Terms & Privacy

1. Who does this Privacy Policy apply to?

This Policy applies to people who interact with Tutumsec through this website, to users of the services that Tutumsec offers for the purposes described in section 4 of this policy (the Services), and to all persons whose personal data (for example, their images) may appear on our Website or in the context of the Services.

2. Who is the controller of your personal data?

The sole controller of your personal data as set out in this policy is:

BDR Informàtica, domiciled at: c/ Baixada del Moli, 20 1-1 – AD500 ANDORRA LA VELLA (ANDORRA), NRT L-707599-R, with Trade Register number 920400X, with whom you can contact via email at hola@tutumsec.io.

We have an external Data Protection Officer —Win2win, SLU, an Andorran company specialised in privacy and personal data protection— whom you can contact at any time via email at DPDextern@win2win.ad.

Additionally, if you are in the European Union, our representative for data protection purposes is COMPLIANCE GAP MITIGATION, located at Calle Ferraz 28, 2º Izq. 28008 Madrid, (Spain), who can be contacted by telephone at (+34) 917589441 and (+34) 915482701, or preferably by email at ESTA-ENTIDAD @compliancegapmitigation.com

Tutumsec is not responsible for the activities carried out by other websites, even if they are accessed through links on our Website. Therefore, we strongly recommend that you carefully read the information provided by these other controllers before giving them your personal data (especially the privacy and cookies policies of each website you visit), and that you contact that controller if you have any concerns or questions.

3. How do we obtain your personal data?

In general, you are the one who directly provides us with your personal data —for example, through the forms on this Website—. The only exceptions to this rule are:

4. What do we use your data for and on what legal basis?

To initiate and maintain the relationship with our suppliers

If you represent a supplier of products or services, we collect your contact details and your signature in order to: (a) Manage all types of relationships with the supplier you represent. (b) Manage the corresponding record in our list of authorised suppliers. (c) Manage the quotes and invoices of the supplier you represent.

The processing linked to purposes a) and b) is legitimised by the employment or services contract you have signed with the supplier you represent and our legitimate interest in contacting them. The processing linked to purpose c) is legitimised as necessary for the performance of the contract(s) you have signed with us.

To initiate and maintain the relationship with our clients

We collect your data which we receive orally or in writing directly from you or from a third party whom you represent or of whom you are a beneficiary, when you contract a service from us for the purpose of managing said contract. The processing of this data is legitimised as necessary for the performance of the service contract in which you are an interested party.

To select and hire our staff

We process the CV data that you voluntarily send us to manage the relationship with you regarding your application for a job at Tutumsec, including the process of searching, filtering and storing the CV as a potential candidate, the staff selection process and the hiring process. The legal basis for the aforementioned processing is your consent, which you express by sending us your CV, the performance of pre-contractual measures, and if we do not have an open selection process or you are not hired and we consider that you may fit future selection processes, our legitimate interest in keeping your CV for the purpose of including it in those future processes. You may withdraw your consent or object to our legitimate interest as indicated in section 7 of this policy and, if you do so, the only effect will be the destruction of your CV (if you withdraw consent) or the limitation of its retention to the selection process for which you sent us your CV.

To prepare quotes and provide our services

We collect the data you provide us at our offices, by phone or email to offer you a quote for the service you request and, if you accept, to provide the corresponding service. Sometimes, we collect more information about our potential clients and/or their beneficial owners through KYC (Know Your Customer) forms, whose main objective is to prevent natural or legal persons from using legitimate services while engaging in illegal activities. The basis that legitimises processing for the management of the quote is the consent you give when providing the data we need to prepare it. The basis that legitimises processing associated with the provision of services is that it is necessary for the performance of the contract that governs the terms and conditions of use of these services. And the basis that legitimises processing associated with KYC management is our legal obligation under Law 14/2017, of 22 June, on the prevention and fight against money laundering or securities and the financing of terrorism.

To handle your requests, queries or complaints

We collect the personal data you provide in your emails, by phone, through the contact page form, or through rights-exercise requests, in order to handle your requests, queries or complaints regarding our services or the rights you have over your personal data. The legal basis for this processing is the consent you express by sending us or giving us this data, our legal obligation to handle your rights requests, and our legitimate interest in serving you. The provision of your personal data is therefore voluntary; however, if you do not provide it we will not be able to process your request, query or complaint. You may revoke your consent at any time, although such revocation will likewise make it impossible to continue processing your request, query or complaint.

