ContactPRIVACY AND DATA PROTECTION POLICY
ACCESORIOS DIMAC, S.L. — THERMIA BARCELONA · Last updated: 16/10/2026
This policy explains what personal data we process when you contact us through our website, by telephone, by email or through Facebook Messenger, Instagram Direct and WhatsApp. It also explains what we use it for, who we share it with, how long we keep it and how you can exercise your rights.
1. Data controller
- Owner: ACCESORIOS DIMAC, S.L., trading as THERMIA BARCELONA.
- Tax ID (CIF): B58507757.
- Registered address: Pol. Ind. Can Torras, calle Narcís Monturiol, 34, nave izquierda, 08192 Sant Quirze del Vallès (Barcelona), Spain.
- Registration details: Barcelona Companies Register (Registro Mercantil de Barcelona), volume 9588, book 8760, sheet 107.768, 1st entry.
- Telephone: (+34) 93 712 12 37.
- Email: contacto@thermiabarcelona.com.
For any question about this policy or to exercise your rights, you can write to contacto@thermiabarcelona.com or to the postal address above.
2. What data we process and where it comes from
We process the data you provide to us and the data generated when we handle your request:
- Website forms: name, company, email address, telephone number, town, province, country, the text of your enquiry and any files you attach. This data is stored on the website server and in our customer management system.
- Facebook Messenger and Instagram Direct: your public profile name, the identifier that Meta assigns to the conversation and the content of the messages you send us. Meta provides us with the profile name and the identifier when you write to us. We only process the conversation that you start with our account: your posts, photos and followers are not included. We store the full conversation in our customer management system, hosted on our own servers, so that we can assist you with full context.
- WhatsApp Business: your telephone number, your profile name and the content of your messages. We also store the full conversation in our customer management system.
- Telephone and email: your contact details and the content of the call or email.
- Details of the project you tell us about: address of the building site or home, type of product, number of units, whether it is a new build or a renovation, desired timeframe, preferred contact time and method, professional association number if you are a professional, how you heard about us and a summary of your request.
- Sales management data: the stage of your request, the team member assisting you, the related tasks and calls and the history of changes to your record.
- Email news: your name, your email address and the date on which you agreed to receive it.
The fields marked as mandatory in the forms are necessary to handle your request; if they are missing, we will not be able to process it. The rest are optional.
We process identification data, contact data and data relating to your project. Special categories of data (health, ideology, religion and similar) are outside the scope of our activity: please do not include them in your messages. Our services are aimed at adults and professionals. If we detect that an enquiry comes from a person under 18, we will delete their data; we will be happy to assist them through their mother, father or legal guardian.
3. Why we process your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Handling your request for information or a quotation and continuing the conversation through the channel you have chosen, including calls to respond to your request. | Steps taken at your request prior to entering into a contract (Art. 6(1)(b)). |
| Studying your project and directing it to the right person in the sales team or the technical office, including the initial assistance by the automated assistant described in section 4. | Pre-contractual steps at your request (Art. 6(1)(b)). |
| When you ask us for a quotation, passing your request on to the authorised distributor in your area so that they can assist you. We are manufacturers and the final sale is made through our network. Before doing so, we tell you in writing or by telephone and, if you have written to us through Facebook Messenger, Instagram Direct or WhatsApp, we ask for your agreement in the same conversation. We pass it on to a single distributor. From that moment on, the distributor assists you, and we only contact you again if you write to us. | Pre-contractual steps at your request (Art. 6(1)(b)). |
| Handling complaints, warranty claims and after-sales enquiries about our products, including when you bought them from a distributor. | Compliance with the manufacturer’s legal obligations (Art. 6(1)(c), in connection with consumer protection law) and our legitimate interest in handling and defending those claims (Art. 6(1)(f)). |
| Managing the commercial relationship with those who contract directly with us: orders, deliveries, invoicing and after-sales service. | Performance of the contract (Art. 6(1)(b)) and compliance with legal, tax and accounting obligations (Art. 6(1)(c)). |
| Sending you news about our products and projects by email, if you have agreed to this by ticking the optional box in our forms, whether you are a private individual or a professional. | Your consent (Art. 6(1)(a)). |
| Sending news about products similar to those you have contracted directly with us. | Our legitimate interest in keeping our customers informed (Art. 6(1)(f)), as permitted by Art. 21.2 of the Spanish Information Society Services Act (LSSI-CE). You can object when you give us your data and in every message. |
| Occasionally recording screen sessions of our tools to document processes and train the team. We use sample records or blur the data whenever possible. | Our legitimate interest in training the team and documenting our processes (Art. 6(1)(f)). You can object by writing to contacto@thermiabarcelona.com. |
| Handling the exercise of your rights and demonstrating compliance with the law. | Compliance with a legal obligation (Art. 6(1)(c)). |
Where we rely on your consent, you can withdraw it at any time. The withdrawal applies from that moment and does not affect the rest of the relationship. Where we rely on legitimate interest, you can object to the processing as explained in section 8.
