Privacy Policy

We are providing you with this Privacy Policy to give you detailed information about how we process your personal data and protect your privacy and the information you provide to us.

If, in the future, we make changes to this Privacy Policy, we will notify you through this website or by other means so that you can be aware of the new privacy terms that are adopted.

Below, in a question-and-answer format, we provide information on the conditions under which our organization processes your personal data:

Who is responsible for processing your data?

1. Identity: MONEY EXCHANGE, A. Tax ID: A81105132.
2. Mailing address: Paseo de Santa María de la Cabeza 10, 28045 –
3. Phone: +34 917617170
4. Email: [email protected]

Who is the organization’s Data Protection Officer (DPO), and how can they help you?

The Data Protection Officer (DPO) is a legally designated position whose primary functions are to inform and advise our organization on its obligations regarding personal data protection and to monitor compliance with those obligations.

In addition, the DPO serves as the point of contact for any issues related to the processing of personal data; therefore, if you have any questions, concerns, or suggestions regarding how we use your personal data, you may contact the DPO:

1. Identity of the Data Protection Officer: Picón & Asociados Abogados Derecho y Nuevas Tecnologías, S.L.
2. DPO contact information: [email protected], Calle Hermanos Pinzón 3 Bajo, 28036 – Madrid.

For what purpose do we process your personal data?

We process the personal data you provide to us for the following purposes:

1. Customer relationship management, as well as billing and collection. The provision of data for this purpose by our customers is mandatory; failure to do so will prevent the fulfillment of the contract. To this end, MONEY EXCHANGE will complete the Money Order Form with the information provided by the customer when conducting the transaction, if necessary.
2. Online registration for customers to access the services offered by MONEY. Providing the required information for this purpose is mandatory; otherwise, registration will not be possible.
3. To comply with the obligations imposed by regulations regarding the Prevention of Money Laundering and Terrorist Financing. To this end, risk profiles of data subjects may be created using an alert system tailored to the type, parties involved, and amount of the transactions. The customer is required to provide personal data for this purpose. If you do not provide this information, we will not be able to provide you with the requested services.
4. Managing relationships with our suppliers, as well as billing and payment for services. To this end, suppliers are required to provide us with their information; otherwise, the contract cannot be fulfilled.
5. To process any requests for information, suggestions, or complaints you may submit to us; to contact the sender of the information; to respond to your request or inquiry; and to follow up on it. Providing your data for this purpose is voluntary; however, if you do not do so, we will be unable to respond to your request, inquiry, or complaint. Therefore, providing your personal data for these purposes is a necessary requirement for us to address such requests.
6. Sending commercial communications about our products. If you are our customer, we will send you such communications unless you indicate otherwise when providing your information or, at a later time, by notifying us through any means.
   Conversely, if you do not purchase our products or services, we will not send you commercial information, unless you expressly authorize us to do so. This authorization is voluntary, and refusing it will simply mean that you will not receive commercial offers for our products or services.
   In connection with sending these communications, based on the information you provide, we may create commercial profiles to offer you the products and services that best match your interests.
   The processing of data for the indicated commercial purposes is not mandatory; however, you will not receive commercial communications from the company unless you provide your consent or object to them.
7. If you submit your resume to us, we will process it to gather information about individuals who wish to complete an internship and/or work with us, in order to carry out the corresponding recruitment processes. If interested individuals provide their personal data to work as agents or correspondents for MONEY EXCHANGE—using the data collection forms created for this purpose or any other means of contact—this data will be processed to evaluate their employment. Providing your data for this purpose is not mandatory; however, you will not be able to participate in our selection or hiring processes if you do not provide it.
8. If you become our friend or follower on social media, we will process your data to keep you informed of our activities and promotions through those channels. Providing your data for this purpose is voluntary; however, if you do not do so, you will not be able to become our friend or follower on the corresponding social media platform. The categories of data processed for this purpose are as follows:

How long will we retain your data?

We retain your data only for as long as necessary to fulfill the purpose for which it was collected, to comply with the legal obligations imposed on us, and to address any potential liabilities that may arise from fulfilling the purpose for which the data was collected.

Data used to manage relationships with customers and suppliers, as well as for billing and collection of services, will be retained for that purpose for as long as the contract remains in effect. Once that relationship has ended, if applicable, the data may be retained for the period required by applicable law and until any liabilities arising from the contract have expired.

Data required to comply with the obligations imposed by regulations on the prevention of money laundering and terrorist financing will be retained for a period of 10 years.

Customer web log data will be retained for as long as necessary to comply with legal obligations, as indicated in the preceding paragraphs, where applicable.

Data used to send marketing communications about our products or services will be retained indefinitely until, if applicable, you inform us of your wish to have it deleted or your desire to stop receiving such communications.

The data of potential customers who do not end up purchasing our products or services and who do not wish to receive marketing information will be deleted once it is confirmed that the transaction will not take place. In the event that the prior relationship between the parties—even if not yet finalized—could give rise to potential liabilities, the data will be retained until such liabilities are time-barred.

