Apipana.io is the trade name under which four companies belonging to the same business group operate jointly (hereinafter, the “Apipana.io Group” or the “Group”).
Company | Tax ID (NIF) | Registered office |
HOLDING MARCUS BRACKELMANNS, S.L.U. (parent company of the Group) | B-75557736 | Plaza Isabel la Católica, nº 7, 2º dcha., 18009 Granada, Spain (headquarters) |
SECRETARYBIRDS, S.L.U. | B-70688361 | Plaza Isabel la Católica, nº 7, 2º dcha., 18009 Granada, Spain |
APIPANA OPERATIONS, S.L.U. | B-23975915 | Plaza Isabel la Católica, nº 7, 2º dcha., 18009 Granada, Spain |
APIPANABIRDS SEVILLA, S.L.U. | B-75397604 | Plaza Isabel la Católica, nº 7, 2º dcha., 18009 Granada, Spain |
The Group has three workplaces, where the staff of the four companies work regardless of which company employs them:
Workplace | Address | Registered and tax address |
«Granada 1» | Plaza Isabel la Católica, nº7, 2º dcha., 18009 Granada, Spain | Group headquarters and registered and tax address of the four companies |
«Granada 2» | Calle Puentezuelas, nº39, 18002 Granada, Spain |
– |
«Sevilla» | Avenida Carlos III, Edificio de la Prensa, 41092 Seville, Spain |
– |
The processing of personal data carried out through the website, contact forms, newsletter, corporate social media profiles, recruitment for Group vacancies, corporate events and the shared Internal Reporting System (ethics/whistleblowing channel) is jointly determined by the four companies above, which act as joint controllers under Article 26 GDPR, by virtue of the joint controllership agreement entered into between them. Video surveillance at the three workplaces, by contrast, is the sole responsibility of HOLDING MARCUS BRACKELMANNS, S.L.U., as the owner and sole operator of that system (see section 2). Where this policy refers to «the joint controllers» or «the Group» as the controller of a processing activity, this means the four companies identified in the table above. Apipana.io is a brand and does not in itself determine who is the data controller; that status corresponds to the companies identified in the table above, as set out in this section.
|
|
Single point of contact | HOLDING MARCUS BRACKELMANNS, S.L.U. – dpo@apipana.io – Plaza Isabel la Católica, nº 7, 2º dcha., 18009 Granada, Spain. Regardless of this allocation, you can exercise your rights and send your queries to any of the four joint controllers. |
Data Protection Officer (DPO) | Mr Manuel Mas Albéniz (Masalbe Servicios Globales, S.L.), external Data Protection Officer common to the Group, registered with the Spanish Data Protection Agency – dpo@apipana.io. Lawyer registered with the Granada Bar Association (ICAGR) No. 5988 |
Internal Privacy Officer (Compliance Officer) | Ms Ana Aguilera Segovia — ana.aguilera.segovia@apipana.io — coordinates the Group’s internal data protection compliance, without prejudice to the DPO’s independent performance of their duties under Articles 38 and 39 GDPR. |
General email | |
Telephone | (+34) 670 684 001 |
You can request a copy of the essential aspects of the joint controllership agreement by writing to dpo@apipana.io
Apipana.io is a registered European Union trade mark (no. 019307533, classes 9 and 42) and the corporate illustration is protected as a registered Community design (no. 015131307-0001). Both rights are exclusively owned by HOLDING MARCUS BRACKELMANNS, S.L.U. (NIF B-75557736), which has granted a licence to use them to its subsidiaries SECRETARYBIRDS, S.L.U., APIPANABIRDS SEVILLA, S.L.U. and APIPANA OPERATIONS, S.L.U. Ownership of the trade mark does not determine who is the controller of personal data processing: that status corresponds exclusively to the entities identified in the previous section.
Each Group company keeps its own Record of Processing Activities under Article 30 GDPR, reflecting, where applicable, its status as joint controller, which is available to the supervisory authority.