4. Artificial intelligence: automated assistant
On Facebook Messenger, Instagram Direct and WhatsApp, an automated assistant based on artificial intelligence may handle the first contact. The assistant introduces itself as such in its first message.
The assistant asks you a few questions about your project and records the answers in your file. This way, the team member who assists you afterwards has all the context. Technical, product and price enquiries are always answered by a person. At any time, in the same conversation, you can ask to be assisted directly by a member of the team.
The assistant only collects information. Each request is reviewed and organised by a member of the team, and the approval or refusal of requests, the referral to the distributor and the setting of prices are always decided by people. This processing therefore does not involve automated individual decisions within the meaning of Art. 22 of the GDPR.
To work, the assistant uses Google’s paid Gemini API, which we have contracted. Google acts as a data processor under its data processing agreement for these services, does not use the information to train its models and keeps logs for a limited time to prevent abuse and comply with the law.
5. Who we share your data with
Authorised distributors. When you ask us for a quotation, and after informing you as explained in section 3, we will share your name, your contact details and the details of your project with the authorised distributor in your area, who will contact you and will process your data as an independent controller. Each distributor undertakes to use that data only to handle your request. If you ask us, we will tell you which distributor has received your data.
Meta. If you write to us through Facebook Messenger or Instagram Direct, Meta Platforms Ireland Ltd. processes your data as an independent controller, in accordance with its own privacy policy; we are responsible for the messages we receive in our management system to handle your enquiry. For the statistics of our Facebook page (Page Insights), Thermia and Meta Platforms Ireland Ltd. are joint controllers, under Meta’s controller addendum. On WhatsApp Business we use the Cloud API: WhatsApp Ireland Limited processes the messages on our behalf as a data processor and keeps them for a maximum of 30 days; the data of your WhatsApp account is processed by WhatsApp as a controller, in accordance with its own privacy policy.
Data processors. These providers process data on our behalf, under contract and only to provide us with their service:
| Provider | Service |
|---|---|
| Google Ireland Ltd. / Google LLC | Artificial intelligence (Gemini): messaging assistant |
| Cloudflare, Inc. | Secure publishing and access control for the CRM. Traffic passes through its network; the data is stored on our own servers. |
| The Rocket Science Group LLC (Mailchimp, Intuit group) | Sending email news |
| Eurovia Servicios Telemáticos, S.L. | Corporate email, including the shared marketing mailbox |
| SEO AGIL, S.L., with Nominalia Internet, S.L.U. as hosting provider | Development, maintenance and hosting of the website thermiabarcelona.com and its forms |
Public authorities, banks and advisers, where there is a legal obligation or it is necessary for the contractual relationship.
Apart from these cases, your data stays with Thermia Barcelona. We never sell it or share it for advertising purposes.
6. International transfers
Google LLC, Cloudflare, Inc., The Rocket Science Group LLC (Mailchimp) and, in the case of WhatsApp, companies of the Meta group may process data in the United States. These transfers are based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) for certified entities and, as an additional safeguard, on the standard contractual clauses approved by the Commission (Decision (EU) 2021/914). On Messenger and Instagram, any transfers made by Meta are governed by its own privacy policy.
