Privacy
policy
What data we process, why, for how long and how to exercise your rights.
The trust of the brands we support also rests on the way we protect their information. This policy explains clearly and comprehensively which personal data we process, for what purposes, on what legal basis, for how long, with whom we share them and how you can exercise your rights, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and with Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).
1. Data controller
| Controller | [Company name], operating under the + ULTRA brand |
|---|---|
| NIF (Spanish tax ID) | [NIF (Spanish tax ID)] |
| Address | [Full address], [Postcode] Madrid, Spain |
| Data protection contact | privacidad@plus-ultra.group |
| Data Protection Officer | [Name or entity, if appointed] · [email] |
When the creative studio in Paris takes part in a project, it does so on behalf of + ULTRA and in accordance with its instructions, under the conditions laid down in Article 28 of the GDPR.
2. Principles we apply
- Lawfulness and transparency: we only process data where there is a valid legal basis, and we inform you of it.
- Purpose limitation: we use data solely for the purposes described here.
- Data minimisation: we only request the data that are necessary. Mandatory fields are indicated on each form.
- Accuracy: we keep data up to date and rectify any that are inaccurate.
- Storage limitation: we retain data only for as long as necessary.
- Integrity and confidentiality: we protect data with appropriate technical and organisational measures.
- Accountability: we document our processing activities and are able to demonstrate their compliance.
3. Data subjects and data processed
3.1. Contacts who write to us through the Site
Founders, executives and teams of brands, buyers, representatives of institutions and partners who complete a form (contact, assessment, proposal, eligibility test, invitation) or write to us by email or WhatsApp.
- Identification and professional contact data: first name and surname, job title, company or brand, business email address, telephone or WhatsApp number, country, website or professional profile.
- Data about your project: product category, approximate turnover, target markets, timeline, indicative budget, free-text message and answers to the eligibility test.
- Technical data associated with the submission: date and time, page of origin and campaign parameters (UTM), in order to process and correctly attribute your request.
3.2. Clients and their representatives
Contact details of the persons designated by the client, billing data and the information necessary for the performance of the contract.
3.3. Newsletter subscribers
Business email address, language and date of consent.
3.4. Professional contacts for our clients' business development
In order to introduce the brands we represent, + ULTRA may process the professional data of buyers, distributors, journalists and influencers (name, job title, company, business email address and telephone number) obtained from publicly accessible professional sources: corporate websites, trade fairs and shows, industry directories and professional networks. These persons are informed in the first communication and may object at any time.
3.5. Visitors to the Site
Aggregated browsing data, only if they accept analytics cookies (see the Cookie Policy).
We do not request special categories of data (health, political opinions, ethnic origin, etc.). Please do not include them in your messages.
4. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention period |
|---|---|---|
| Responding to your request, arranging a meeting and preparing an assessment or a proposal | Pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR) | Up to 3 years from the last contact if no contract is signed |
| Performing the services contract and managing the client relationship | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of the contractual relationship and until any resulting claims become time-barred |
| Invoicing, accounting and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) | 6 years (art. 30 del Código de Comercio) and the periods laid down in tax legislation |
| Sending the newsletter on markets, buyers and European regulations | Consent (Art. 6(1)(a) GDPR) | Until you unsubscribe or withdraw your consent |
| Introducing the brands we represent to professional buyers and influencers | Legitimate interest (Art. 6(1)(f) GDPR) | Until the data subject objects and, at most, 3 years without interaction |
| Measuring the Site's audience in order to improve it | Consent (Art. 6(1)(a) GDPR) | As set out in the Cookie Policy |
| Ensuring the security of the Site and preventing fraud or abusive use | Legitimate interest (Art. 6(1)(f) GDPR) | For as long as necessary for the purpose, up to a maximum of 12 months |
| Handling requests to exercise your rights | Legal obligation (Art. 6(1)(c) GDPR) | 3 years from the response |
Once the periods indicated have expired, the data are erased or anonymised. Where required by law, they are retained in blocked form, available exclusively to the competent authorities, for the limitation period of any potential liabilities.
5. Legitimate interest
Where processing is based on our legitimate interest, we have verified that it is not overridden by your interests, rights and freedoms. In the professional prospecting referred to in section 3.4, this balance is ensured because: only professional data are processed; the contact is directly related to the person's professional activity; the person is informed in the first communication; and the right to object is honoured immediately and free of charge. You may request further information about this balancing test by writing to privacidad@plus-ultra.group.
