data: the data in the CV and message you send us with your application, including applications to the trained panel. Please do not include health data.
• Technical data: the data necessary to browse the Website and submit the form.
• Professional contact data for prospecting: first name and surname, job title or role, company and professional contact details, obtained at industry trade fairs, on LinkedIn or on corporate websites.

By providing us with your data, you guarantee that it is true and accurate. If you provide us with the data of third parties (for example, other professionals in your company), you guarantee that you have informed them and that you are entitled to do so.

4. Purposes and legal bases of processing

Handling your enquiry

Purpose: To handle the enquiries and requests for information or proposals you send us through the contact form, by email or by telephone, and to follow them up.

Legal basis: Art. 6(1)(f) GDPR and Art. 19 LOPDgdd; or Art. 6(1)(b) GDPR. Legitimate interest in handling the enquiries of companies that contact us and in keeping in touch with their professionals. Where you request a proposal to contract in your own name, steps taken at your request prior to entering into a contract.

Managing the business relationship

Purpose: Where your company contracts the Services, to manage the relationship with you as its contact person or representative, including invoicing. If you contract in your own name, to manage the contractual relationship with you.

Legal basis: Arts. 6(1)(b), 6(1)(c) and 6(1)(f) GDPR. Legitimate interest in maintaining the relationship with our clients’ contact persons. If you contract in your own name, performance of the contract. In both cases, compliance with legal obligations (accounting, tax, etc.).

Recruitment of staff and of the trained panel

Purpose: To receive and assess the applications you send us by email and, where applicable, to contact you to take part in a selection process. If you expressly authorise us to do so, to keep your application for future processes. Any subsequent collection of health data for the selection of the trained panel will be specifically notified before the first interview.

Legal basis: Arts. 6(1)(b) and 6(1)(a) GDPR. Steps taken at the data subject’s request prior to entering into a contract, to assess the application you send us. Your consent, which we will request separately, to keep it for future processes. The processing of information on food allergies or intolerances at the interview stage will be governed by the specific information we will provide to you before collecting it.

Professional prospecting

Purpose: To identify companies and professionals who may be interested in our Services and to establish business contacts related to their professional activity, by telephone, at industry trade fairs or through professional networks. You may object at any time by writing to info@sensoryvalue.com. Electronic commercial communications are subject to the conditions in the following section.

Legal basis: Art. 6(1)(f) GDPR and Art. 19 LOPDgdd. Legitimate interest in establishing business relationships with companies, sole traders and professionals. We will limit processing to the data necessary to locate you professionally and to contacts related to your activity. We will respect your objection and the rules applicable to each channel, including the requirements for commercial calls and advertising opt-out systems.

E-marketing

Purpose: To send you, by email or equivalent electronic means, commercial information about our Services, studies or events, where the conditions set out in this section are met. You may object or withdraw your consent by following the instructions in each communication or by writing to us at info@sensoryvalue.com.

Legal basis: Arts. 6(1)(a) and 6(1)(f) GDPR and Art. 21 LSSI. If you are not a client, we will only send you electronic commercial communications that you have previously requested or expressly authorised. If there is a prior contractual relationship and we have lawfully obtained your contact details, we may send you information about our own products or services similar to those contracted, on the basis of our legitimate interest and the exception in Art. 21(2) LSSI. In this case you may object when your data is collected and in each communication. The publication of your details on LinkedIn or on a corporate website, or obtaining them at a trade fair, does not in itself amount to authorisation to send you electronic advertising.

Social networks

Purpose: To manage our social media profiles (for example, LinkedIn) and interact with other users.

Legal basis: Art. 6(1)(f) and (b) GDPR. Our legitimate interest in managing our social media profiles and interacting with other users.

Security

Purpose: To ensure the security of the Website and the contact form, prevent misuse and manage incidents.

Legal basis: Art. 6(1)(f) GDPR. Legitimate interest in protecting the Website, its Users and their data.

Regulatory compliance

Purpose: To respond to requests from authorities and comply with applicable legal obligations.

Legal basis: Art. 6(1)(c) GDPR. Compliance with legal obligations.

5. Data retention

5.1. Enquiry data will be kept for as long as necessary to handle the enquiry and, if it does not lead to a business relationship, for a maximum of twelve (12) months from the last communication. After that period, it will be kept blocked for the limitation periods of any actions that may arise, in accordance with section 5.6.

5.2. Data linked to a business relationship will be kept for as long as the relationship continues and, once it has ended, for the retention periods required by commercial and tax law and the limitation periods of any actions that may arise from the relationship.

5.3. Applications will be kept for the duration of the relevant selection process. If you have expressly authorised us, in response to our request, to keep your application for future processes, we will keep it for a maximum of two (2) years from receipt, unless you withdraw your consent earlier. Otherwise, it will be deleted once the process has ended or, if there is no open process, once it has been assessed.

