Sembi Comunicación S.L. (hereinafter, “the data controller”) is the entity responsible for processing personal data and the owner of the website https://sembi.es (hereinafter, “the website”).
The data controller guarantees the protection of all personal data that users provide through the website, as well as through applications developed by Sembi that integrate with third-party services, including Meta Platforms’ APIs (Facebook, Instagram, and WhatsApp Business Platform).
In compliance with the provisions of Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights, as well as Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter “GDPR”), the user is hereby informed that, by completing the forms or using the services offered, they give their express consent for the personal data provided to be included and processed in a record of processing activities under the responsibility of the data controller.
For customers, the processing of their personal data is based on the legal basis of the performance of the contract.
Owner’s identity: Sembi Comunicación S.L.
Tax ID Number: B95957130
Address: Calle Gardoki Kardenalaren 9, 2.º Derecha, 48008 Bilbao (Vizcaya), España
Email: info@sembi.es
Phone: 946 06 61 26 / 622 14 84 63
By completing the forms and other means of communication available on the website, the user gives their express consent for the requested personal data to be included in and processed in the record of processing activities maintained under the responsibility of the data controller.
For the purposes of current legislation, personal data provided through web forms will be processed as data pertaining to “Website Users” and/or “Customers and Suppliers.” The legal basis for the processing is, depending on the case, the data subject’s consent, the performance of a contract, or the legitimate interest of the data controller.
The personal data provided will be retained until the data subject requests its deletion and, where applicable, for the duration of the applicable legal retention periods (in particular, tax and commercial retention periods).
No special categories of personal data are processed through the website.
The website includes an SSL certificate. This is a security protocol that ensures that data transmitted between the server and the user is transmitted in its entirety and in an encrypted format.
The data collection forms, their purposes, and retention periods are as follows:
The information requested through the website is required to ensure optimal service. Failure to provide the required information may prevent us from providing all or part of the service.
The Company does not share, sell, or rent users’ personal information to third parties, except as provided in this policy or as required by law. However, it may share certain information with the authorized data processors identified below.
The legal basis for the data controller’s processing of personal data is, as applicable:
Appropriate technical and organizational measures have been implemented in the collection and processing of personal data to prevent its loss, unauthorized access, or tampering, in accordance with applicable law. The data subject agrees to protect any confidential information to which they have access.
The data controller undertakes not to share or disclose personal data to third parties without the user’s express consent, except where required by law or where necessary for the provision of the service through the data processors listed below.
The processing involves international transfers of personal data to entities whose registered offices are located outside the European Union, primarily in the United States, even though the data may be physically stored on servers located within the European Union.
These transfers result from the use of services provided by:
Although these providers primarily store data in European data centers, their U.S. parent company may be subject to laws that allow U.S. authorities to access the data, which is why these transfers are considered international for the purposes of the GDPR.
The appropriate safeguards in place for these transfers are:
In addition, the following providers are European entities that process data exclusively within the European Union, without involving any international transfers:
Under no circumstances will the transfer of this data involve any use that goes beyond the consent provided for the purposes and under the conditions set forth in this privacy policy.
If the user provides the data controller with personal data belonging to third parties, they do so at their own risk, declaring that they have obtained the express consent of such third parties and have previously informed them of the content of this clause. The data controller shall not be liable for the transfer of data belonging to third parties who have not given their consent.
If you do not provide the required information, some website features may not be available. Refusing to accept the cookie policy may result in the loss of certain website features.
The user certifies that he or she is at least 14 years of age and therefore has the legal capacity to consent to the processing of his or her personal data in accordance with this Privacy Policy.
In addition to the data processing resulting from browsing the website, Sembi Comunicación S.L. develops and operates applications that integrate with Meta Platforms’ APIs (Facebook, Instagram, and WhatsApp Business Platform) to provide lead management and automated communication services to its business clients.
When an administrator user connects their Meta account to a Sembi app using the Facebook Login for Business or WhatsApp Embedded Signup flows, the following data is processed:
In addition, Sembi’s applications process the following personal data of third parties (individuals who have interacted with the client’s advertising campaigns or communication channels) on behalf of its business clients:
With regard to the data of the administrator user who logs in to Sembi’s applications, the data controller is responsible for processing the data.
With regard to the data of leads and contacts processed on behalf of client companies, the data controller acts as a data processor on behalf of those companies, pursuant to a data processing agreement entered into with each client in accordance with Article 28 of the GDPR.
Any user can request the deletion of their data by following the procedure outlined on our Data Deletion page: https://sembi.es/eliminacion-datos/
To provide its services, Sembi Comunicación S.L. uses the following data processors, with whom it has entered into the corresponding contracts in accordance with Article 28 of the GDPR:
This list may be updated based on the data controller’s operational needs. Any user may request the updated and complete list of data processors by emailing info@sembi.es.
Users may exercise their rights of access, rectification, erasure, objection, restriction of processing, and data portability (ARCO-POL rights) at any time by contacting us at:
El interesado tiene derecho a recibir los datos personales que le conciernen, que haya facilitado a un responsable del tratamiento, en un formato estructurado, de uso común y legible por máquina, así como a transmitir dichos datos a otro responsable del tratamiento.
Under certain circumstances, data subjects may request that the processing of their data be restricted, in which case the data will be retained solely for the purpose of asserting or defending legal claims.
