{"id":10266,"date":"2024-01-08T07:44:38","date_gmt":"2024-01-08T06:44:38","guid":{"rendered":"https:\/\/sembi.es\/privacy-policy\/"},"modified":"2026-05-27T12:01:01","modified_gmt":"2026-05-27T10:01:01","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/sembi.es\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t<\/path><\/svg>\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t

Privacy Policy<\/h1>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Sembi Comunicaci\u00f3n S.L. (hereinafter, \u201cthe data controller\u201d) is the entity responsible for processing personal data and the owner of the website https:\/\/sembi.es (hereinafter, \u201cthe website\u201d).<\/p>

The data controller guarantees the protection of all personal data that users provide through the website, as well as through applications developed by Sembi that integrate with third-party services, including Meta Platforms\u2019 APIs (Facebook, Instagram, and WhatsApp Business Platform).<\/p>

In compliance with the provisions of Organic Law 3\/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights, as well as Regulation (EU) 2016\/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter \u201cGDPR\u201d), the user is hereby informed that, by completing the forms or using the services offered, they give their express consent for the personal data provided to be included and processed in a record of processing activities under the responsibility of the data controller.<\/p>

For customers, the processing of their personal data is based on the legal basis of the performance of the contract.<\/p>

1. Identity of the data controller<\/h2>

Owner’s identity: Sembi Comunicaci\u00f3n S.L.<\/p>

Tax ID Number: <\/strong>B95957130<\/p>

Address: <\/strong>Calle Gardoki Kardenalaren 9, 2.\u00ba Derecha, 48008 Bilbao (Vizcaya), Espa\u00f1a<\/p>

Email: <\/strong>info@sembi.es<\/p>

Phone: <\/strong>946 06 61 26 \/ 622 14 84 63<\/p>

2. Purposes of processing and retention periods<\/h2>

By completing the forms and other means of communication available on the website, the user gives their express consent for the requested personal data to be included in and processed in the record of processing activities maintained under the responsibility of the data controller.<\/p>

For the purposes of current legislation, personal data provided through web forms will be processed as data pertaining to \u201cWebsite Users\u201d and\/or \u201cCustomers and Suppliers.\u201d The legal basis for the processing is, depending on the case, the data subject\u2019s consent, the performance of a contract, or the legitimate interest of the data controller. <\/p>

The personal data provided will be retained until the data subject requests its deletion and, where applicable, for the duration of the applicable legal retention periods (in particular, tax and commercial retention periods).<\/p>

No special categories of personal data are processed through the website.<\/p>

The website includes an SSL certificate. This is a security protocol that ensures that data transmitted between the server and the user is transmitted in its entirety and in an encrypted format. <\/p>

The data collection forms, their purposes, and retention periods are as follows:<\/p>

  • Collection and automated processing of personal data resulting from browsing the website (see the cookie policy).<\/li>
  • Customer relationship. <\/strong>Data will be retained for as long as necessary to fulfill the purpose of processing. Contracts and invoices will be retained for five and ten years, respectively. <\/li>
  • To respond to, manage, and resolve inquiries, questions, proposals, requests for quotes, and any other information requested by the data subject via the contact form. Retention period: for the duration of the inquiry\u2019s processing, unless a prior request for deletion is made. <\/li>
  • Subscription to services. <\/strong>Collection and automated processing of personal data resulting from a request for or subscription to the services offered by the data controller. Retention period: for the duration of the processing, unless a request for deletion is made in advance. <\/li>
  • Contact us via WhatsApp. <\/strong>Address inquiries and questions submitted by the data subject through this channel. Retention period: for the duration of the processing, unless a request for deletion is made in advance. <\/li>
  • Google Analytics. <\/strong>Analysis of user behavior, demographic characteristics, and traffic patterns to better understand the audience and optimize the user experience and advertising.<\/li>
  • Google Fonts. <\/strong>Certain data (such as your IP address) may be processed in order to provide the service properly.<\/li>
  • Facebook Ads and Meta Pixel. <\/strong>Acquiring subscribers and customers through targeted advertising (location, demographics, interests, etc.) and remarketing. This information is collected using Facebook cookies, which users can disable through the Network Advertising Initiative. <\/li><\/ul>

    The information requested through the website is required to ensure optimal service. Failure to provide the required information may prevent us from providing all or part of the service. <\/p>

