01Who is responsible for your data
The controller is Iguazu Fragancias SL (trading as Iguazu Trading), Calle Navalmanzano 6 B, 28035 Madrid, Spain, NIF B22678338, EU VAT ESB22678338.
For any data-protection question, write to export@iguazutrading.com marking your message “Data protection”.
02What we collect
From enquiry and quotation forms: company name, contact name, business email address, telephone number, country of business, buyer type, and the details of the requirement you describe.
From trading: the correspondence, order documents, delivery addresses and payment records associated with your account.
Automatically: standard server log data — IP address, browser type, pages requested, and the time of the request — retained for security and diagnostics.
We do not collect special-category data and we do not ask for it. Please do not include it in an enquiry.
03Why we process it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Responding to an enquiry and issuing a quotation | Steps taken at your request prior to entering a contract |
| Performing a sale, shipment and after-sales support | Performance of a contract |
| Issuing invoices and keeping accounting and customs records | Legal obligation |
| Sanctions and anti-money-laundering screening | Legal obligation |
| Securing the website and preventing fraud | Legitimate interests |
| Occasional trade updates to existing business contacts | Legitimate interests, with opt-out in every message |
05International transfers
Export by its nature involves sending shipping documents to parties outside the European Economic Area. Where personal data is transferred outside the EEA to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, or on the transfer being necessary for the performance of your contract.
06How long we keep it
- Enquiries that do not lead to a sale: 24 months from last contact.
- Accounting and transaction records: 6 years, per article 30 of the Spanish Código de Comercio.
- Tax and customs documentation: 4 years, per the limitation period in the Ley General Tributaria, or longer where an assessment is open.
- Server logs: 12 months.
07Your rights
Under the GDPR you may request access to your personal data, rectification of inaccurate data, erasure where no retention obligation applies, restriction of processing, portability, and you may object to processing carried out on the basis of legitimate interests.
Write to export@iguazutrading.com. We respond within one month. If you are not satisfied you may complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid — aepd.es.
08Security
The site is served over HTTPS. Access to enquiry and customer records is limited to staff who need it, over authenticated accounts. We keep no payment card data: settlement is by bank transfer or documentary credit through our bank.
Be alert to invoice fraud. Our bank details appear on the pro-forma invoice and we never change them by email mid-transaction. Telephone the trade desk to verify before sending funds if you receive any message suggesting otherwise.
09Changes to this policy
We update this policy when our processing changes. The revision date at the top of this page always reflects the current version.