ALEA IBERIA S.L. | VERSION 1.0
Last updated: 30th October 2026
This Notice explains how Alea Iberia S.L. handles personal data relating to visitors to alea.com, business contacts and prospects, people who submit website or campaign forms or arrange meetings, event contacts, and recipients or participants in business-to-business marketing campaigns. It does not govern personal data that Alea processes solely on behalf of a customer or operator as a processor or sub-processor; that processing is governed by the relevant customer’s privacy information and Alea’s contractual data-processing arrangements.
1 Who is responsible
Alea Iberia S.L. (NIF B6755364), with registered office at Carrer Roc Boronat 71, 08005, Barcelona, Spain, registered with the Commercial Registry of Barcelona (“Alea”, “we”, “us” or “our”), is the controller for the Processing described in this Notice to the extent that it determines the purposes and essential means of that Processing.
Privacy enquiries and rights requests: info@alea.com
2 Scope and sources of personal data
We obtain personal data directly from you; from your employer or organisation; through alea.com and technologies you have consented to; from event organisers, referral partners or public professional sources; and, where you interact with our campaigns, from advertising platforms such as LinkedIn or Google. Recruitment data collected through a separate recruitment platform is governed by the privacy information provided on that platform.
3 Personal data we use
Identity and professional data: name, employer, position, professional email address, telephone number, country and preferred language.
Enquiry and relationship data: messages, telephone enquiries, meeting requests, product or service interests, event interactions, correspondence and relationship history.
Website and device data: IP address, browser and device information, timestamps, referring page, pages viewed, interactions, approximate location and consent or cookie identifiers.
Campaign and lead data: campaign source, Lead Gen Form responses, advertising or audience identifiers, conversion events, engagement data and marketing preference, consent or objection status.
Compliance and security data: information reasonably required to protect systems, prevent misuse, comply with legal obligations or establish, exercise or defend legal claims.
4 Purposes, legal bases and retention
- Purpose
- Respond to enquiries and arrange meetings
- Data and legal basis
- Identity, professional, enquiry and relationship data. Steps requested before a contract and/or Alea’s legitimate interests in responding to business communications.
- Retention approach
- For as long as necessary to deal with the enquiry and reasonable follow-up. If a business relationship follows, relevant records are retained with that relationship; otherwise they are deleted or anonymised after Alea’s documented prospect-inactivity period.
- Purpose
- Manage business relationships and services
- Data and legal basis
- Professional contact, correspondence and relationship records. Contract where the individual is personally a party; otherwise legitimate interests in managing B2B relationships.
- Retention approach
- For the relationship and thereafter for applicable legal, regulatory, accounting or claims periods.
- Purpose
- Operate and secure the website
- Data and legal basis
- Technical logs, IP, device and security events. Legitimate interests in maintaining reliable and secure services and, where applicable, legal obligation.
- Retention approach
- For a risk-appropriate security period and longer only where required for an incident, investigation, legal obligation or claim.
- Purpose
- Measure and improve the website
- Data and legal basis
- Consented analytics identifiers, device data and interactions. Consent where non-essential storage, access or tracking is used.
- Retention approach
- According to the configuration disclosed in Cookie Settings and only for as long as necessary for the stated analytics purpose.
- Purpose
- B2B marketing
- Data and legal basis
- Professional contact details, preferences and engagement. Consent for communications by email or equivalent electronic means, as required by Article 21 of Law 34/2002 (LSSI), unless you are an existing customer and the communication concerns similar Alea products or services. Legitimate interests (Article 6(1)(f) GDPR and Article 19 LOPDGDD) for other B2B communications, subject to the right to object. Every electronic communication includes a simple, free opt-out.
- Retention approach
- Until you opt out, withdraw consent where applicable, or Alea’s documented inactivity rule applies. A minimal suppression record may be retained to ensure that an objection continues to be respected.
- Purpose
- LinkedIn and Google campaigns
- Data and legal basis
- Campaign, lead, cookie or advertising identifiers, visits, conversions and audience data, depending on the selected feature. Consent for non-essential tracking; other Processing only on an appropriate documented legal basis.
- Retention approach
- According to the selected platform feature, Alea’s configuration and the applicable consent or campaign lifecycle, subject to minimisation and deletion when no longer required.
- Purpose
- Compliance and legal claims
- Data and legal basis
- Relevant contact, transaction, security and correspondence records. Legal obligation and/or legitimate interests in establishing, exercising or defending claims.