To manage any potential future claims

We keep the data that may be necessary to manage your possible claims, or ours, based on our legitimate interest in defending ourselves in order to safeguard our rights.

To ensure the operation of our website (functional cookies)

We use functional cookies to collect, store, consult and process personal information (linked to you through unique identifiers or IP addresses) from your device’s browser, in order to ensure the proper operation of our website. As these cookies are necessary for the correct functioning of the website, their use does not require your express consent, and the basis that legitimises their use is our legitimate interest in being able to offer you the services of our website. You can find more information about these cookies in our cookies policy.

To extract aggregated statistics on the use of our website (analytics cookies)

We use analytics or statistical cookies to identify the most and least visited pages, analyse which content is of greatest interest to our visitors, and measure the success of our informational campaigns, all with the aim of improving the services we offer you through the Website. All these purposes provide aggregated results, in which it is not possible to identify the interests of any specific person. As these are analytics cookies, we will not use them until we have your consent, and not granting it or withdrawing it will have no effect other than hindering our purpose of improving the website by analysing aggregated navigation statistics of our visitors. You can find more information about these cookies in our cookies policy.

To improve the relevance of the advertising you receive (advertising cookies)

We download third-party advertising cookies. These files help us infer your interests based on the pages you visit, the content you click on and other actions you perform online. As these are non-essential cookies, we will not use them until we have your consent, and not granting it or withdrawing it will have no effect except that your visit to our website will not be able to be used to improve the relevance of the advertising you receive. You can obtain more information about these cookies in our cookies policy.

To be able to use Google services

Additionally, as an obligation that Google LLC, the company of which Google Ireland Ltd. is a subsidiary, imposes on entities that, like us, use Google Analytics and Google Ads tools, we inform you that these two services are operated by Google Inc., located at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and that Google Inc. is a beneficiary of them. The information generated by the cookies about your use of this website and your advertising preferences is generally transmitted to a Google server in the USA and stored there. If you wish to obtain more information, you can consult the page describing how Google uses information from our website and/or Google’s privacy policy regarding these services. We inform you that we have activated the IP anonymisation function in the Google service to add additional safeguards to the standard contractual clauses that protect this international data transfer to the USA. With this, Google will shorten your IP address before transmitting it to the USA (process to obfuscate your identity). Only in exceptional cases is the full IP address sent to a Google server in the USA and shortened there. Google guarantees that the IP address transmitted by your browser in Google Analytics will not be processed together with any other data held by Google. You can consult the categories of personal data processed by these services at privacy.google.com/busineses/adsservices.

To notify you of security breaches

At Tutumsec we assume security measures appropriate to the level of risk to protect personal information against loss, misuse and unauthorised access, disclosure, alteration and destruction, taking into account the risks involved in processing and the nature of personal information; however, if we determine that your data has been misappropriated (including by an employee or former employee of Tutumsec), has been exposed due to a security breach or has been improperly acquired by a third party, exposing you to high risk, we will immediately inform you about this security breach, misappropriation or improper acquisition, and about the measures we have taken and those we recommend you take so that the breach does not affect you. The basis that legitimises this processing is the legal obligation set out in Article 37 of the LQPD, and our legitimate interest in preventing this security breach from harming you.

To preserve security through video surveillance

We collect your image through our video surveillance systems in order to preserve the security of people, property and facilities, as well as to have video recordings as evidence. The legal basis for such processing is the public interest in public security pursuant to paragraph 3 of Article 20 of Law 31/2021, of 22 November, the consolidated qualified text on public security, the legitimate interest of Tutumsec, or of affected third parties, in seeking judicial protection concerning an offence that may be evidenced by a few minutes of a recording, as well as our own legitimate interest in preventing or reducing losses arising from offences committed on the premises, protecting the integrity and healthiness of our products, protecting the integrity of our workers, protecting our property and facilities, increasing workplace safety, and speeding up response to serious risks such as fires or thefts by third parties.

