Privacy policy
1. Data controller details
Company name: Oxo Technology, S.L.
Tax ID (NIF): B88070271
Address: C/ Ramón y Cajal 5, 28100 Alcobendas (Madrid)
Email: oxo@oxotechnology.com
Website: www.oxotechnology.com
2. Applicable law
Our Privacy Policy has been designed in accordance with EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), with Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights, and the regulations implementing them.
The company may amend this privacy policy to adapt it to legislative or case-law developments or to the interpretation of the Spanish Data Protection Agency. These privacy conditions may be supplemented by the Legal Notice, the Cookie Policy and any General Terms that apply to the sale of certain products or services, where such access involves any particularity regarding the protection of personal data.
3. What do we use your data for?
1. To handle what you ask for through the website forms: a demo, a purchase, distributor access, an OEM enquiry or any other enquiry.
2. If you ask for a demo or a purchase, to send your request to OXO's distributor in your country, and to AKURA WORLD, S.L., so they can assist you.
3. To send you our newsletter and OXO news, events and offers, only if you have asked for it by ticking the box.
4. To manage our relationship with the distributors and OEM partners who sign up.
The forms ask for the data we need to assist you (name, email, phone, country, clinic or company and message). The fields marked as required are needed to reply to you. We do not need or ask for patient data: please do not include it in your message.
4. What is the legal basis?
1. Handling your request and passing it to the distributor in your country and to Akura: it is necessary to take the steps you ask for before a possible purchase (Art. 6(1)(b) GDPR). If you are a professional or work for a clinic or company, also our legitimate interest and the distributor's in responding to your request (Art. 6(1)(f) GDPR and Art. 19 of Spanish Organic Law 3/2018).
2. Newsletter and commercial communications: your consent (Art. 6(1)(a) GDPR and Art. 21 of Spanish Law 34/2002). You can withdraw it at any time using the unsubscribe link in every email or by writing to oxo@oxotechnology.com, without affecting what was done before.
3. Distributors and OEM partners: the contractual or pre-contractual relationship with your company (Art. 6(1)(b) GDPR) and our legitimate interest in maintaining that relationship (Art. 19 of Spanish Organic Law 3/2018).
5. Who do we share your data with?
1. AKURA WORLD, S.L. (C/ Albasanz 49, 28037 Madrid, Spain), OXO's wholesaler. It receives every demo and purchase request, from any country, because OXO's distributors are Akura's customers and Akura coordinates each sale with them. Akura processes your data as a controller, only to handle your request and coordinate the sale with the distributor in your country.
2. OXO's distributor in your country. Akura or OXO sends your request to the distributor so that it can assist you and sell to you in its own name. From then on, the distributor is also a controller of your data, under its own privacy policy. You can see the distributor for each country in the Distributors page on this website.
3. We only pass on the data needed to assist you. Under contract, they may only use it for that purpose, may not send you advertising without your permission, and must delete it no later than 2 years after the last contact if you do not buy. When they first contact you, they will tell you who they are and how to exercise your rights with them.
4. Apart from these cases, we do not share your data with anyone, unless required by law (for example, with the tax authorities or the courts).
6. Service providers acting on OXO's behalf
These providers process data only on our instructions and under a data processing agreement:
- Odoo S.A. (Belgium): cloud CRM (Odoo Online) where we store requests. Data is stored on servers in the European Union (France and Belgium), with backups in the European Union.
- Brevo SAS (France): contact list and sending of emails and the newsletter. Data is stored on servers in the European Union.
- Cloudflare, Inc. (USA): website hosting and security, and form delivery.
- Google Ireland Limited (Ireland): website usage statistics (Google Analytics), only if you accept analytics cookies.