5.4. The form’s technical logs are kept for thirty (30) days and contain no personal data. We do not keep personal access logs for the Website. If we change this practice, we will update this Policy before starting the new processing and will state its purpose, legal basis and retention period.

5.5. Data processed for prospecting and commercial communications will be kept for as long as it is necessary for those purposes and remains relevant, or until you object or withdraw your consent. We may keep the minimum data necessary to record your objection and avoid further commercial contact.

5.6. Once the above periods have expired, we will delete your data, without prejudice to keeping it duly blocked for the statutory limitation periods, solely to meet potential liabilities (Art. 32 LOPDgdd).

6. Recipients

We will only disclose your data to third parties where necessary in the following cases:

• Providers: providers that need access to your data in order to provide their services to us. We use Amazon Web Services (AWS) to host the Website, process the form and send your messages by email; and Microsoft 365 for the info@sensoryvalue.com mailbox, where we receive and manage enquiries and applications. IT maintenance and web development providers, as well as advisers, may also access the data where necessary. These providers act as data processors and may use sub-processors with the safeguards of Art. 28 GDPR, except advisers acting as independent controllers to fulfil their own legal or professional obligations.
• Authorities: we will share your data with third parties if required to do so by law or by an administrative or judicial authority.
• Corporate transactions: in the event of a corporate restructuring, merger, demerger or sale, we may transfer your information to the third party resulting from that transaction in accordance with Article 21 LOPDgdd.

7. How do we protect your personal data?

We take all reasonable and appropriate technical and organisational measures to protect the security of your personal data in the course of our activity, taking into account the risks associated with the processing activities carried out. These measures include, for example, restricted access, encryption, antivirus software and regular testing and assessment, including an annual cybersecurity review carried out by a specialised external company.

8. International transfers

As a general rule, your data is processed within the European Economic Area. However, some technology providers, such as some email providers and corporate tools, may process data outside the European Economic Area. In that case, such transfers will be made with the appropriate safeguards provided for in the GDPR, such as adequacy decisions of the European Commission (for example, Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework, for certified entities) or standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914.

9. Rights

What rights do you have?

As provided for in the GDPR and the LOPDgdd, we inform you that you have the following rights:

• Access: you have the right to know whether we process personal data concerning you and, if so, to access it and obtain a copy.
• Rectification: you have the right to ask us to rectify inaccurate personal data concerning you and to complete incomplete data.
• Erasure: you have the right to ask us to erase your personal data in certain circumstances; for example, when it is no longer necessary for the purposes for which it was collected or when you withdraw your consent.
• Restriction: in certain circumstances, you have the right to ask us to restrict the processing of your data; for example, while we verify its accuracy or resolve your objection. In that case, other than for storage, we will only process it with your consent or in the other cases provided for in Art. 18 GDPR, such as the establishment, exercise or defence of legal claims.
• Objection: in certain circumstances and on grounds relating to your particular situation, you have the right to object to the processing of your data, in which case we would stop processing it except for compelling legitimate grounds or for the establishment, exercise or defence of legal claims. You may object to receiving commercial communications at any time.
• Portability: you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller, where we process it by automated means on the basis of your consent or a contract.
• Right not to be subject to a decision based solely on automated processing: you have the right to ask not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, where the legal requirements are not met.

How can you exercise your rights?

You can exercise your rights at any time by contacting the Controller (Sensory Value) as indicated in Section 2, writing “Privacy” in the subject line, at info@sensoryvalue.com.

Exercising these rights is free of charge. However, please note that a fee may be charged where requests are manifestly unfounded, excessive or repetitive.

Do you have the right to withdraw your consent?

Yes, you may at any time withdraw your consent to the processing of your data for one, several or all of the purposes indicated above that are based on consent, without affecting the lawfulness of processing carried out before its withdrawal.

Do you have the right to lodge a complaint?

Yes, you may at any time lodge a complaint with the competent supervisory authority according to your place of residence. In Spain, this is the Spanish Data Protection Agency (AEPD). You can find out about the different supervisory authorities by contacting us.

In any event, before lodging any complaint, we ask you to contact us by email at info@sensoryvalue.com so that we can try to resolve any disagreement or dispute amicably.

How soon will we reply?

We will reply to your requests as soon as possible and in any event within one (1) month, which may be extended in the cases provided for in Art. 12(3) GDPR, in which case we would inform you. If this is not the case, please accept our apologies and contact us again so that we can assist you and correct any technical error that may have prevented us from replying in time.

10. How do we keep this Privacy Policy up to date?

We may need to update this Privacy Policy from time to time and, when we do, we will revise the date shown at the beginning to reflect the date of the update. If we make any substantial change to the way we collect, process and/or share the personal data you have provided to us, we will endeavour to notify you before those changes take effect, for example by publishing a prominent notice on our Website.

We recommend that you review this page periodically for the latest information on our privacy practices.

11. Contact

You can contact us by email at info@sensoryvalue.com.