This document contains the Data Protection Policy and Cookie Policy of ImpactCo, in compliance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI-CE).
Version 1.0 — March 2026
Data Protection Policy
Processing of personal data in accordance with GDPR and LOPDGDD
1. Data Controller
Alpama Impact, S.L. (IMPACT.CO)
Tax ID: B-88403217
Address: Camino de la Zarzuela nº 29, 28023 Madrid, Spain
Privacy contact: tribu@impactco.es
2. Data we collect
Depending on your interaction with our website and services, we may process the following categories of personal data:
Contact data: name, surname, email, phone and professional position, through contact forms or information requests.
Navigation data: IP address, browser type, pages visited and session duration, collected through WordPress and analytics plugins.
Subscription data: email and communication preferences when subscribing to our newsletter.
Candidate data: CV, cover letter and professional information in selection processes.
Contractual data: information necessary for service provision and compliance with legal obligations.
We do not collect special categories of data through this site unless explicit consent is given.
3. Purposes and legal basis
We process your data exclusively for purposes supported by the corresponding legal basis:
Query management — Pre-contractual measures (art. 6.1.b GDPR).
Service provision — Contract execution (art. 6.1.b GDPR).
Commercial communications and newsletter — Express consent (art. 6.1.a GDPR), revocable at any time.
Web analytics — Legitimate interest (art. 6.1.f GDPR) and consent for non-essential cookies.
Personnel selection — Consent and pre-contractual measures (art. 6.1.a and 6.1.b GDPR).
Legal and tax obligations — Legal obligation (art. 6.1.c GDPR).
4. Retention periods
Queries and contact: until resolution of the request and during the applicable limitation period.
Contractual relationships: contract validity plus 6 years (Spanish commercial and tax regulations).
Newsletter: until consent withdrawal or unsubscribe request.
Candidates: during the process and up to 12 additional months with your consent.
Navigation data and cookies: as detailed in Chapter II of this document.
5. Recipients
ImpactCo does not sell or transfer data to third parties for their own commercial purposes. Only the following may access the data:
Technology providers acting as data processors (WordPress hosting, CRM, email marketing, analytics), under contract with confidentiality obligations.
Public administrations, judicial bodies and regulators when required by law.
Legal advisors, auditors and external consultants when strictly necessary.
When ImpactCo engages third-party providers for data processing, corresponding data processing agreements will be signed to guarantee GDPR compliance and adoption of appropriate technical and organizational measures.
6. International transfers
Generally, data is kept within the European Economic Area (EEA). When it is necessary to transfer data to third countries, the following safeguards will be applied in accordance with GDPR:
European Commission adequacy decision for the destination country.
Standard contractual clauses (SCCs) adopted by the European Commission.
Binding corporate rules (BCRs) when applicable.
You can request information about safeguards applied to specific transfers by contacting tribu@impactco.es.
7. Your rights
As a data subject, you have the following rights that you can exercise free of charge at any time:
Access: Know what data we process and how.
Rectification: Correct inaccurate or incomplete data.
Erasure: Request deletion of your data when appropriate.
Restriction: Restrict processing in certain circumstances.
Portability: Receive your data in structured and readable format.
Objection: Object to processing based on legitimate interest.
To exercise your rights, send a written request to tribu@impactco.es attaching a copy of your identity document. We will respond within a maximum period of one month.
If you consider that the processing does not comply with regulations, you can file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
8. Updates and contact
This policy may be updated when new services or plugins are incorporated into the site, or when regulatory requirements change. The date of the last update appears in the header of this document.
For any privacy inquiries, you can contact ImpactCo at
tribu@impactco.es.
Alpama Impact, S.L. (IMPACT.CO) — Tax ID B-88403217
Camino de la Zarzuela nº 29, 28023 Madrid — tribu@impactco.es
Version 1.0 — March 2026