- Retention approach
- For the applicable legal, regulatory or limitation period and any longer period required by a competent authority or ongoing proceedings. Where Article 32 LOPDGDD applies, data are blocked and made available only to courts, public authorities and competent bodies during that period.
| Purpose | Data and legal basis | Retention approach |
|---|---|---|
| Respond to enquiries and arrange meetings | Identity, professional, enquiry and relationship data. Steps requested before a contract and/or Alea’s legitimate interests in responding to business communications. | For as long as necessary to deal with the enquiry and reasonable follow-up. If a business relationship follows, relevant records are retained with that relationship; otherwise they are deleted or anonymised after Alea’s documented prospect-inactivity period. |
| Manage business relationships and services | Professional contact, correspondence and relationship records. Contract where the individual is personally a party; otherwise legitimate interests in managing B2B relationships. | For the relationship and thereafter for applicable legal, regulatory, accounting or claims periods. |
| Operate and secure the website | Technical logs, IP, device and security events. Legitimate interests in maintaining reliable and secure services and, where applicable, legal obligation. | For a risk-appropriate security period and longer only where required for an incident, investigation, legal obligation or claim. |
| Measure and improve the website | Consented analytics identifiers, device data and interactions. Consent where non-essential storage, access or tracking is used. | According to the configuration disclosed in Cookie Settings and only for as long as necessary for the stated analytics purpose. |
| B2B marketing | Professional contact details, preferences and engagement. Consent for communications by email or equivalent electronic means, as required by Article 21 of Law 34/2002 (LSSI), unless you are an existing customer and the communication concerns similar Alea products or services. Legitimate interests (Article 6(1)(f) GDPR and Article 19 LOPDGDD) for other B2B communications, subject to the right to object. Every electronic communication includes a simple, free opt-out. | Until you opt out, withdraw consent where applicable, or Alea’s documented inactivity rule applies. A minimal suppression record may be retained to ensure that an objection continues to be respected. |
| LinkedIn and Google campaigns | Campaign, lead, cookie or advertising identifiers, visits, conversions and audience data, depending on the selected feature. Consent for non-essential tracking; other Processing only on an appropriate documented legal basis. | According to the selected platform feature, Alea’s configuration and the applicable consent or campaign lifecycle, subject to minimisation and deletion when no longer required. |
| Compliance and legal claims | Relevant contact, transaction, security and correspondence records. Legal obligation and/or legitimate interests in establishing, exercising or defending claims. | For the applicable legal, regulatory or limitation period and any longer period required by a competent authority or ongoing proceedings. Where Article 32 LOPDGDD applies, data are blocked and made available only to courts, public authorities and competent bodies during that period. |
5 Website forms and LinkedIn Lead Gen Forms
When you submit a form on alea.com, Alea uses the information you provide to respond, manage your request and, where lawful, follow up about relevant Alea products or services. The form may be provided through a contracted form or CRM service. Those providers may process the submitted data on Alea’s behalf under appropriate contractual safeguards.
Alea uses LinkedIn Lead Gen Forms for B2B lead-generation campaigns. If you choose to submit a LinkedIn Lead Gen Form, LinkedIn makes the information submitted through the form available to Alea. Alea uses that information to respond to your interest, assess the potential business opportunity, arrange meetings and, where permitted by law, send relevant B2B follow-up communications. LinkedIn also processes information in connection with its platform and advertising services under its own privacy information and applicable terms. For LinkedIn Marketing Solutions products such as Lead Gen Forms, the Insight Tag, conversion tracking and Matched Audiences, LinkedIn acts as a controller for the Customer Personal Data it processes for those products under LinkedIn’s applicable Independent Controller Addendum.
Alea will use audience uploads, matched-audience features, conversion tracking or similar advertising tools only where the underlying data was obtained lawfully for that purpose and any required consent has been obtained. You may object to direct marketing at any time and may withdraw consent where Processing relies on consent.
6 Cookies, analytics and advertising technologies
Alea uses cookies and similar technologies as described in its Cookie Policy and Cookie Settings. Strictly necessary technologies may operate where legally exempt. Non-essential analytics, personalisation and advertising technologies are activated only in accordance with the consent choice presented to the visitor. Where Google Analytics, Google Ads, the LinkedIn Insight Tag or comparable services are enabled, the categories of data, purposes and storage periods are described in Cookie Settings.
7 Recipients and international transfers
We may share personal data, where appropriate and on a valid legal basis, with website hosting and development providers, form and CRM providers, communications and event tools, analytics and advertising platforms, professional advisers, relevant Alea group entities, competent authorities and a buyer or successor in a corporate transaction. Service providers acting on our behalf are subject to contractual data-protection obligations appropriate to their role.
Where personal data is transferred outside the EEA, we rely on an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required. Platform providers may also rely on their own applicable international-transfer arrangements for Processing for which they act as controllers. You may contact us using the details above to obtain further information about the safeguards applicable to a relevant international transfer.
8 Your choices and rights
Depending on applicable law, you may request access, rectification, erasure, restriction or portability of your personal data, or object to Processing based on legitimate interests. You may object at any time to direct marketing. Where Processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of Processing before withdrawal. We may ask for information necessary to verify your identity before acting on a request.
Requests may be sent to info@alea.com. You also have the right to complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD, www.aepd.es), which is Alea’s lead supervisory authority, or to another competent supervisory authority, including in the country where you live or work.
9 Business audience, security and changes
alea.com and Alea’s B2B campaigns are directed to business audiences and are not intended for children. Alea applies technical and organisational measures proportionate to the risks of the Processing. We may update this Notice when our Processing, technologies or legal obligations change. The “Last updated” date will be revised when a material update is published.