SGASGA GROUP
HomeEspañol

Privacy policy

At SGA we process personal data transparently and in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). This policy explains what data we process, why, for how long and what rights you have.

1. Who is the controller

SEED GLOBAL ADVISORING, S.L. ("SGA"), a company of SGA Group · Tax ID (NIF) B64980782 · Registered office: C/ Alzina, 1, local 1, 08024 Barcelona · Offices: C/ Bisbe Sivilla, 37, bajos, 08022 Barcelona (Spain) · Email: jpr@sgaoffice.com.

2. What data we process and why

2.1. Enquiries through the form or by email

  • Data: name, company, email address, phone number and whatever you tell us in your message.
  • Purpose: to answer your enquiry and, if you ask us to, send you information or a proposal.
  • Legal basis: your request (steps taken prior to entering into a contract, Art. 6(1)(b) GDPR) and our legitimate interest in answering the enquiries we receive (Art. 6(1)(f) GDPR).
  • The mandatory fields are needed to answer you; if you leave them empty, we will not be able to do so.
  • Retention: as long as needed to deal with your enquiry. If it does not lead to a relationship, we delete the data within 12 months at the latest.

2.2. Clients and suppliers

  • Data: the contact details of the people we deal with at your company (name, position, work email and phone number) and the data needed for invoicing.
  • Purpose: to provide the contracted services, manage the relationship and meet our accounting and tax obligations.
  • Legal basis: the contract (Art. 6(1)(b) GDPR), our legal obligations (Art. 6(1)(c) GDPR) and, for company contact persons, our legitimate interest (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD).
  • Retention: for the duration of the relationship and, afterwards, for the legal periods; for example, six years for accounting records (Art. 30 of the Spanish Commercial Code).

2.3. Information about services for clients

If you are a client, we may send you information about SGA services similar to those you have contracted (Art. 21.2 LSSI), based on our legitimate interest. You can object simply and free of charge when you sign up and in every communication you receive.

2.4. Contacting professionals at other companies (business prospecting)

We may contact professionals at companies that, given their activity, may be interested in our services. As you have not given us the data yourself in this case, we inform you of the following (Art. 14 GDPR):

  • Data: first and last name, position, company, work contact details (work email and phone number), public professional profile and public information about your company, such as its sustainability reports or its non-financial information statement.
  • Source:
    • publicly available sources: company websites, reports published by companies, public registers and public professional profiles, such as LinkedIn;
    • company databases from business information providers;
    • services that find and verify work email addresses.
  • Purpose: to present SGA's services to the person responsible for the related areas (sustainability, ESG and corporate reporting), via LinkedIn, work email or work phone.
  • Legal basis: our legitimate interest in making our services known to other companies (Art. 6(1)(f) GDPR and, where applicable, Art. 19 LOPDGDD). We only use professional data related to your position.
  • Your right to object: you can object at any time, without giving reasons, by replying to our message or writing to jpr@sgaoffice.com. We will stop contacting you and keep only the minimum data (name, company and email) on a suppression list, so that we do not contact you again.
  • Retention: while the data is useful for this purpose and, at most, two years from the last contact if no relationship has started.

2.5. Newsletter

If you subscribe to our newsletter:

  • Data: name and email address.
  • Purpose: to send you our news and content by email.
  • Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI). You can withdraw it at any time with the unsubscribe link included in every email.
  • Retention: until you unsubscribe.

2.6. Our LinkedIn page

If you follow our page or interact with it, we will process the data LinkedIn shows us, such as your name, your public profile and your comments. We do so to manage our presence on LinkedIn and reply to you, based on our legitimate interest. LinkedIn processes your data as a controller under its own privacy policy: https://www.linkedin.com/legal/privacy-policy.

3. Who we share data with

We only disclose your data to third parties where required by law (for example, to the tax authorities or to the courts) or, if your enquiry concerns the services of another SGA Group company (TBK, Violet Golden or Kei), to that company so that it can reply to you, based on our legitimate interest. In addition, some providers access the data only to provide their services to us, under a contract that regulates it (processors):

  • website hosting and maintenance;
  • email and cloud services;
  • sales management, prospecting and email-sending tools.

4. International transfers

Some of these providers, or their subcontractors, may process data outside the European Economic Area, for example in the United States. We only allow this with the safeguards required by the GDPR:

  • an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for participating companies;
  • or standard contractual clauses approved by the Commission.

You can ask for more information at jpr@sgaoffice.com.

5. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw at any time any consent you have given us. To do so, write to jpr@sgaoffice.com or send a letter to our offices, with the subject "Data protection". If we have reasonable doubts about your identity, we may ask you for information to confirm it.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

We do not take decisions based solely on automated processing that produce legal effects concerning you.

6. Security

We apply appropriate technical and organisational measures to protect your data against loss, unauthorised access or misuse (Art. 32 GDPR).

7. Minors

This website is aimed at companies and professionals, and is not intended for children under 14.

8. Changes to this policy

We may update this policy to reflect legal changes or changes in our activity. The version in force is the one published on this page.

Last updated: October 2026.