Privacy policy

1. Data controller

2. Purposes of processing

At Sticon Sistemas S.L., we process personal data provided by data subjects for the following purposes:

• Managing enquiries and requests for information submitted via the website, email or telephone.
• Providing the contracted professional services (acoustic consulting, electro-acoustics, equipment supervision).
• Sending commercial communications related to our services, provided prior consent has been given.
• Complying with applicable legal and tax obligations.

3. Legal basis

• Consent (Art. 6(1)(a) GDPR): for sending commercial communications and using contact forms.
• Performance of a contract (Art. 6(1)(b) GDPR): for the provision of professional services.
• Legitimate interest (Art. 6(1)(f) GDPR): for administrative and accounting management.
• Legal obligation (Art. 6(1)(c) GDPR): for complying with tax obligations.

4. Data collected

Personal data we may collect includes:

• Full name.
• Email address.
• Phone number.
• Company and position (for professional clients).
• Postal address (when required to deliver the service).
• Browsing data collected via cookies (see Cookie policy).

5. Data retention

• Client data: 5 years after the end of the contractual relationship (tax obligations).
• Contact / enquiry data: 1 year from the last communication.
• Marketing data: until consent is withdrawn.

6. Recipients

Data will not be shared with third parties except where required by law. Data may be processed by:

• Web hosting provider (Dinahosting S.L., servers within the EU).
• Web analytics tools (Google Analytics), under the safeguards described in the cookie policy.

7. Data subject rights

You have the right to:

• Access: obtain confirmation of whether your personal data is being processed.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data when no longer needed.
• Objection: object to processing in certain circumstances.
• Restriction: request limitation of processing in specific cases.
• Portability: receive your data in a structured format and transfer it to another controller.

To exercise these rights, contact sticon@sticon.es with a copy of your ID.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

8. Security

Sticon Sistemas S.L. implements appropriate technical and organisational measures to ensure the security of personal data and prevent unauthorised alteration, loss, processing or access.

9. Acoustic monitoring with evidence recording (LEVELAD)

At certain locations identified by specific signage, Sticon Sistemas S.L. operates the LEVELAD environmental noise monitoring system, which continuously measures ambient sound levels. This system does not permanently record audio.

9.1. What data do we process and why?

Only when noise levels exceed the legal limits set by applicable regulations (Spanish Noise Act 37/2003; Royal Decree 1367/2007; and municipal ordinances), the system makes a brief audio recording (maximum 30 seconds) as evidence of the acoustic event.

These recordings may incidentally and unintentionally contain voices of people present in the area. No processing of such voices is performed (no transcription, biometric identification or voice recognition).

Data processed:

• Brief audio recordings (max. 30 seconds per event) in WAV format.
• Acoustic metadata: date and time of the event, measured sound level (dBA, dBC), acoustic zone, instrument calibration parameters.
• Cryptographic hash (SHA-256) of the audio file to guarantee its integrity.

9.2. Legal basis

• Legitimate interest (Art. 6(1)(f) GDPR): documenting exceedance events of legal noise limits to demonstrate regulatory compliance and provide evidence in administrative or judicial proceedings.
• Public interest (Art. 6(1)(e) GDPR): when the system is operated within the framework of acoustic pollution inspection and control by or for a public authority (Art. 26 of the Spanish Noise Act 37/2003).

The recording is brief (max. 30 seconds), conditional (triggered only by exceedance of the legal threshold) and not continuous. Voice capture is incidental to the acoustic purpose and voices are not processed to identify individuals.

9.3. Retention

Recordings are kept for a maximum of 90 days from creation. After this period, they are automatically deleted from both the measuring device and the central server.

9.4. Recipients

• Competent public authorities in acoustic pollution matters, within inspection or sanctioning proceedings.
• Courts of law, if the evidence is required in judicial proceedings.

No international data transfers are made. Processing and storage take place entirely on the local device and on servers located within the European Union.

9.5. Specific security measures

• Communications encrypted via VPN (WireGuard).
• Mandatory authentication for system access.
• SHA-256 cryptographic hash to guarantee the integrity of each recording.
• Recording disabled by default; only active after explicit configuration by an authorised technician.
• No image capture (audio only via measurement microphone).

9.6. Applicable regulations

The LEVELAD system operates in accordance with Spanish Noise Act 37/2003, Royal Decree 1367/2007, applicable municipal ordinances, Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).