Privacy policy

Last updated: 12 November 2026

1. Controller and contact

Controller: Biomket SL, Spanish tax identification number B25903329.Registered office: Calle San Telmo 67, 28016 Madrid, Spain.Business address: Avenida de Europa 19, Edificio 3, Planta 1, 28224 Pozuelo de Alarcón, Madrid, Spain.General contact: info@biomket.com.Privacy enquiries and data protection rights: legal@biomket.com.

2. Data and purposes

We process the information you give us when you write to us: identification and contact details, the company you act for, if any, and the content of your enquiry. We use it to:

• respond to your enquiry and manage related communications;
• manage the contract, if your enquiry leads to one;
• handle data protection rights requests and show how they were handled;
• protect the website against abuse.

Giving us information is voluntary. To reply, we need at least one way to contact you and the information that lets us understand your enquiry; without them, we may not be able to handle it. Please do not include sensitive information, identification documents or other details that are unnecessary for the enquiry.

The website and its security services may process technical data such as IP address, browser information and connection signals to provide the service and protect it against abuse. This first release has no audience analytics or behavioural advertising. It does not create customer accounts or process online purchases or payments. For cookies, see the Cookies policy.

3. Legal bases

• Responding to your enquiry: if you act on your own behalf and your enquiry concerns steps you request before entering a contract, processing is based on those pre-contractual steps (Article 6(1)(b) GDPR). Otherwise, including when you write on behalf of a company, the basis is Biomket's legitimate interest in handling and answering the enquiries it receives (Article 6(1)(f) GDPR).
• Managing the contract: if you are the one contracting with Biomket, for example as a sole trader, performance of the contract (Article 6(1)(b) GDPR). If you act on behalf of a company, the contract is with that company, not with you: we process your business contact details on the basis of Biomket's legitimate interest in maintaining its relationship with that company (Article 6(1)(f) GDPR and Article 19 of Spain's Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights).
• Handling rights requests: compliance with the legal obligations that data protection law places on us (Article 6(1)(c) GDPR).
• Protecting the website: Biomket's legitimate interest in protecting it against abuse and automated access (Article 6(1)(f) GDPR).
• Keeping data where the law requires it: compliance with that legal obligation (Article 6(1)(c) GDPR).

We will not use your details for marketing unrelated to your enquiry without a lawful basis. This first release has no marketing subscription.

4. Providers, recipients and technical processing

Providers needed to operate the website and handle enquiries take part in processing: Cloudflare, for the website's hosting and security, and the provider of the mailbox that receives enquiries.

Providers process data in providing their services, under their data processing terms. People authorised by Biomket may access enquiries to respond to them.

The providers are:

• Cloudflare, Inc. (San Francisco, United States), for the website's hosting and security, under its Data Processing Addendum.
• Microsoft (Microsoft 365), for the mailbox that receives enquiries, under its Products and Services Data Protection Addendum.

Enquiries you send us by email are received in Biomket's mailbox, and providers keep technical records as described under Retention.

5. International transfers

Cloudflare and Microsoft may process data outside the European Economic Area, in particular in the United States. The safeguards that apply are:

• Cloudflare: its certification under the EU-US Data Privacy Framework and, for transfers the framework doesn't cover or if the certification stops applying, the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), incorporated in its Data Processing Addendum. You can check its certification on the official Data Privacy Framework list.
• Microsoft: the European Commission's standard contractual clauses included in its Products and Services Data Protection Addendum.

You can download both addenda from those links and read the standard contractual clauses on EUR-Lex. You can also ask us for a copy of these safeguards at legal@biomket.com.

6. Retention

We keep enquiry data while we handle the enquiry and related communications. After that, depending on the case:

• Commercial enquiries that don't lead to a contract: 12 months after closure, we review them manually and delete data that is no longer needed, except what we must keep under a legal obligation or as evidence of a security incident.
• Other, non-commercial enquiries: 12 months after closure, we also review them manually and delete data that is no longer needed, with the same exceptions.
• Enquiries that lead to a contract: we keep the data for as long as the contractual relationship lasts and then for the periods the law requires. In particular, Article 30 of the Spanish Commercial Code requires a business's books, correspondence, documentation and supporting records to be kept for six years from the last entry made in the books.
• Data protection rights requests: we keep only what is needed to handle them and to show how they were handled, for the applicable periods, with access restricted once they are closed.

The 12-month review is a manual procedure carried out by Biomket, not automatic deletion.

Blocking: when we rectify or erase data, we keep it blocked while liabilities could arise from the processing: set aside, used for nothing else, and available only to courts, the Public Prosecutor and the competent public authorities, in particular data protection authorities, for the limitation period of those liabilities (Article 32 of Organic Law 3/2018). After that, it is destroyed. Blocking is separate from the statutory document retention above.

Evidence of a security incident will be kept for as long as needed to handle the incident and its consequences, and any other security records Biomket keeps, only for as long as is necessary and proportionate to protect the website.

Technical records: the website's request logs are switched off. Cloudflare keeps its own security event records under its terms. In the mailbox, messages classed as junk mail are deleted automatically after 30 days; other messages are not deleted automatically and are kept for the periods above.

7. Rights and complaints

You may request access, rectification, erasure, objection, restriction and portability where applicable, by writing to legal@biomket.com. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Only necessary and proportionate information will be requested to verify a rights request. You may complain to the Spanish Data Protection Agency: https://www.aepd.es/.

Automated decisions with legal effects are not intended for commercial enquiries; the website's security systems may automatically block access identified as abusive.