    The Company does not share, sell, or rent users\u2019 personal information to third parties, except as provided in this policy or as required by law. However, it may share certain information with the authorized data processors identified below. <\/p>

    3. Legal Basis for the Processing of Personal Data<\/h2>

    The legal basis for the data controller\u2019s processing of personal data is, as applicable:<\/p>

    • The data subject\u2019s express, free, specific, informed, and unambiguous consent, provided through forms or authentication workflows.<\/li>
    • The performance of the contract entered into with the customer for the provision of Sembi’s services.<\/li>
    • The data controller\u2019s legitimate interest in ensuring the security of its infrastructure, preventing abuse, and sending commercial communications related to its own services.<\/li>
    • Compliance with legal obligations applicable to the data subject.<\/li><\/ul>

      Appropriate technical and organizational measures have been implemented in the collection and processing of personal data to prevent its loss, unauthorized access, or tampering, in accordance with applicable law. The data subject agrees to protect any confidential information to which they have access. <\/p>

      4. Recipients and Disclosures<\/h2>

      The data controller undertakes not to share or disclose personal data to third parties without the user\u2019s express consent, except where required by law or where necessary for the provision of the service through the data processors listed below.<\/p>

      International data transfers<\/h3>

      The processing involves international transfers of personal data to entities whose registered offices are located outside the European Union, primarily in the United States, even though the data may be physically stored on servers located within the European Union.<\/p>

      These transfers result from the use of services provided by:<\/p>

      • Meta Platforms Ireland Ltd. (Ireland), a subsidiary of Meta Platforms Inc. (U.S.) \u2014 Facebook, Instagram, and WhatsApp Business Platform APIs. <\/li>
      • Google Ireland Ltd. (Ireland), a subsidiary of Alphabet Inc. (U.S.) \u2014 Google Analytics and Google Tag Manager services. <\/li><\/ul>

        Although these providers primarily store data in European data centers, their U.S. parent company may be subject to laws that allow U.S. authorities to access the data, which is why these transfers are considered international for the purposes of the GDPR.<\/p>

        The appropriate safeguards in place for these transfers are:<\/p>

        • EU-US Data Privacy Framework (DPF): a data protection framework approved by the European Commission on July 10, 2023, to which the aforementioned providers have committed.<\/li>
        • Standard Contractual Clauses (SCCs) approved by the European Commission, applicable to suppliers not participating in the DPF.<\/li>
        • Where applicable, the user\u2019s explicit consent, following disclosure of any potential risks, in accordance with Article 49 of the GDPR.<\/li><\/ul>

          In addition, the following providers are European entities that process data exclusively within the European Union, without involving any international transfers:<\/p>

          • Webempresa Europa S.L. (Spain) \u2014 Hosting for the corporate website sembi.es. Privacy policy: https:\/\/www.webempresa.com\/aviso-legal.html <\/li>
          • Hostinger International Ltd. (Lithuania \/ Cyprus) \u2014 Hosting for applications developed by Sembi, in a European data center.<\/li><\/ul>

            Under no circumstances will the transfer of this data involve any use that goes beyond the consent provided for the purposes and under the conditions set forth in this privacy policy.<\/p>

            Other forecasts<\/h3>

            If the user provides the data controller with personal data belonging to third parties, they do so at their own risk, declaring that they have obtained the express consent of such third parties and have previously informed them of the content of this clause. The data controller shall not be liable for the transfer of data belonging to third parties who have not given their consent. <\/p>

            If you do not provide the required information, some website features may not be available. Refusing to accept the cookie policy may result in the loss of certain website features. <\/p>

            The user certifies that he or she is at least 14 years of age and therefore has the legal capacity to consent to the processing of his or her personal data in accordance with this Privacy Policy.<\/p>

            5. Sembi Apps and Use of Meta APIs<\/h2>

            In addition to the data processing resulting from browsing the website, Sembi Comunicaci\u00f3n S.L. develops and operates applications that integrate with Meta Platforms\u2019 APIs (Facebook, Instagram, and WhatsApp Business Platform) to provide lead management and automated communication services to its business clients.<\/p>

            5.1. Data processed<\/h3>

            When an administrator user connects their Meta account to a Sembi app using the Facebook Login for Business or WhatsApp Embedded Signup flows, the following data is processed:<\/p>

