PRIVACY POLICY
The purpose of this Privacy Policy is to inform data subjects about the different processing activities carried out by the organizations responsible through the website that affect their personal data, all in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights.
Company name: Administrador de Infraestructuras Ferroviarias
NIF/VAT: Q2801660H
Address: Calle Sor Ángela de la Cruz, 3. 28020 Madrid
Contact: dpd.adif@adif.es
Privacy policy: Personal Data Protection Policy - ADIF Spain
FOUNDSPOT, S.L., with registered address at C/ Alameda No. 22 (28014) Madrid, NIF B87946877, WEBSITE: www.foundspot.com and email address info@foundspot.com. Foundspot's Data Protection Officer: SEGURIDAD Y PRIVACIDAD DE DATOS, SL, email address infodpo@forlopd.es
□ WEBSITE USERS/VISITORS / CUSTOMERS
We will process the personal data provided for the following purposes:
● To handle requests, complaints and incidents submitted through the contact channels available on our website, on the basis of our legitimate interest and compliance with legal obligations.
● To comply with the legal obligations directly applicable to us.
● To protect and exercise our rights or respond to claims of any kind, on the basis of our legitimate interest in protecting our image, business and reputation.
● Where applicable, to send satisfaction and/or quality surveys on the basis of our legitimate interest in evaluating the service provided.
● To manage the return of the identified item on the basis of the performance of the contract entered into.
□ WEBSITE USERS/VISITORS
● We will process the personal data provided to understand visitors' behavior on the website in order to identify and prevent possible cyberattacks against the website, on the basis of our legitimate interest in ensuring the security of the platform, protecting users' data and preserving the integrity of our systems.
● To manage your registration on the entity's web platform and create a username and password on the basis of your consent. Refusal to provide such authorization will make it impossible to register.
□ CUSTOMERS
In addition to the purposes set out in the section "website users/visitors", we will process the personal data provided to carry out procedures related to the shipment of the identified item and to perform the associated administrative, accounting and tax procedures, all on the basis of the performance of the contract entered into and compliance with the legal obligations associated with that contractual relationship.
As part of our services, we use the Redsys payment gateway to process financial transactions and ensure that your payments are made securely and efficiently. We recommend that you review the Redsys privacy policy beforehand to understand how they handle your personal information by clicking here.
The personal data provided will be retained for as long as necessary to fulfill the purposes for which it was initially collected.
Once the data is no longer necessary for the processing in question, it will be duly blocked and, where applicable, made available to the competent Public Administrations and Public Bodies, Judges and Courts or the Public Prosecutor's Office, for the limitation period applicable to any legal actions that may arise from the relationship maintained with the customer and/or for the legally established retention periods.
Data blocking period:
● THE CIVIL CODE. Between 1 and 5 years, depending on the case, in accordance with Articles 1964.2 and 1968.2 of the aforementioned legislation.
● THE COMMERCIAL CODE. For 6 years, in accordance with Article 30 of the aforementioned legislation. This applies to commercial information relating to issued and received invoices, receipts, amended invoices, bank documents, etc.
● THE GENERAL TAX LAW. For 4 years, in accordance with Articles 66 to 70 of the aforementioned legislation. This applies to information relating to tax obligations.
The website does not make automated decisions or create profiles.
During the period for which your personal data is processed, the organization may disclose your data to the following recipients:
● Judges and Courts.
● State Security Forces and Corps.
● Other competent public authorities or bodies, where the controller is legally required to provide personal data.
● Banks and Financial Institutions.
● Courier companies for the delivery of the identified item.
The organization does not carry out any International Data Transfers. If international transfers subsequently become necessary, the level of protection of the destination country will be verified and the safeguards required by applicable regulations will be adopted.
For the purpose of involving you in our activities and keeping you informed of our news, we inform you that FOUNDSPOT, S.L. has profiles on Social Media.
All users have the opportunity to join our social media pages or groups. However, you should bear in mind that, unless we request your data directly (for example, through marketing activities, competitions, promotions, or any other valid means), your data will belong to the relevant Social Network. We therefore recommend that you carefully read its terms of use and privacy policies and make sure to configure your preferences regarding the processing of your data.
Below, we provide links to the privacy policies of the various Social Networks in which we have a presence, so that you can access their policies at any time and configure your profile to protect your privacy:
Facebook: https://es-es.facebook.com/privacy/policy/?entry_point=facebook_page_footer
Twitter: https://twitter.com/es/privacy
Instagram: https://privacycenter.instagram.com/
LinkedIn: https://es.linkedin.com/legal/privacy-policy
Data subjects may request further information about the processing of their personal data and may exercise, at any time and free of charge, their rights of access, rectification and erasure, as well as request restriction of the processing of their personal data, object to such processing, request data portability (where technically possible), withdraw their consent and, where applicable, not be subject to a decision based solely on automated processing, including profiling.
To do so, you may send a written request to the postal address or email address indicated in the header of the relevant data controller to whom you wish to submit your request to exercise your rights. For these purposes, please note that you may be asked to provide your national identity document (DNI) or another equivalent document in order to verify your identity, provided that this cannot be done through less intrusive means.
If you believe that your rights regarding data protection have been violated, particularly where you have not obtained satisfactory results when exercising your rights, you may lodge a complaint with the competent Data Protection Supervisory Authority (Spanish Data Protection Agency) through its website www.aepd.es.
The user guarantees that the data provided is true, accurate, complete and up to date, and undertakes to inform of any changes to the data provided through the channels enabled for this purpose and indicated in section one of this Policy. The user shall be responsible for any damage or loss, whether direct or indirect, that may arise as a result of failure to comply with this obligation.
If the user provides third-party data, the user declares that they have obtained the consent of the data subjects and undertakes to provide them with the information contained in this clause, releasing the organization from any liability arising from failure to comply with this obligation.
This Privacy Policy may be modified/updated in accordance with applicable legal requirements, for the purpose of adapting it to instructions issued by the Spanish Data Protection Agency, or as a result of changes to the website. For this reason, we recommend that users regularly review our Privacy Policy.
If you have any questions regarding this Privacy Policy, you may contact the data controllers by sending a written request to the postal address or email address indicated in the heading.
Last reviewed: 7 October 2026