Data processed to address requests, inquiries, or complaints will be retained for as long as necessary to respond to them and definitively close them. Thereafter, it will be retained as a record of communications for a period of one year, unless you request its deletion sooner.

The information you provide to us or that we obtain for the purpose of participating in a specific open recruitment process will be retained until that process is completed and will be deleted thereafter, unless the candidate is selected, in which case it will be added to their employee file. If candidates who are not selected wish for us to retain their resumes for future recruitment processes, they must expressly request this via email. In this case, as well as when you voluntarily submit your resume simply so that we may consider it for future recruitment processes, the data will be retained for a maximum of one year from the date of the last update. You must keep the personal data you provide to us up to date, particularly information regarding your education and professional experience.

Occasionally, during the recruitment process, we may use job portals to search for candidates who match the professional profiles we are interested in, subject to the privacy policies of those platforms. The categories of personal data processed in these cases are as follows: identifying information, personal characteristics, employment details, academic and professional information, and any other information the candidate has posted on the job portal or included in their resume.

In the event that interested parties provide their personal data to work as agents or correspondents for MONEY EXCHANGE, this data will be retained for the duration of the agent and correspondent hiring processes and subsequently deleted, unless they are hired. If interested parties who are not hired wish for us to retain their data for future hiring processes, they must expressly request this via email. In the latter case, as well as when you voluntarily provide us with your data simply so that we may take it into account in future agent and correspondent recruitment processes, the data will be retained for a maximum of one year from the last update; you must keep the personal data you provide to us up to date.

Data provided through social media will be retained as long as you remain our friend or follower on the respective platform.

What is the legal basis for processing your data?

The legal basis for processing customer and supplier data is the performance of the contract. Data from the customer web log will be processed for the purpose of taking pre-contractual measures, to the extent that such information is necessary so that customers can subsequently conduct transactions via the website in accordance with the terms of service offered by MONEY EXCHANGE.

The legal basis for processing data to comply with the obligations imposed regarding the prevention of money laundering and terrorist financing is compliance with the legal obligation established by Law 10/2010, of April 28, on the prevention of money laundering and terrorist financing.

Our proactive offering of products and services to our customers is based on a legitimate business interest, which consists of being able to offer them additional products or services and thereby build their loyalty. This legitimate interest is recognized by applicable law (the General Data Protection Regulation), which expressly permits the processing of personal data on this legal basis for direct marketing purposes. However, we remind you that you have the right to object to this processing of your data, and you may do so through any of the means provided for in this clause.

The prospective offering of products and services to individuals who, having expressed interest in them, are not—or have not yet become—our customers is based on the consent of the data subject. Such consent may be revoked at any time, with the sole consequence being that the individual will no longer receive marketing communications, and without affecting any data processing that took place prior to the revocation.

The processing of personal data to respond to your requests for information, inquiries, and complaints is based on the consent of the data subject. You may withdraw this consent at any time; however, this will not affect the lawfulness of any processing carried out prior to such withdrawal.

The legal basis for processing the resumes you submit to us or that we obtain from job platforms for a specific open recruitment process is the existence of a pre-contractual relationship. Additionally, further data may be collected during interviews or recruitment processes, and the processing of such data is based on the same legal basis.

The legal basis for processing the data contained in your resume—whether you have asked us to retain it following a recruitment process or have submitted it to us on your own initiative—is your consent, which you may revoke at any time. However, any data processing carried out prior to the revocation of consent will remain lawful.

If interested parties provide their personal data to work as agents or correspondents for MONEY EXCHANGE, the data will be processed on the basis of a pre-contractual relationship, provided that a hiring process is underway. If additional data is collected during the hiring process, the processing would be based on the same legal basis.

However, if data subjects provide their personal data to work as agents or correspondents for MONEY EXCHANGE without an open hiring process, or if, having participated in one, they have asked us to retain their data for future processes, the legal basis is consent, which may be revoked at any time. However, data processing carried out prior to the revocation of consent will not lose its lawful basis simply because consent has been revoked.

Data provided through social media will be processed on the legal basis of your consent, which you may revoke at any time, although this will not affect the lawfulness of any processing carried out prior to such revocation.

The categories of data processed are those requested in each case on the form or in the contract through which you provide us with your data.

To whom will your data be disclosed?

The data will be disclosed to the following entities:

1. The competent public authorities, including judges and courts, in the cases provided for by law and for the purposes defined therein.
2. The financial institutions through which collections are managed and
3. In payment orders, to the foreign entity or correspondent to which the order is addressed or from which it originates, as indicated on the front of the invoice or receipt. In this regard, the data will be transferred to the various destination or origin countries of the transfers, depending on the specific case. These countries may not have a level of data protection comparable to that provided for in European legislation, and there may be no adequacy decision by the Commission in this regard; however, the transfer is necessary for the performance of the contract with the data subject. If required by the laws of the country of origin or destination, it may be necessary to disclose additional customer data in compliance with such regulations.

Although this does not constitute a transfer of data, third-party companies acting as our service providers may access your information in order to provide the service. These processors access your data in accordance with our instructions and may not use it for any other purpose; they are required to maintain the strictest confidentiality and are bound by a contract in which they agree to comply with the requirements of current regulations regarding the protection of personal data.