If your project is outside the European Economic Area and is handled by a distributor in that country, we will pass your request on to that distributor because it is necessary to fulfil the request you make to us (Art. 49(1)(b) GDPR).
You can ask us for information about these safeguards at contacto@thermiabarcelona.com.
7. How long we keep your data
| Data | Period |
|---|---|
| Requests that do not become an order, including your conversations on Messenger, Instagram or WhatsApp | Up to 3 years from the last time you contacted us. After 12 months without activity, we keep only your record and a summary of the request. They are then deleted. |
| Customers with a direct contract | For as long as the commercial relationship lasts. Afterwards, invoices and accounting records, 6 years (Art. 30 of the Spanish Commercial Code, which also covers the 4-year tax period). |
| Product traceability (product, building site and delivery date) | 10 years from delivery, blocked, to handle claims about our products. |
| Email news | Until you withdraw your consent or object. We keep the list of unsubscriptions so that we do not write to you again. |
| Internal screen recordings | Raw footage, 30 days at most. The final training material uses sample records or blurred data. |
| Requests to exercise rights | 3 years from our reply. |
Where required by law, when data is deleted it is first blocked: it is only available to judges, courts and competent authorities, to deal with possible liabilities and during their limitation period, and it is not used for any other purpose (Art. 32 of the Spanish Data Protection Act, LOPDGDD). Once that period has elapsed, it is destroyed.
8. Your rights
You can exercise the following rights free of charge, at any time:
- Access: find out what data of yours we process.
- Rectification: correct any inaccurate data.
- Erasure: ask us to delete it.
- Objection: object to processing based on our legitimate interest, and in any case to receiving commercial communications.
- Restriction of processing: ask us to keep the data without using it in certain cases.
- Portability: receive the data you have provided to us in a structured, commonly used format.
- Withdrawal of consent, where the processing is based on it.
To exercise them, write to contacto@thermiabarcelona.com or to the postal address in section 1. Tell us which right you are exercising and, if necessary to identify you, we will ask you to prove your identity. We will reply within one month, which may be extended by two further months if the request is complex; in that case we will let you know within the first month.
To unsubscribe from our news, simply use the link included in every message.
If you wrote to us through Facebook, Instagram or WhatsApp and want us to delete that information, you will find the step-by-step procedure at thermiabarcelona.com/en/data-deletion/.
If you believe that we have not handled your rights correctly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
9. Security
We apply technical and organisational measures appropriate to the risk:
- Restricted access to the management system, with individual credentials and permissions by work area.
- Logging of changes made to records.
- Encrypted communications.
- Cryptographic verification of the authenticity of the messages we receive from Meta’s platforms.
- Access credentials stored outside the code.
10. Third-party data and accuracy
You are responsible for ensuring that the data you provide to us is true and up to date. If you provide us with data about other people, such as an end customer or a collaborator, you must have informed them beforehand of the content of this policy.
11. Changes to this policy
We may update this policy to adapt it to changes in the law or to new services. The version in force is always the one published on this page, with its last updated date. If the change significantly affects the use of your data, we will let you know through the contact details we have.
12. Forms and campaigns aimed at Peru
The pages and forms on this website aimed at Peru collect requests for THERMIA PERÚ S.A.C. (RUC 20552078102, Calle Los Telares 289, Urbanización Industrial Vulcano, Lima, Peru), a Peruvian company independent of ACCESORIOS DIMAC, S.L. Thermia Perú S.A.C. is the controller of that data, deals directly with the people who send it and informs them in its own privacy policy, in accordance with Peru’s Personal Data Protection Law 29733: thermiabarcelona.com/politica-privacidad-peru/ (in Spanish).
ACCESORIOS DIMAC, S.L. publishes those pages on its website, manages the campaigns and hosts the customer management system for Thermia Perú S.A.C. on its servers, as a data processor and only in accordance with its instructions.