Privacy policy

Distribuciones Nespit SL processes your personal data when you use the website, when you apply for a trade account, when you send us your CV and if you accept the analytics cookies. For each case, this policy sets out what data is processed, for what purpose, on what legal basis, for how long and who else sees it. Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Ley Orgánica 3/2018, de protección de datos personales y garantía de los derechos digitales, apply.

Who is the controller

What data we process and why

If you apply for a trade account

• Data processed: the data in the account application form, which are your business name, its type and area, a contact telephone number and whether you are applying for a business or for your home, and whatever you tell us by WhatsApp, telephone or email.
• Purpose: to reply to you, to visit you and to assess your trade account application.
• Legal basis: taking steps, at your request, prior to entering into a contract, which is what applying for a trade account is (Article 6(1)(b) of the GDPR).
• Retention period: one year, if you do not become a customer. If you do, your data becomes part of the commercial relationship.

If you are a customer

• Data processed: the contact and billing details of your business, and your orders.
• Purpose: to prepare and deliver orders, and to invoice them.
• Legal basis: the contract with your business (Article 6(1)(b) of the GDPR) and accounting and tax obligations (Article 6(1)(c)).
• Retention period: for as long as the commercial relationship lasts and, after that, for the periods set by law. Accounting documentation is kept for six years (Article 30 of the Código de Comercio).

If you send us your CV

• Data processed: the data in the job application form, which are your full name, a telephone number, an email address and the position you are interested in, and your CV. You do not need to include health data or other special categories of data.
• Purpose: to assess your application for the company's positions, and to write to you to confirm that we have received it.
• Legal basis: your consent, which you give by sending it (Article 6(1)(a) of the GDPR) and which you can withdraw at any time.
• Retention period: one year from the date we receive it, after which it is deleted. If you want us to delete it sooner, you only need to ask.

If you accept the analytics cookies

• Data processed: how you browse the website (the pages viewed, where you arrive from, the type of device), with an identifier that does not say who you are.
• Purpose: to know which pages are read, counted in aggregate form.
• Legal basis: your consent in the cookie notice (Article 6(1)(a) of the GDPR and Article 22(2) of Ley 34/2002).
• Retention period: Google Analytics keeps each user's data for 14 months and each visit's data for 2 months, which is how the Nespit account is configured. The details of each cookie are in the cookie policy.

Who else sees your data

Nobody uses your data for their own purposes. They see it because of what they do:

• Website and email hosting: Hostinger, a company in the European Union, with the website server in France.
• The company that maintains the website and manages its forms, acting as data processor.
• Google, for Google Analytics statistics, only if you accept its cookies. Google may process data in the United States, covered by the EU-US Data Privacy Framework, under which it is certified.
• WhatsApp, if you write to us there: messages go through its service, which has its own privacy policy.
• Transport companies, only with the delivery details, for shipments to customers outside Mallorca.
• Public authorities, when required by law, such as the Spanish tax authorities (Hacienda) in relation to invoicing.

Your rights and how to exercise them

At any time you can request:

• Access: to find out what data of yours we process.
• Rectification: to correct any that is inaccurate.
• Erasure: to have us delete your data when it is no longer needed.
• Objection and restriction: for us to stop processing it, or to process it only for what is essential.
• Portability: to receive it in a format you can take elsewhere.
• Withdrawal of your consent, where processing depends on it, without affecting what was done before.

Write to administracion@nespititalia.com saying which right you want to exercise. If we need to verify that it is you, we will ask you for only what is needed to do so. We reply within the one-month period set by the GDPR.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at www.aepd.es (opens in a new tab).

Automated decisions

No automated decisions are made and no profiling is carried out with your data.

Last updated: 5 November 2026.