Privacy Policies

MARCH 2025

WATER POSITIVE ADVISORS S.L. (hereinafter, AQUA POSITIVE) is committed to complying with Spanish and European regulations on personal data protection and guarantees full compliance with the obligations established, as well as the implementation of security measures set forth in the General Data Protection Regulation (GDPR) (EU) 2016/679, of April 27, and in Organic Law 3/2018, of December 5, on Personal Data Protection and the Guarantee of Digital Rights (LOPD-GDD, hereinafter LOPD).

In accordance with these regulations, we inform you that the use of our website may require the provision of certain personal data through contact forms or via email, which will be processed by AQUA POSITIVE, as the Data Controller, with the following details:

Company Name: WATER POSITIVE ADVISORS S.L.
Tax ID (C.I.F.): B7066217
Registered in: Madrid Commercial Registry, Volume 46359, Folio 181, Entry 1, Page M – 814265
Registered Address: C/ Villalar 7, 28001 Madrid
Email: contacto@aquapositive.com

Collection and Processing of Personal Data

Personal data is any information relating to an individual, including name, email, address, phone number, and ID number (NIF/NIE). Additionally, when a user visits our website, certain technical information is automatically stored for security and technical reasons, such as the IP address assigned by their Internet provider.

As the Data Controller, AQUA POSITIVE has a duty to inform users of its website about the collection of personal data, whether through email communication or by filling out forms included on the website.

Only the necessary data required to provide the requested service or to respond appropriately to the user’s request for information will be collected. The collected data is of an identifying nature and corresponds to the minimum necessary to carry out our activities. No specially protected data will be collected at any time. Under no circumstances will data be used for purposes other than those for which it was collected.

Contact Forms/Email

Purpose: To respond to your request for information made through our contact form(s).
Legal Basis: The legal basis that legitimizes this processing is the user’s consent, which may be revoked at any time.
Data Processing: Personal data will be processed through servers managed by OVH, which acts as the Data Processor.

Minors' Data

Only individuals over 14 years old may provide personal data on this website. According to the LOPD and GDPR, in the case of minors under 14, parental or guardian consent is mandatory before we can process their personal data.

Additionally, only individuals over 18 years old can contract our services. If the user is under 18, parental or legal guardian consent is required unless the minor is legally emancipated.

Security Measures

AQUA POSITIVE informs website users that it has implemented technical and organizational security measures to prevent the loss, misuse, alteration, unauthorized access, or theft of personal data, ensuring the confidentiality, integrity, and quality of the information in accordance with applicable data protection regulations.

The personal data collected in the forms is processed exclusively by AQUA POSITIVE personnel or designated Data Processors.

Accuracy of Data

The user declares that all data provided is true and accurate and commits to keeping it updated. The user is solely responsible for any disputes or legal issues resulting from false or inaccurate data. It is important that users notify AQUA POSITIVE of any modifications to their personal data.

Data Sharing

AQUA POSITIVE will not sell or share user data with third parties, except in cases required by law or when strictly necessary to provide a service. Specifically, data may be shared with:

IT service providers
Payment service providers
Courier and logistics companies
Third-party service providers acting on our behalf (e.g., accounting firms, legal consultants)

Data transfers will always be conducted with strict confidentiality, applying necessary safeguards such as confidentiality agreements or compliance with privacy policies established by third parties.

Additionally, in cases where required by law, customer data may be shared with public authorities such as the Spanish Tax Agency (Agencia Tributaria Española) or the Labor Inspectorate (Inspección de Trabajo).

Exercise of User Rights

The LOPD and GDPR grant data subjects the right to exercise a series of rights related to the processing of their personal data. To do so, the User must submit a request, along with documentation proving their identity (ID card or passport), via email to contact@aquapositive.com, or by written communication to the address specified in our Legal Notice. This communication must include the following information: the User’s full name, the purpose of the request, their address, and supporting documentation.

The exercise of rights must be carried out by the User. However, these rights may also be exercised by an authorized person acting as the User’s legal representative, provided that documentation proving such representation is provided.

The User may exercise the following rights:

Right of Access: The right to obtain information on whether their personal data is being processed, the purpose of such processing, the origin of the data, and any communications made or planned regarding the data.
Right of Rectification: The right to request correction of inaccurate or incomplete personal data or deletion of data that is inappropriate or excessive.
Right to Restrict Processing: The right to limit processing, in which case AQUA POSITIVE will only retain the data necessary for the exercise or defense of legal claims.
Right to Object to Processing: The right to prevent or stop the processing of personal data in cases where consent is not required, including marketing databases or decisions based solely on automated data processing, unless legitimate reasons or legal claims necessitate continued processing.
Right to Data Portability: The right to receive their data in a structured, commonly used, and machine-readable format, or to have their data transferred to another service provider.

If consent has been given for a specific purpose, the User has the right to withdraw consent at any time, without affecting the lawfulness of processing based on prior consent.

We commit to fulfilling these rights within the maximum legal period of one month. If a User believes there is an issue with how AQUA POSITIVE is handling their data, they may submit a complaint to the Security Officer or the relevant Data Protection Authority, which in Spain is the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

Data Retention

Personal data provided by Users through the contact form or email inquiries will be processed only for the time strictly necessary to respond to the request or until the given consent is revoked.

Customer personal data will be processed until the contractual relationship ends. The retention period for personal data will be kept to the minimum necessary and will be maintained according to the timeframes established by applicable laws, including:

4 years: Law on Social Order Infractions and Sanctions (employment-related obligations, registrations, deregistrations, contributions, salary payments, etc.); Articles 66 and following of the General Tax Law (accounting records).
5 years: Article 1964 of the Civil Code (personal actions without a special time limit).
6 years: Article 30 of the Commercial Code (accounting books, invoices).
10 years: Article 25 of the Law on the Prevention of Money Laundering and Terrorist Financing.
Indefinite: Aggregated and anonymized data.

Confidentiality

The information provided by the User will always be treated as confidential and will not be used for purposes other than those described herein. AQUA POSITIVE is committed to not disclosing or revealing any User information, including their inquiries, the reasons for seeking advisory services, or the duration of their relationship with AQUA POSITIVE.

Validity

This Privacy Policy was drafted on March 22, 2025, and may be updated in response to changes in legal or regulatory frameworks. It is the User’s responsibility to review this document periodically to stay informed about their rights and obligations at all times.