Personal data processing, TRACEA

Processing of personal data supplied by the TRACEA application

Who is responsible for processing your data?


Address: Barrio de Zicuñaga s/n 20120 HERNANI (GUIPUZCOA)

Tel.: 943.55.11.00



What is the purpose of personal data processing?

The TRACEA application has been developed for the sole purpose of allowing full traceability of all the materials we use in paper manufacturing. After the User logs in at the start of the transport route from the supplier to our plants, the User will be asked to take photographs of load status. The location coordinates will be linked to the image using the geolocation technology installed in the device in which TRACEA is downloaded.

NO PERSONAL DATA CONTAINED IN THE DEVICE in which TRACEA is installed will be accessed and it will not be necessary for the session to remain open outside working hours or following delivery of the materials to the destination.


The only purpose of this tool is to document the route followed by the raw material from source to our plants, regardless of whether or not the data collected through TRACEA are used by third parties, as a result of any assignments that may be made, for purposes and processing in which IBERPAPEL is not the Data Controller.

The data will be kept for the period of time stipulated in prevailing legislation and in our data policy or until the rights of erasure, cancellation or objection are exercised, provide the data need not be kept to fulfil legal obligations and notwithstanding the obligation to observe legally stipulated limitation periods.


What is our legal standing for data processing?

The processing of data furnished through TRACEA requires the express consent of the data subject and is necessary to satisfy the Data Controller’s legitimate interests.

The refusal to provide any personal data deemed to be mandatory or the prevention of access to geolocation data during the provision of the service, in the terms stipulated, could be a breach of contractual conditions with third parties.


Which recipients will be provided with the data?

The only recipient of the data processed for the aforementioned purpose is the Data Controller, although the latter may contract companies specialised in activities such as warehousing, reporting, data destruction and erasure, and external IT services, which could have access to these data.

The Data Controller may communicate the personal data obtained to other Group companies so as to centralise administrative and IT processes. The data may also be communicated to auditors, lawyers, insurance companies, accounting firms and other external consultants and providers of products or services.

We continue to apply strict criteria when selecting third-party service providers in order to fulfil our data protection obligations and we pledge to enter into a data-processing agreement with each supplier.

Moreover, in the context of the provision of material transport services to which the use of TRACEA is connected, it may be necessary to assign data to third parties such as insurance companies, the Directorate General for Traffic (DGT), companies engaged in security services on public and/or private roads, national or regional law enforcement bodies, or courts and tribunals, as well as other third parties where legally stipulated or in order to file claims for breach of contract, including claims against the natural or legal persons with whom the goods transport services have been contracted or subcontracted. Such assignments may reflect the interests of both the data subject and the Data Controller.

It is understood that the user, on giving consent to this data processing, also consents to any such assignments that may be made, if applicable, due to forming part of the processing activity to which consent is given. Should other processing activities be undertaken that require the user’s express consent, this will be obtained on a timely basis.

The international assignment of personal data is not envisaged in any event.


What are your rights when providing your data?

Data subjects may exercise the following rights:

  • Access to their personal data;
  • Rectification of inaccurate data;
  • Erasure when the data are no longer required, among other reasons;
  • Objection, in which case we will stop processing the data, save for pressing, legitimate reasons or to initiate or defend against possible claims;
  • Restriction of processing, on certain occasions, in which case we will only keep the data to initiate or defend against claims;
  • Revocation or withdrawal of consent given at any time, without affecting the lawfulness of processing based on consent prior to withdrawal;
  • Not to be subject to automated decisions;
  • Portability of data to other data controllers, in which case we will keep them to initiate or defend against possible claims.

In accordance with prevailing legislation, these rights may be exercised by sending an email or letter to the address first above written. A copy of your national identity card or other identity document must be attached.

A response must be given to the exercise of these rights within one month as from receipt of the message.

Further information on these rights may also be obtained or a claim may be brought (particularly when the data subject considers that his or her rights have not been observed) at the Spanish Data Protection Agency. The necessary information may be found at:


How did we obtain the data?

The personal data processed was gathered by using the information provided by the user in the TRACEA login process and the data sent automatically by the geolocation technology included in your device along the transport route.

The following personal data categories are processed:

  • Identification data: The driver’s name, email address and telephone number, the vehicle’s registration number and the IP address associated with the device from which application login takes place.
  • Geolocation coordinates;
  • No data subject to special protection are processed.


Where can I find additional information?

Additional information may be obtained at

Basic information on personal data protection

Data Controller

Iberpapel Gestión, S.A. TIN: A21248893. Registered address: San Sebastián, Avenida Sancho El Sabio, 2, 20010.

Purpose and legal standing

Iberpapel will process the personal data furnished by shareholders or by custodians for the purposes described below:
In order to fulfil the legal obligations laid down in Royal Decree-Law 1/2010 of 2 July whereby the Consolidated Text of the Spanish Companies Act was introduced:

– Manage the development, fulfilment and control of the shareholder relationship, including the submission of information on shareholder status.

– Manage the calling, holding and disclosure of the General Shareholders’ Meeting, including: (i) attendance at and participation in the meeting; (ii) delegation of representation, if applicable; and (iii) distance voting, if applicable.

– Assure of the proper functioning of the Electronic Shareholder Forum so as to facilitate shareholder communication prior to the General Shareholders’ Meeting.

Iberpapel requests the personal data that are strictly necessary for the aforesaid purposes. Should the required personal data not be furnished, Iberpapel may not carry out the aforementioned actions.

All the above reflects Iberpapel’s legitimate interest in adopting good corporate governance practices that guarantee transparency and accessibility to information on Iberpapel, such as the recording of the General Shareholders’ Meeting.

As regards image rights, we inform you that on attending the General Shareholders’ Meeting the shareholder or representative consents to the taking of photographs, the audiovisual recording of their image and/or voice, and the reproduction and/or posting thereof on Iberpapel’s website.


You guarantee the accuracy of the personal data provided to Iberpapel. In the event that the card for attendance, delegation and voting includes personal data of natural persons other than the shareholder and should a third party attend the General Shareholders’ Meeting, the shareholder must inform them of the matters stated in this announcement in connection with the processing of personal data and meet any other requirements that may apply to the correct assignment of personal data to Iberpapel, the latter not being required to take any other steps with respect to the data subjects. The personal data of these third parties will be processed as stated herein and will be subject to the same conditions and protected on the same legal basis as the shareholders’ data.

Storage period

The data storage period will depend on the specific legal obligation requiring us to keep them. You are advised that the data may be communicated to third parties exercising the right of information provided by the Spanish Companies Act or may be publicly accessible due to being included in documents available on the website as stipulated herein.


Personal data will not be assigned to third parties unless required by law.

The international assignment of personal data is not envisaged in any event.

Iberpapel may allow certain service providers access to the personal data, in which case they will be data processors.

Exercise of rights

We remind you that your rights of access, rectification, erasure, restriction of processing and, when your personal data are processed on the basis of legitimate interest, the right of objection, may be exercised at any time at Avenida Sancho el Sabio, 2 de San Sebastián (Guipúzcoa – 20010) (Spain) or at the following email address:, attaching a copy of your national identity card or other identity document.

A claim may also be filed at the Spanish Data Protection Agency should you consider that your rights have been infringed (

Additional information

Additional detailed information on the personal data protection policy may be consulted in the following link: legal-notice.

Skip to content