For other purposes that are not incompatible with the above

We may use your personal data for other purposes that are not incompatible with those indicated above (such as archiving in the public interest, scientific or historical research purposes, or statistical purposes) provided this is permitted by current personal data protection regulations, and, of course, acting in accordance with them and with the rest of applicable regulations.

5. With whom can we share your personal data?

We do not disclose your personal data to anyone, unless:

6. How long do we keep your personal data?

Tutumsec keeps your personal data strictly for as long as the processing that requires it lasts and, thereafter, for as long as it takes for the legal liabilities that apply to us at any given time, arising from the processing concerned, to expire (including the obligation to be able to demonstrate that we have complied with your request to destroy personal data).

When we do not have a legitimate purpose for processing some of your personal data, we will delete or anonymise it, and if this is not possible (for example, because it is in backups), we will store it securely and block it to isolate it from any further processing until deletion is possible.

7. What rights do you have?

You have the right to obtain confirmation as to whether or not we hold any of your personal data.

We remind you that, when we share personal data with other controllers, you will have to exercise your rights directly with them by following the instructions provided in their own privacy policies. Specifically, regarding the data that our cookies share with Google, we inform you that you can install in your browser Chrome, Internet Explorer, Safari, Firefox and/or Opera, the add-on to prevent data from being sent to Google Analytics or Google Ads by Google Inc. Below, we explain what other rights you have and how to exercise them.

Your rights

Where and how can you exercise your rights

You can exercise your rights:

Forms for exercising your rights

8. What responsibilities do you have?

By providing us with your data, you guarantee that it is accurate and complete. Likewise, you confirm that you are responsible for the truthfulness of the personal data you have provided to us and that you will keep it duly updated so that it reflects your real situation, making you responsible for any false or inaccurate personal data you may provide to us, as well as for any damages, direct or indirect, that may arise from your inaccuracy.

You may not provide us with personal data of other people unless it is justified in relation to the services you request from us. In any case, if you provide us with personal data of third parties, you assume the responsibility of informing said third parties in advance before providing us with their personal data. This information that you must provide to third parties whose data you supply to us must include all the provisions set out in this privacy policy, and you are responsible for the lawfulness of this personal data and for conveying to its holders the rights they have in relation to their personal data.

In cases where you must provide us with personal data of a minor under 16 years of age or of a person whose rights are limited, by doing so you undertake to have the authorisation of those holding parental authority or guardianship. Without such authorisation, you are prohibited from providing us with any personal data of these persons.

9. How do we protect your personal data?

We are fully committed to protecting your privacy and your personal data. We have drawn up the record of all personal data processing activities that we carry out, we have analysed the risk that each of these activities may pose to you, and we have implemented the appropriate legal, technical and organisational safeguards to avoid, as far as possible, the alteration of your personal data, its misuse, loss, theft, unauthorised access, or unauthorised processing. We keep our policies duly updated to ensure that we provide you with all the information we have on the processing of your personal data, and to ensure that our staff receives the appropriate guidelines on how to process your personal data. We have signed data protection clauses and data processor contracts with all our service providers, according to the need each one has to process personal data. We restrict access to personal data to those employees who really need to know it in order to carry out any of the processing referred to in this policy, and we have trained and raised awareness among them about the importance of confidentiality and maintaining the integrity and availability of information, as well as about the disciplinary measures that any violation in this area would entail.

However, if we determine that your data has been misappropriated (including by an employee or former employee of Tutumsec), has been exposed due to a security breach or has been improperly acquired by a third party, exposing you to a high risk, we will immediately inform you about this security breach, misappropriation or improper acquisition, and about the measures we have taken and those we recommend you take so that the breach does not affect you.

10. Amendments to this Privacy Policy

We will update this policy when necessary to reflect any changes that occur in the regulations or in our processing. If the changes are substantial, we will notify you before they take effect by sending you a notification or posting a prominent notice on this website, and you will have the option to exercise your rights as we informed you in an earlier section. In any case, we recommend that you periodically review this privacy policy to know how we protect your personal data.

If you have any questions about this policy, please let us know by sending us an email to DPDextern@win2win.ad.

Last updated: March 11, 2025