Processing activity | Data processed | Legal basis (Article 6 GDPR) | Retention | Controller(s) |
Handling enquiries and requests received through the web form, email or telephone | Identification and contact data and content of the message | Art. 6.1.b (pre-contractual measures) or 6.1.f (legitimate interest in responding to those who contact us) | 1 year from the last contact, unless it leads to a contractual relationship | The four Group companies (joint controllers) |
Management of relationships with customers and suppliers (contracting, invoicing, support) | Identification, contact, professional, financial and billing data | Art. 6.1.b (contract) and 6.1.c (tax and accounting obligations) | Term of the contract and, after it ends: 4 years (Spanish General Tax Law 58/2003) and 6 years (Article 30 of the Spanish Commercial Code) | The Group company with which you have contracted (Secretarybirds, Apipana Operations or Apipanabirds Sevilla, depending on the workplace or the subject matter of the contract), as sole controller of this relationship |
Sending of the newsletter and commercial communications under the Apipana.io brand | Name, email address and preferences | Art. 6.1.a GDPR (consent). For customers with a prior contractual relationship: Art. 6.1.f GDPR (legitimate interest), in accordance with Article 21.2 LSSI-CE, for communications about similar services, with the possibility of objecting in each communication. | Until you unsubscribe or withdraw your consent; unsubscription data are kept blocked to evidence the objection | The four Group companies (joint controllers) |
Recruitment processes for vacancies at any of the Group companies (CVs sent to recruitment@apipana.io) | CV, education, experience, contact details and, where applicable, results of tests and interviews | Art. 6.1.b (pre-contractual measures at the candidate’s request) | Until the process is completed and, in addition, 1 further year if you give your express consent to join the Group’s active talent pool (revocable at any time) | The four Group companies (joint controllers), as centralised recruitment |
Management of corporate social media profiles | Data that followers make public on the platform and their interactions | Art. 6.1.f (legitimate interest in publicising our activity) | For as long as the interaction continues or until erasure is requested, insofar as the platform allows | The four Group companies (joint controllers) |
Registration for and management of corporate events, including the capture and dissemination of images | Identification and contact data; image and voice; where applicable, accessibility or dietary requirements | Art. 6.1.b (performance of the registration) for the event; Art. 6.1.a (express consent, obtained in advance and separately) for images | 1 year after the event (without prejudice to tax periods); images until consent is withdrawn | The four Group companies (joint controllers) |
Video surveillance at the Group’s three workplaces (Granada 1, Granada 2 and Seville) | Images captured by the video surveillance system | Art. 6.1.f (legitimate interest in the security of people, property and premises); Article 89 LOPDGDD | Maximum 1 month from capture (Article 22.3 LOPDGDD), unless retained to evidence offences before the competent authorities | HOLDING MARCUS BRACKELMANNS, S.L.U. (sole controller, as owner and operator of the Group’s single system) |
Shared Internal Reporting System (ethics / whistleblowing channel) | Data provided by the whistleblower and data generated during the investigation | Art. 6.1.c in conjunction with Title VI of Spanish Law 2/2023 of 20 February | Maximum 3 months from receipt of the report, unless proceedings are under way (see the specific channel information) | The four Group companies (joint controllers), under the common group system provided for in Article 11 of Law 2/2023. Full information is available at: https://canaletico.i2-ethics.com/apipana |
Technical website browsing logs | IP address, browser, operating system, pages visited, date and time | Art. 6.1.f (security of systems and incident detection) | 7 days for the IP address | The four Group companies (joint controllers) |
Cookies and similar technologies | As indicated in the Cookie Policy | Art. 6.1.a (consent), except for technically necessary cookies | See Cookie Policy | See Cookie Policy |
Accuracy of data. The data provided must be true and up to date; users undertake to inform us of any change. If you provide us with data of third parties, you must be entitled to do so and inform them beforehand. For our part, we will inform those persons in accordance with Article 14 GDPR in our first communication with them, unless one of the exceptions provided for in that article applies.
Mandatory or optional fields. In our forms, fields marked with an asterisk (*) are necessary to handle the request; if they are not completed, the request cannot be processed. All other fields are optional and leaving them blank has no consequence.
As a general rule, the data come from the data subject. In recruitment processes we may also consult information that candidates have published on professional social networks (for example, LinkedIn) and the references they themselves provide, limiting the consultation to the data relevant to the position. We do not consult personal profiles or carry out general internet searches on candidates.