Meta (Facebook and Instagram pixel). Only if you accept advertising cookies, the Meta pixel collects data about your browsing on our website and sends it to Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland), to measure and improve our ads. For that collection and transmission, OXO and Meta are joint controllers (Art. 26 GDPR) under Meta's Controller Addendum. Under that agreement, OXO is responsible for informing you, and Meta is responsible for handling your rights over the data Meta stores afterwards. What Meta does with that data afterwards is Meta's responsibility: see its policy at https://www.facebook.com/privacy/policy. We never send Meta the data you enter in our forms.
7. International transfers
1. Distributors. If the distributor in your country is outside the European Economic Area, your data will be sent to that country. If the European Commission has recognised that the country provides an adequate level of protection (for example, Switzerland, the United Kingdom or Japan), nothing else is needed. If not, whoever sends your data (Akura or OXO) signs the standard contractual clauses approved by the European Commission (Decision (EU) 2021/914) with the distributor. Until they are signed, your request is only sent when it is necessary to handle what you have asked for (Art. 49(1)(b) GDPR). The Distributors page on this website shows which safeguard applies in each country. You can ask for a copy of the safeguards by writing to oxo@oxotechnology.com.
2. Service providers. Safeguard used by each:
- Odoo: servers and backups in the European Union. Some older European customers also have a backup in Canada, a country covered by a European Commission adequacy decision. If staff of Odoo subsidiaries outside the European Union access the data to provide support, Odoo uses standard contractual clauses.
- Brevo: servers in the European Union. Brevo's few sub-processors in the USA work under the EU-US Data Privacy Framework or standard contractual clauses.
- Cloudflare: certified under the EU-US Data Privacy Framework. If that framework ceased to apply, its agreement applies the standard contractual clauses.
- Google: Google LLC is certified under the EU-US Data Privacy Framework. Otherwise, its agreement applies the standard contractual clauses.
- Meta: Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.
8. How long do we keep your data?
1. Demo, purchase or other requests that do not lead to a purchase: while we handle them and for up to 2 years after the last contact.
2. Customers, distributors and OEM partners: for as long as the relationship lasts and, after that, for 6 years, as required by the Spanish Commercial Code (Art. 30) for business records. Accounting and tax records are kept for as long as the tax authorities can review them (Spanish General Tax Law, Arts. 66 to 70): usually 4 years, and up to 10 years in the cases set out in the law.
3. Newsletter: until you unsubscribe. After that, we only keep your email address on a suppression list so that we do not write to you again.
4. When each period ends, the data is blocked: it is kept set aside, unused, only for courts and authorities, for as long as legal claims may arise (up to 3 years for data protection matters and up to 5 years for contractual claims). It is then destroyed (Art. 32 of Spanish Organic Law 3/2018).
5. Akura and the distributor in your country keep your data under their own policies, for no longer than 2 years after the last contact if you do not buy.
9. Security measures
As part of our commitment to guaranteeing the security and confidentiality of your personal data, we inform you that we have adopted the technical and organisational measures necessary to guarantee the security of personal data and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of technology, the nature of the data stored and the risks to which they are exposed. Nevertheless, users should be aware that security measures on the Internet are not impregnable.
You can obtain more information about the security measures we apply by contacting us through the channels given at the start of this Privacy Policy, in the section identifying the data controller.
10. Your rights
You have the following rights regarding the processing of your personal data, and you can exercise them by contacting the data controller:
– If the legal basis for processing is consent, the right to withdraw it at any time, without affecting processing carried out before its withdrawal.
– The right to request access to your personal data.
– The right to request rectification if they are inaccurate, or to request erasure (for example, if you consider that they are no longer necessary for the purposes for which they were collected).
– The right to request restriction of processing, where any of the conditions set out in the regulations is met, in which case we will only keep the data for the establishment, exercise or defence of claims.
– The right to object to processing, for example regarding commercial information sent by us, in which case we will stop processing your data for that purpose, except for compelling legitimate grounds or the establishment, exercise or defence of possible claims.
– The right to data portability.
– The right to lodge a complaint with the Spanish Data Protection Agency (the competent supervisory authority), especially if you have not obtained satisfaction in exercising your rights: www.aepd.es