If consent has been given for a specific purpose, the data subject has the right to withdraw it at any time, without this affecting the lawfulness of the processing based on the consent given prior to its withdrawal.
Those affected may file a complaint with the Spanish Data Protection Agency (AEPD) through its website, www.aepd.es, if they have not received a satisfactory resolution regarding the exercise of their rights.
The data controller reserves the right to subcontract employees and/or third parties to provide various services, as well as to handle legal and data protection matters. In all such cases, the data controller will require the contracted company and the data processors to sign the corresponding data processing agreement and/or confidentiality agreement in accordance with Articles 28 and 32 of the GDPR.
The user consents to the disclosure of their personal data when required to do so by the competent administrative authorities or by court order.
The data controller reserves the right to modify this privacy policy to bring it into line with changes in legislation or case law, as well as with industry practices. In such cases, the data controller will post the changes on this page a reasonable amount of time before they take effect.
Responsible party: Sembi Comunicación S.L. (Tax ID No. B95957130)
Purpose: To provide the requested services, manage the contractual relationship, handle administrative, accounting, and tax matters, and send marketing communications about our products and services.
Legal basis: Performance of a contract; the controller’s legitimate interest in related marketing communications.
Recipients: Tax authorities and financial institutions, for the purpose of complying with legal and operational obligations. Data processors listed in Section 6.
International data transfers: These may occur as a result of using service providers headquartered outside the EU, as described in section 4.
Retention period: Until the data subject requests deletion and, where applicable, for the applicable statutory periods (five years for contracts; ten years for invoices).
Source: The individual concerned.
Rights: Access, rectification, erasure, objection, restriction, data portability, and withdrawal of consent. Please contact us at info@sembi.es or by mail.
No automated decisions will be made based on the data provided.
Responsible party: Sembi Comunicación S.L. (Tax ID No. B95957130)
Purpose: To respond to the data subject’s request and send them marketing communications, including via electronic means.
Legal basis: Pre-contractual processing of the request; consent of the data subject for marketing communications.
Recipients: No data will be disclosed to third parties except where required by law or to the data processors listed in section 6.
International data transfers: These may occur as a result of using service providers headquartered outside the EU, as described in section 4.
Retention period: Until the data subject requests its deletion.
Source: The individual concerned.
Rights: Access, rectification, erasure, objection, restriction, data portability, and withdrawal of consent. Please contact us at info@sembi.es or by mail.
No automated decisions will be made based on the data provided.
Responsible party: Sembi Comunicación S.L. (Tax ID No. B95957130)
Purpose: To authenticate the administrator user, authorize access to applications, link Meta assets (Pages, WABAs, Ad Accounts) to the corresponding workspace, and interact with Meta APIs to provide the service.
Legal basis: Performance of the contract with the client company; explicit consent from the user in the Facebook Login for Business / Embedded Signup flow; legitimate interest in the security of the infrastructure.
Recipients: Data processors listed in Section 6. Meta Platforms Ireland Ltd., as the provider of the APIs used.
International transfers: Yes, as described in section 4 (DPF and CCT as adequate safeguards).
Retention period: As long as the user maintains an active connection, or until the user requests that the connection be terminated or their data be deleted.
Source: The data subject, via Meta’s authentication flows.
Rights: Access, rectification, erasure, objection, restriction, data portability, and withdrawal of consent. Please contact info@sembi.es. You may also request data deletion at https://sembi.es/eliminacion-datos/.
No automated decisions with legal consequences will be made based on the data provided.
Data controller: The Sembi client company that created the advertising campaign or communication channel.
Data Processor: Sembi Comunicación S.L. (Tax ID No. B95957130), pursuant to the data processing agreement entered into with the client company in accordance with Article 28 of the GDPR.
Purpose: To receive, store, and make available to the client company the lead data generated by its Meta campaigns, as well as to facilitate the management of communications via WhatsApp Business and other channels.
Legal basis: The legal basis applicable to the client company as the data controller (typically, the lead’s consent when filling out the advertising form).
Rights: Data subjects must exercise their rights directly with the client company responsible for processing their data. If a request is mistakenly sent to Sembi, Sembi will forward it to the responsible party or direct the data subject to the correct channel.
Responsible party: Sembi Comunicación S.L. (Tax ID No. B95957130)
Purpose: To manage the provision of contracted services and handle the administrative, accounting, and tax matters associated with the relationship with the supplier and its contacts.
Legal Basis: Performance of a contract.
Recipients: Tax Administration and Financial Institutions.
International transfers: These are not normally required for this category, unless the provider itself operates from outside the EU, in which case the safeguards set forth in paragraph 4 shall apply.
Retention period: Until the data subject requests erasure and, where applicable, for the applicable statutory periods.
Source: The individual concerned.
Derechos: Acceso, rectificación, supresión, oposición, limitación, portabilidad y revocación del consentimiento, dirigiéndose a info@sembi.es o por correo postal.
If the data subject believes that their rights regarding the protection of their personal data have been violated, particularly if they have not received a satisfactory response when exercising those rights, they may file a complaint with the Spanish Data Protection Agency (AEPD), located at Calle Jorge Juan, 6, 28001 Madrid, or through its website at www.aepd.es
Last updated: May 11, 2026
Sembi Comunicación S.L. · Tax ID No. B95957130 · info@sembi.es