            • Meta user ID (Facebook ID), name, and email address.<\/li>
            • User-managed Facebook Page IDs.<\/li>
            • Ad account IDs managed by the user.<\/li>
            • WhatsApp Business Account (WABA) identifiers and associated phone numbers.<\/li>
            • Access tokens required to interact with Meta’s APIs.<\/li><\/ul>

              In addition, Sembi\u2019s applications process the following personal data of third parties (individuals who have interacted with the client\u2019s advertising campaigns or communication channels) on behalf of its business clients:<\/p>

              • Identifying information (first name, last name).<\/li>
              • Contact information (email, phone).<\/li>
              • Responses to Facebook Lead Ads forms.<\/li>
              • Messages exchanged via the WhatsApp Business Platform.<\/li>
              • Associated metadata (campaign, ad, and form identifiers, date, etc.).<\/li><\/ul>

                5.2. Purposes of the processing<\/h3>
                • Authenticate the administrator user and grant access to Sembi applications.<\/li>
                • Receive and store the leads generated by the client’s Meta campaigns.<\/li>
                • Send and receive WhatsApp Business messages on behalf of the client.<\/li>
                • Show the client advertising and customer acquisition performance metrics.<\/li>
                • Enable the customer and their agents to manage the conversations and contacts generated.<\/li><\/ul>

                  5.3. Legal Basis<\/h3>
                  • Performance of the contract entered into between Sembi and the client company.<\/li>
                  • Explicit consent from the administrator user, granted during the Embedded Signup or Facebook Login for Business process.<\/li>
                  • Legitimate interest in ensuring the security of the infrastructure and preventing abuse.<\/li><\/ul>

                    5.4. Sembi’s stance on the treatment<\/h3>

                    With regard to the data of the administrator user who logs in to Sembi\u2019s applications, the data controller is responsible for processing the data.<\/p>

                    With regard to the data of leads and contacts processed on behalf of client companies, the data controller acts as a data processor on behalf of those companies, pursuant to a data processing agreement entered into with each client in accordance with Article 28 of the GDPR.<\/p>

                    5.5. Specific retention periods<\/h3>
                    • Access tokens: as long as the user keeps the connection active or until they request to log out.<\/li>
                    • Lead data: for the duration of the contract with the customer, plus the applicable statutory retention periods following termination.<\/li>
                    • Data deleted at the request of the data subject: within a maximum period of 30 days, in accordance with Article 12 of the GDPR.<\/li><\/ul>

                      5.6. Data Deletion<\/h3>

                      Any user can request the deletion of their data by following the procedure outlined on our Data Deletion page: https:\/\/sembi.es\/eliminacion-datos\/<\/p>

                      6. Data processors<\/h2>

                      To provide its services, Sembi Comunicaci\u00f3n S.L. uses the following data processors, with whom it has entered into the corresponding contracts in accordance with Article 28 of the GDPR:<\/p>

                      • Webempresa Europa S.L. (Spain) \u2014 Hosting for the corporate website sembi.es.<\/li>
                      • Hostinger International Ltd. (Lithuania \/ EU) \u2014 Hosting for applications developed by Sembi.<\/li>
                      • Meta Platforms Ireland Ltd. (Ireland \/ EU) and its subsidiaries \u2014 Provider of the Facebook, Instagram, and WhatsApp Business Platform APIs.<\/li>
                      • Google Ireland Ltd. (Ireland \/ EU) \u2014 Google Analytics and Google Tag Manager services for web traffic analysis.<\/li><\/ul>

                        This list may be updated based on the data controller\u2019s operational needs. Any user may request the updated and complete list of data processors by emailing info@sembi.es. <\/p>

                        7. Rights of Data Subjects<\/h2>

                        Users may exercise their rights of access, rectification, erasure, objection, restriction of processing, and data portability (ARCO-POL rights) at any time by contacting us at:<\/p>

                        • Email: <\/strong>info@sembi.es<\/li>
                        • Mailing address: 9 Gardoki Kardenalaren Street, 2nd Floor, Right, 48008 Bilbao (Biscay)<\/li><\/ul>

