Privacy Policy

This policy explains how we process the personal data you provide through this website, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

José María Gallastegui y Cía., S.A. (Joma Urban)
Tax ID (CIF): A-20029674
Registered address: San Bartolomé 11, Polígono Industrial Goiain, 01170 Legutio (Araba), Spain
Phone: +34 945 31 87 70
Email: urban@joma.es

For any question about your data, write to us at urban@joma.es.

2. What data we process

The data you give us in the contact or quote request form:

• name;
• email address and phone number;
• organisation (company, studio or public authority);
• profile (for example, architect, city council or company);
• country;
• the products or references you are interested in;
• your message.

The mandatory fields are needed to handle your request: without them we cannot process it. When you send the form we also record technical data (IP address, browser, date and time) to protect the form against abuse.

If you email or call us, we will process the data you give us in the same way. If you give us data about other people (for example, colleagues in your organisation), you must have informed them beforehand. Please do not include health data or other special categories of data in your message: we do not need them.

3. Why we use your data and on what legal basis

• To answer your request for information or a quote and keep up the communication this requires. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• To manage the request in our sales management system (ERP/CRM), where we record the enquiry, its follow-up and, where applicable, the quote. Legal basis: the same (Art. 6(1)(b) GDPR) and, if you place an order, the performance of the contract.
• To protect the form against spam and automated submissions with Google reCAPTCHA and the technical data of the submission. Legal basis: our legitimate interest in the security of the website and its forms (Art. 6(1)(f) GDPR). reCAPTCHA only loads if you accept functional cookies (see the Cookie Policy).

We do not send you marketing communications without your prior, express consent, and we do not share your data for advertising purposes.

reCAPTCHA automatically calculates a risk score to tell submissions made by people from automated ones. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

To understand how the website is used we rely on Umami, hosted on Joma Group servers. It does not use cookies or identify individuals: it processes, in aggregate form, the page visited, the browser, the approximate country and the IP address, which is not stored.

4. Who we share your data with

• The providers that supply us with web hosting, email and sales management (ERP/CRM) services. They act as data processors: they may only process the data on our instructions and in accordance with Article 28 GDPR.
• Google, as the reCAPTCHA provider, which receives the technical data the service collects (for example, the IP address and data about the browser and your interaction with the page). More information in Google’s privacy policy.
• Public authorities, judges and courts that require it, where there is a legal obligation.

International transfers

Some recipients may be outside the European Economic Area (EEA): for example, a technology provider such as Google. In those cases we only transfer the data if the destination country has an adequacy decision from the European Commission or if appropriate safeguards exist under the GDPR, such as the recipient’s certification under the EU-U.S. Data Privacy Framework or the standard contractual clauses approved by the European Commission.

5. How long we keep your data

For as long as needed to handle your request. If it does not lead to a business relationship, we keep the data for up to two years from the last contact, in case you come back to the enquiry or the project. If it turns into an order or a business relationship, we keep the data for as long as that relationship lasts and, afterwards, for the periods required by law (for example, commercial and tax law).

Once those periods have ended, the data are blocked and made available only to judges, courts and competent authorities to address any possible liabilities, for the corresponding limitation period (Art. 32 LOPDGDD). We then delete them.

6. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to us at urban@joma.es or by post to the address in section 1. Please state which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it.

Exercising your rights is free of charge. We will reply within one month, which may be extended in the cases provided for in the GDPR.

If you believe we have not handled your request properly or that the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

You can withdraw the consent you have given to functional cookies at any time from the “Manage cookies” link in the footer.

7. Minors

This website is intended for professionals and public authorities. It is not directed at children under 14 and we do not knowingly process their data. If you are under 14, please do not send us personal data.

8. Security

We apply technical and organisational measures appropriate to the risk to protect your data against loss, misuse or unauthorised access. For example, the website always runs over an encrypted connection (HTTPS).

9. Changes to this policy

We may update this policy to reflect legal changes or changes to the website. We will always publish the current version here, with the date it was last updated.

Last updated: October 2026.