Last updated: 5 November 2026
This is a translation for information purposes. In case of discrepancy, the Spanish version prevails.
1. Data controller
- Controller
- NORTEÑA DE METALES, S.A. (NORMESA)
- Tax ID (CIF)
- A48107833
- Address
- Plentzia Bidea, 9, 48100 Mungia, Vizcaya, Spain
- Phone
- +34 946 741 874
- normesa@normesa.com
2. What data we process and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| Quote request form | Name, e-mail, company, address, postcode, town, phone, requested products and comments | To prepare and send you the quote and, if you accept it, to manage the order | Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) |
| Contact form | Name, e-mail, subject and message | To answer your enquiry | Your consent, given when you send the form (Art. 6(1)(a) GDPR) |
| E-mail or phone | Whatever you provide | To handle your request | Consent or pre-contractual steps, as applicable |
| Visiting the website | IP address, date and time and requested page, in the server logs | Site security and prevention of form abuse | Legitimate interest in protecting the website (Art. 6(1)(f) GDPR) |
We do not use your data to send you advertising, we do not build profiles and we do not make automated decisions about you.
Fields marked with an asterisk are needed to handle your request. If you do not complete them we cannot reply through that channel, but you can always call or e-mail us.
3. How long we keep data
- Enquiries: as long as needed to answer them and resolve related matters.
- Quotes and orders: for the duration of the business relationship and then for the periods required by commercial and tax law.
- Server logs: up to 12 months, unless needed to investigate a security incident.
4. Recipients
We do not share your data with third parties unless required by law. To provide the service we use providers that process data on our behalf (processors), under the contracts required by the GDPR:
- the website hosting company
- the e-mail provider
The map on the contact page only loads if you click "Show map". At that point your browser connects to Google, which processes data under its own privacy policy. See the cookies policy.
5. International transfers
NORMESA does not transfer your data outside the European Economic Area. If you choose to load the map, Google may process technical data in the United States under the safeguards of the EU-US Data Privacy Framework.
6. Your rights
You can exercise these rights at any time:
- access to your data;
- rectification of inaccurate data;
- erasure;
- objection to processing;
- restriction of processing;
- data portability;
- withdrawal of consent, without affecting processing carried out before withdrawal.
To exercise them, write to normesa@normesa.com or by post to NORTEÑA DE METALES, S.A., Plentzia Bidea, 9, 48100 Mungia, Vizcaya, Spain, stating the right you wish to exercise. If we have doubts about your identity, we may ask you to prove it.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
We apply appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS) across the whole site, forms that do not keep messages on the web server, restricted access to the mailboxes where requests are received, and protection against automated submissions.
8. Changes to this policy
We may update this policy to reflect legal or website changes. The date of the last update is shown at the top of the page.