                          El interesado tiene derecho a recibir los datos personales que le conciernen, que haya facilitado a un responsable del tratamiento, en un formato estructurado, de uso com\u00fan y legible por m\u00e1quina, as\u00ed como a transmitir dichos datos a otro responsable del tratamiento.<\/p>

                          Under certain circumstances, data subjects may request that the processing of their data be restricted, in which case the data will be retained solely for the purpose of asserting or defending legal claims.<\/p>

                          If consent has been given for a specific purpose, the data subject has the right to withdraw it at any time, without this affecting the lawfulness of the processing based on the consent given prior to its withdrawal.<\/p>

                          Those affected may file a complaint with the Spanish Data Protection Agency (AEPD) through its website, www.aepd.es, if they have not received a satisfactory resolution regarding the exercise of their rights.<\/p>

                          8. Subcontracting and Modifications<\/h2>

                          The data controller reserves the right to subcontract employees and\/or third parties to provide various services, as well as to handle legal and data protection matters. In all such cases, the data controller will require the contracted company and the data processors to sign the corresponding data processing agreement and\/or confidentiality agreement in accordance with Articles 28 and 32 of the GDPR. <\/p>

                          The user consents to the disclosure of their personal data when required to do so by the competent administrative authorities or by court order.<\/p>

                          The data controller reserves the right to modify this privacy policy to bring it into line with changes in legislation or case law, as well as with industry practices. In such cases, the data controller will post the changes on this page a reasonable amount of time before they take effect. <\/p>

                          9. Specific processing activities by data subject category<\/h2>

                          9.1. Processing of Customer Data<\/h3>

                          Responsible party: Sembi Comunicaci\u00f3n S.L. (Tax ID No. B95957130)<\/p>

                          Purpose: To provide the requested services, manage the contractual relationship, handle administrative, accounting, and tax matters, and send marketing communications about our products and services.<\/p>

                          Legal basis: Performance of a contract; the controller\u2019s legitimate interest in related marketing communications.<\/p>

                          Recipients: Tax authorities and financial institutions, for the purpose of complying with legal and operational obligations. Data processors listed in Section 6. <\/p>

                          International data transfers: These may occur as a result of using service providers headquartered outside the EU, as described in section 4.<\/p>

                          Retention period: Until the data subject requests deletion and, where applicable, for the applicable statutory periods (five years for contracts; ten years for invoices).<\/p>

                          Source: The individual concerned.<\/p>

                          Rights: Access, rectification, erasure, objection, restriction, data portability, and withdrawal of consent. Please contact us at info@sembi.es or by mail.<\/p>

                          No automated decisions will be made based on the data provided.<\/p>

                          9.2. Processing of data on potential customers and website contacts<\/h3>

                          Responsible party: Sembi Comunicaci\u00f3n S.L. (Tax ID No. B95957130)<\/p>

                          Purpose: To respond to the data subject\u2019s request and send them marketing communications, including via electronic means.<\/p>

                          Legal basis: Pre-contractual processing of the request; consent of the data subject for marketing communications.<\/p>

                          Recipients: No data will be disclosed to third parties except where required by law or to the data processors listed in section 6.<\/p>

                          International data transfers: These may occur as a result of using service providers headquartered outside the EU, as described in section 4.<\/p>

                          Retention period: Until the data subject requests its deletion.<\/p>

                          Source: The individual concerned.<\/p>

                          Rights: Access, rectification, erasure, objection, restriction, data portability, and withdrawal of consent. Please contact us at info@sembi.es or by mail.<\/p>

                          No automated decisions will be made based on the data provided.<\/p>

                          9.3. Processing of User Data for Sembi Application Administrators<\/h3>

                          Responsible party: Sembi Comunicaci\u00f3n S.L. (Tax ID No. B95957130)<\/p>

                          Purpose: To authenticate the administrator user, authorize access to applications, link Meta assets (Pages, WABAs, Ad Accounts) to the corresponding workspace, and interact with Meta APIs to provide the service.<\/p>

                          Legal basis: Performance of the contract with the client company; explicit consent from the user in the Facebook Login for Business \/ Embedded Signup flow; legitimate interest in the security of the infrastructure.<\/p>

                          Recipients: Data processors listed in Section 6. Meta Platforms Ireland Ltd., as the provider of the APIs used. <\/p>

                          International transfers: Yes, as described in section 4 (DPF and CCT as adequate safeguards).<\/p>

