Europavia
Data protection

Privacy policy

Last updated: January 2026

1. Data controller

  • Controller: EUROPAVIA ESPAÑA, S.A.
  • Tax ID (CIF): A28157493
  • Address: Calle Jorge Juan, 30 – 4.º A, 28001 Madrid, Spain
  • Email: info@europavia.es
  • Phone: +34 914 318 253

2. Data we collect and purposes

Our aim is to provide you with information on how we process your personal data.

At Europavia, we will only process your personal data in a manner that is compatible with and relevant to the purpose for which it was collected or authorised.

Furthermore, Europavia will always process your data for specified, explicit and legitimate purposes, taking into account the principle of data minimisation, and will collect and process only the data that is necessary and relevant for the purposes set out below, on the legal basis specified in each case.

Europavia will process your personal data for each of the following purposes and in accordance with the following legal bases:

2.1 Contact form and business enquiries

  • Data processed: First name, surname, company, job title, email, phone, country, message content.
  • Purpose: To respond to the enquiry received and manage the pre-contractual or commercial relationship.
  • Legal basis: Art. 6.1.b) GDPR: steps taken at the request of the data subject prior to entering into a contract.
  • Retention period: 3 years from the last contact or until consent is withdrawn.
  • Disclosures: No data is disclosed. Access by data processors (hosting, CRM).

2.2 Job applications and recruitment processes

  • Data processed: First name, surname, email, phone, CV, employment history, qualifications, cover letter.
  • Purpose: Management of recruitment processes, candidate pools and filling of vacancies.
  • Legal basis: Art. 6.1.a) GDPR: explicit consent of the candidate.
  • Retention period: 12 months from receipt. After this period, data is deleted unless a new application is submitted.
  • Disclosures: No data is disclosed to third parties.

2.3 Commercial communications and newsletter

  • Data processed: Email, name, company, communication preferences.
  • Purpose: Sending information about Europavia’s services, industry news and events.
  • Legal basis: Art. 6.1.a) GDPR: explicit consent. Art. 6.1.f): legitimate interest for existing customers.
  • Retention period: Until consent is withdrawn or you unsubscribe from the list.
  • Disclosures: Email marketing platform acting as data processor.

2.4 Browsing data and web analytics

  • Data processed: IP address (anonymised), pages visited, session duration, device, language.
  • Purpose: Analysis of Website usage, improvement of user experience and content optimisation.
  • Legal basis: Art. 6.1.a) GDPR: consent via the cookie panel (category: analytics).
  • Retention period: 13 months from collection.
  • Tools: Google Analytics 4 / other active tools

2.5 Contractual relationships with customers and suppliers

  • Data processed: Contact details of individuals acting on behalf of the customer or supplier company.
  • Purpose: Performance and management of the contract, invoicing, operational communications.
  • Legal basis: Art. 6.1.b) GDPR: performance of the contract. Art. 6.1.c): legal obligation (invoicing).
  • Retention period: Term of the contract + 6 years (tax and commercial obligations).
  • Disclosures: Advisory firms, public authorities where required by law.

2.6 Security cameras

For security reasons and to protect people, property and premises, we may process your image through the video surveillance cameras at our premises, on the basis of that public interest and in order to comply with our legal obligations. All recordings will be kept for a maximum of 30 days, in accordance with the applicable legal retention periods, unless required for compliance with legal obligations. No data will be disclosed to third parties, except at the request of the State Security Forces and Corps, Courts, Tribunals or where otherwise required by law.

2.7. Data collected in meetings through communication systems

During meetings held via videoconferencing systems, chats or conference calls, your data may be collected after participants have been informed and their consent requested. In such cases, Europavia may process your image and voice and/or transcripts of the conversations in order to follow up on those meetings and prepare minutes or summaries of them.

3. Data transfers

Europavia is a multinational company operating in several countries and has developed global data security practices designed to ensure that your personal information is adequately protected. Please note that personal information may be transferred, accessed and stored in different countries, provided this is necessary for the uses and disclosures described earlier in this policy.

International transfers of personal data may therefore occur when your data is sent to or accessed from a country outside the European Economic Area (EEA). However, in order to transfer personal data to a country outside the EEA, measures must be implemented to guarantee a level of security equivalent to that of the EEA, as some countries do not have regulations ensuring a level of compliance similar to that of the EEA.

Europavia has implemented appropriate safeguards for transfers of personal information originating in the European Economic Area (“EEA”) to Europavia subsidiaries, third parties or suppliers located outside the EEA.

Therefore, if such transfers become necessary in the course of our activities, we ensure that appropriate safeguards are in place, such as standard contractual clauses, adequacy decisions or other legal mechanisms, to protect your personal data in compliance with the relevant EEA data protection laws.

For Europavia subsidiaries located outside the EEA, we ensure compliance with the applicable local data protection and privacy regulations. These subsidiaries operate in accordance with the legal requirements of the country in which they are located, ensuring that personal data is processed securely and lawfully.

4. Data processors

Europavia engages external providers that act as data processors in accordance with Art. 28 GDPR. These providers only process data in accordance with Europavia’s instructions and may not use it for their own purposes.

5. Data subject rights

You may exercise the following rights at any time, free of charge, by writing to info@europavia.es with the subject line “Exercise of GDPR rights” and attaching a copy of your identity document:

  • Right of access to your personal data, to find out which data is being processed;
  • Right to rectification of any inaccurate personal data;
  • Right to erasure/deletion of your personal data, where possible;
  • Right to request restriction of the processing of your personal data where the accuracy, lawfulness or necessity of the processing is in doubt, in which case we may retain the data for the establishment, exercise or defence of legal claims.
  • Right to object to the processing of your personal data where the legal basis for the processing is legitimate interest. Europavia will stop processing your data unless it has compelling legitimate grounds or the processing is needed for the establishment, exercise or defence of legal claims.
  • Right to data portability, where the legal basis for the processing, among those indicated, is your consent.

If you consider that the processing of your data does not comply with the applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es · C/ Jorge Juan, 6, 28001 Madrid.

6. Minors

The Europavia Website is intended exclusively for professionals and businesses. We do not knowingly collect personal data from children under 14. If you become aware that a minor has provided us with data without the consent of their legal guardian, please notify us at info@europavia.es so that we can delete it immediately.

7. Updates to the Privacy Policy

Europavia may update this Privacy Policy to reflect changes in legislation, case law or its processing activities. Where changes are substantial, users will be informed by means of a prominent notice on the Website. The “Last updated” date shown in the header reflects the current version.