Privacy Notice

Last updated: September 2026. This notice follows the structure required by the General Data Protection Regulation (GDPR, EU 2016/679).

1. Data controller

[Invest Oil — legal name, company registration number and registered address pending]. Contact: contacto@investoil.es. Data Protection Officer (if applicable): [to be appointed].

2. Data we process

Through the contact form and the booking block we process: name, email address, phone number (if provided), subject and message content. We do not request bank details or special categories of data through this website.

3. Purpose and legal basis

We process your data to respond to your business enquiries and, where applicable, manage bookings, based on the consent given when submitting the form (Art. 6(1)(a) GDPR) and our legitimate interest in handling contact requests (Art. 6(1)(f) GDPR).

4. Retention

We retain data for as long as the business or pre-contractual relationship lasts, and afterwards for the applicable legal limitation periods.

5. Recipients and international transfers

We do not share your data with third parties except where legally required. If you use the CRM webhook or analytics tools configured by Invest Oil (see the Cookie Policy), those providers may act as data processors, including, where applicable, international transfers covered by GDPR safeguards (standard contractual clauses).

6. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to contacto@investoil.es. You have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of your country of residence within the European Economic Area.

7. Security

We apply reasonable technical and organisational measures (security-token forms, encrypted HTTPS connection) to protect your data against unauthorised access.

8. Minors

This site is aimed at a professional audience and is not intended for minors.

Notice: this document is a good-faith standard template based on the GDPR. It does not constitute legal advice; it must be reviewed by a lawyer or DPO before final publication, completing the controller’s real identifying details and confirming which external providers (analytics, CRM) are actually active.