Customer data will be transferred to Mailchimp, the company that provides MONEY EXCHANGE with email marketing services, which is owned by The Rocket Science Group LLC (U.S.). Mailchimp adheres to the Data Privacy Framework, ensuring that it implements appropriate security measures for international data transfers: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000TXVKAA4&status=Active

In any case, you can request more information using any of MONEY EXCHANGE’s contact details.

What are your rights when you provide us with your personal information?

Any person has the right to obtain confirmation as to whether or not we are processing personal data concerning them. Data subjects have the right to access their personal data, as well as to request the correction of inaccurate data or, where applicable, to request its erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

Under the conditions set forth in the General Data Protection Regulation, data subjects may request that the processing of their data be restricted or that their data be transferred; in such cases, we will retain their data solely for the purpose of asserting or defending legal claims.

Under certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. If you have given consent for a specific purpose, you have the right to withdraw it at any time, without this affecting the lawfulness of the processing based on the consent given prior to its withdrawal. In such cases, we will cease processing the data or, where applicable, cease processing it for that specific purpose, except for compelling legitimate grounds or the exercise or defense of potential claims.

In addition, data protection regulations allow you to object to decisions based solely on the automated processing of your data, where applicable.

The aforementioned rights are characterized by the following:

1. This right may be exercised free of charge, except in the case of manifestly unfounded or excessive requests (e.g., repetitive requests), in which case a fee proportional to the administrative costs incurred may be charged, or the request may be denied
2. You may exercise these rights directly or through your legal representative or volunteer.
3. A response to your request must be provided within one month; however, depending on the complexity and number of requests, this deadline may be extended by an additional two months.
4. We are required to inform you of the means by which you can exercise these rights, which must be accessible, and we may not deny you the right to exercise them solely because you choose a different method. If the request is submitted electronically, the information will be provided electronically whenever possible, unless you request otherwise.
5. If, for any reason, your request is not processed, we will inform you, within one month at the latest, of the reasons for this and of your right to file a complaint with a supervisory authority.

To help you exercise these rights, we have provided the links to the request forms for each of them below:

1. Form for Exercising the Right of Access
2. Form for Exercising the Right to Rectification
3. Form for Exercising the Right to Object
4. Form for Exercising the Right to Erasure (the “Right to Be Forgotten”)
5. Form for Exercising the Right to Restriction of Processing
6. Right to Data Portability Exercise Form
7. Form for Exercising the Right Not to Be Subject to Automated Individual Decision-Making

All of the rights mentioned above may be exercised through the contact information provided at the beginning of this clause.

MONEY EXCHANGE reserves the right to request, in the event of any doubt regarding the applicant’s identity, a photocopy or scanned copy of their national ID card or equivalent document, or a document proving their authority to act as a representative, if the right is exercised through a representative.

If your rights have been violated in any way, especially if you have not received a satisfactory resolution, you may file a complaint with the Spanish Data Protection Agency (contact information available at www.aepd.es) or another competent supervisory authority. You can also obtain more information about your rights by contacting these agencies.

How do we protect your personal data?

We are firmly committed to protecting the personal data we process. We use physical, organizational, and technological measures, controls, and procedures that are reasonably reliable and effective, designed to preserve the integrity and security of your data and ensure your privacy.

In addition, all staff members with access to personal data have been trained and are aware of their obligations regarding the processing of personal data.

In the contracts we enter into with our suppliers, we include clauses requiring them to maintain confidentiality regarding the personal data to which they have had access in connection with the work commissioned, as well as to implement the necessary technical and organizational security measures to ensure the ongoing confidentiality, integrity, availability, and resilience of the systems and services used to process personal data.

All of these security measures are reviewed periodically to ensure their appropriateness and effectiveness.

However, absolute security cannot be guaranteed, and no security system is impenetrable; therefore, in the event that any information we process and control is compromised as a result of a security breach, we will take appropriate measures to investigate the incident, notify the Supervisory Authority, and, where appropriate, notify those users who may have been affected so that they can take the necessary steps.

What are your responsibilities as a data subject?

By providing us with their personal information, the individual doing so warrants that they are at least 14 years old and that the information provided is true, accurate, complete, and up-to-date.

For these purposes, the data subject is responsible for the accuracy of the information and must keep it properly updated so that it reflects his or her actual situation, and is liable for any false or inaccurate information he or she may provide, as well as for any direct or indirect damages that may result.

If you provide data regarding third parties, you are responsible for informing them in advance of all the provisions of Article 14 of the General Data Protection Regulation, in accordance with the conditions set forth in that provision.

How did we obtain your information?

In cases where user registration is carried out through social media platforms, the personal data we process will come from the relevant social media platform, to which the data subject will have previously provided such data for the purposes set forth in its corresponding privacy policies. The categories of data we will collect from the relevant social media platform are those listed on our registration form and which you have provided to that platform. If, in order to register on our website, additional data beyond what is provided by the social media platform is required, you must provide it on our registration form, subject to the privacy conditions set forth in this Policy.