                          Retention period: As long as the user maintains an active connection, or until the user requests that the connection be terminated or their data be deleted.<\/p>

                          Source: The data subject, via Meta’s authentication flows.<\/p>

                          Rights: Access, rectification, erasure, objection, restriction, data portability, and withdrawal of consent. Please contact info@sembi.es. You may also request data deletion at https:\/\/sembi.es\/eliminacion-datos\/. <\/p>

                          No automated decisions with legal consequences will be made based on the data provided.<\/p>

                          9.4. Processing of lead data and end-contact data (customers of client companies)<\/h3>

                          Data controller: The Sembi client company that created the advertising campaign or communication channel.<\/p>

                          Data Processor: Sembi Comunicaci\u00f3n S.L. (Tax ID No. B95957130), pursuant to the data processing agreement entered into with the client company in accordance with Article 28 of the GDPR.<\/p>

                          Purpose: To receive, store, and make available to the client company the lead data generated by its Meta campaigns, as well as to facilitate the management of communications via WhatsApp Business and other channels.<\/p>

                          Legal basis: The legal basis applicable to the client company as the data controller (typically, the lead\u2019s consent when filling out the advertising form).<\/p>

                          Rights: Data subjects must exercise their rights directly with the client company responsible for processing their data. If a request is mistakenly sent to Sembi, Sembi will forward it to the responsible party or direct the data subject to the correct channel. <\/p>

                          9.5. Processing of Supplier Data<\/h3>

                          Responsible party: Sembi Comunicaci\u00f3n S.L. (Tax ID No. B95957130)<\/p>

                          Purpose: To manage the provision of contracted services and handle the administrative, accounting, and tax matters associated with the relationship with the supplier and its contacts.<\/p>

                          Legal Basis: Performance of a contract.<\/p>

                          Recipients: Tax Administration and Financial Institutions.<\/p>

                          International transfers: These are not normally required for this category, unless the provider itself operates from outside the EU, in which case the safeguards set forth in paragraph 4 shall apply.<\/p>

                          Retention period: Until the data subject requests erasure and, where applicable, for the applicable statutory periods.<\/p>

                          Source: The individual concerned.<\/p>

                          Derechos: <\/strong>Acceso, rectificaci\u00f3n, supresi\u00f3n, oposici\u00f3n, limitaci\u00f3n, portabilidad y revocaci\u00f3n del consentimiento, dirigi\u00e9ndose a info@sembi.es o por correo postal.<\/p>

                          10. Complaints to the supervisory authority<\/h2>

                          If the data subject believes that their rights regarding the protection of their personal data have been violated, particularly if they have not received a satisfactory response when exercising those rights, they may file a complaint with the Spanish Data Protection Agency (AEPD), located at Calle Jorge Juan, 6, 28001 Madrid, or through its website at www.aepd.es<\/p>

                          Last updated: May 11, 2026<\/em><\/p>

                          Sembi Comunicaci\u00f3n S.L. \u00b7 Tax ID No. B95957130 \u00b7 info@sembi.es<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n

                          \n\n\t\t\n
                            \n\t\t\t <\/ul>\n <\/div> \n","protected":false},"excerpt":{"rendered":"

                            Privacy Policy Sembi Comunicaci\u00f3n S.L. (hereinafter, \u201cthe data controller\u201d) is the entity responsible for processing personal data and the owner of the website https:\/\/sembi.es (hereinafter, \u201cthe website\u201d). The data controller guarantees the protection of all personal data that users provide through the website, as well as through applications developed by Sembi that integrate with third-party […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"postBodyCss":"","postBodyMargin":[],"postBodyPadding":[],"postBodyBackground":{"backgroundType":"classic","gradient":""},"footnotes":""},"class_list":["post-10266","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/sembi.es\/en\/wp-json\/wp\/v2\/pages\/10266","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sembi.es\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sembi.es\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sembi.es\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sembi.es\/en\/wp-json\/wp\/v2\/comments?post=10266"}],"version-history":[{"count":0,"href":"https:\/\/sembi.es\/en\/wp-json\/wp\/v2\/pages\/10266\/revisions"}],"wp:attachment":[{"href":"https:\/\/sembi.es\/en\/wp-json\/wp\/v2\/media?parent=10266"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}