6. Mandatory nature of the data
The fields marked as mandatory on the forms are necessary to process your request. If you do not provide them, we will be unable to deal with it. The other fields are optional and help us prepare a more precise response. You warrant that the data provided are accurate and that, if you disclose data relating to third parties, you have their authorisation to do so.
7. Recipients
Your data are not sold or disclosed to third parties for their own commercial purposes. They may only be accessed by:
- the + ULTRA team and the team of its creative studio in Paris working on your request or your project, who are bound by a duty of confidentiality;
- the Partners involved in your project (lawyers, tax advisers, customs agents, logistics operators), with your knowledge and to the extent strictly necessary;
- the buyers and distributors to whom we introduce your brand, solely with the information you have authorised;
- public authorities, courts and tribunals, where there is a legal obligation to do so.
In addition, we use technical service providers that process data on our behalf as processors, under a contract compliant with Article 28 of the GDPR:
| Provider | Service | Location and safeguards |
|---|---|---|
| [Vercel Inc.] | Site hosting | [United States and EU] · [applicable safeguard] |
| [Form provider] | Receipt of forms | [Location] · [applicable safeguard] |
| [Scheduling provider] | Booking of meetings | [Location] · [applicable safeguard] |
| [Email provider] | Business email and newsletter | [Location] · [applicable safeguard] |
| Google Ireland Ltd. | Audience measurement (only with your consent) | EU and United States · EU-U.S. Data Privacy Framework |
8. International transfers
8.1. Some providers may process data outside the European Economic Area. In that case, the transfer is based on an adequacy decision of the European Commission (in particular, the EU-U.S. Data Privacy Framework for certified entities) or, failing that, on the standard contractual clauses adopted by the European Commission, supplemented by additional measures where necessary. You may request a copy of these safeguards at privacidad@plus-ultra.group.
8.2. Exchanges with your own company or with your teams in Latin America take place at your request and are necessary for the performance of the contracted service (Art. 49(1)(b) GDPR).
9. Data security
We apply technical and organisational measures appropriate to the risk, including:
- encryption of the Site's communications using HTTPS;
- access control based on the need-to-know principle and strong authentication on our tools;
- confidentiality undertakings signed by the team, collaborators and Partners;
- selection of providers offering sufficient security guarantees;
- backups and an incident management procedure.
In the event of a personal data breach that poses a risk to your rights, we will notify the Agencia Española de Protección de Datos (Spanish Data Protection Agency) within 72 hours and, where the risk is high, we will inform you without undue delay (Arts. 33 and 34 GDPR).
10. Your rights
You may exercise the following rights at any time:
- Access: to find out whether we process your data and obtain a copy.
- Rectification: to correct inaccurate data or complete incomplete data.
- Erasure: to request the deletion of your data where they are no longer necessary, among other cases.
- Objection: to object to processing based on legitimate interest and, in any event, to direct marketing.
- Restriction: to request that we retain your data without using them, in the cases provided for by law.
- Portability: to receive the data you have provided to us in a structured, commonly used format.
- Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out beforehand.
How to exercise them. Write to privacidad@plus-ultra.group or by post to the controller's address, stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to verify it. Exercising your rights is free of charge.
Response time. We will respond within one month of receiving your request; this period may be extended by a further two months where the request is complex, in which case we would inform you (Art. 12(3) GDPR).
11. Complaints to the supervisory authority
If you consider that the processing of your data does not comply with the applicable regulations, you may lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) (C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es) or with the supervisory authority of the European Union Member State in which you reside or work. We invite you to contact us beforehand so that we can try to resolve the matter.
12. Commercial communications and unsubscribing
We only send you our newsletter if you have subscribed to it. Each mailing includes a link allowing you to unsubscribe with a single click. You may also unsubscribe by writing to privacidad@plus-ultra.group.
13. Social networks
+ ULTRA has profiles on professional networks such as LinkedIn. Any data you post or share on them are governed by the terms and privacy policy of each platform. We only use the data from our profiles to manage our relationship with those who interact with them.
14. Minors
The Site and the Services are aimed at professionals. We do not knowingly process data of children under 14 years of age. If we find that we have received data from a minor without the required consent, we will erase them.
15. Updates to this policy
We may amend this policy to adapt it to legal changes, to the guidance of the supervisory authority or to the development of our services. The date of the last update appears at the foot of this page. In the event of a substantial change, we will notify you by appropriate means.
Last updated: October 2026.