Corporate social media profiles
The Apipana.io Group has corporate profiles on the following social networks:
These are our only official profiles. Any other profile using the Apipana.io brand that is not on this list is not managed by the Group.
With regard to the data of people who follow, interact with or comment on these profiles, the Group companies act as joint controllers together with the relevant platform, in accordance with the case law of the Court of Justice of the European Union (cases C-210/16, Wirtschaftsakademie, and C-40/17, Fashion ID). This joint controllership is governed by the agreements that each platform makes available to holders of corporate profiles. Our processing is limited to what the social network itself allows corporate profiles to do, and each platform also processes the data in accordance with its own privacy policy.
We may inform our followers, through any means permitted by the social network, about our news, activities and events. We will never extract data from social networks without the prior and express consent of the data subject. You can exercise your rights both with the Group and with the platform. Where the effective exercise of a right depends on the settings of your personal profile on the social network, we will help you as far as we can.
LinkedIn Insight Tag
This website uses, subject to prior consent, the LinkedIn Insight Tag to measure the effectiveness of our LinkedIn campaigns. In the collection and transmission of these data to LinkedIn, the Group companies and LinkedIn Ireland Unlimited Company act as joint controllers. Any subsequent processing by LinkedIn is its sole responsibility. Further information is available in our Cookie Policy.
We do not sell your data or disclose it to third parties for their own advertising purposes. The following may access or receive your data:
Some of our providers are established outside the European Economic Area or access the data from third countries. In such cases we apply one of the following safeguards:
You can request information about the safeguards applied to a specific provider and a copy of them by writing to dpo@apipana.io
In accordance with Spanish Law 2/2023 of 20 February, the Group has an Internal Reporting System common to its member companies, under Article 11 of that Law, which allows breaches to be reported, including anonymously.
Full information on how the channel works, the available reporting channels and your safeguards is available at: https://canaletico.i2-ethics.com/apipana
The General Data Protection Regulation (GDPR) and the Spanish LOPDGDD grant you the following rights, which you can exercise free of charge against any of the Group’s joint controllers, at any time:
You have the right to obtain confirmation as to whether or not we are processing personal data concerning you and, if so, to access those data and the following information:
You have the right to have inaccurate personal data concerning you rectified and incomplete data completed, including by means of a supplementary statement.
You have the right to obtain the erasure of your personal data where one of the following grounds provided for in Article 17 GDPR applies:
This right is not absolute: we may retain the data, to the extent necessary, where processing is required for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research or statistical purposes, or for the establishment, exercise or defence of legal claims.
You have the right to obtain restriction of the processing of your data, which means that we will only store them, without using them, in any of the following cases:
You have the right to object, on grounds relating to your particular situation, to our processing of your data where the legal basis is legitimate interest. In that case, we will stop processing them unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
Where you object to the processing of your data for direct marketing purposes (for example, to stop receiving our commercial communications or newsletter), we will stop processing them for that purpose immediately and without you having to give any reason.
Where the processing is based on your consent or on the performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to have them transmitted directly to another controller where technically feasible.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (see also section 8 of this Policy).
Where the processing is based on your consent, you have the right to withdraw it at any time, as easily as you gave it. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
To exercise any of the above rights, write to dpo@apipana.io or to Plaza Isabel la Católica, nº 7, 2º dcha., 18009 Granada, Spain, stating the right you wish to exercise. Regardless of the single point of contact indicated in section 1, you can contact any of the four joint controllers. You may use the AEPD’s template forms (www.aepd.es). We will only request additional identification documents if there are reasonable doubts about your identity. We will respond within one month, which may be extended by two further months for complex requests, in which case we will inform you of the extension and the reasons for it.
If you consider that the processing does not comply with the regulations, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, Spain — www.aepd.es), without prejudice to contacting our DPO beforehand.
We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you. (If we use artificial intelligence systems to interact with users — for example, chatbots — we will inform you clearly and unambiguously, at the latest at the time of the first interaction, in accordance with Article 50 of Regulation (EU) 2024/1689, the AI Act).
Our services are intended for adults. Where processing is based on consent and the data subject is under 14 years of age, the consent of their parents or guardians will be required (Article 7 LOPDGDD). In in-person activities involving minors, we will put in place the means to obtain the authorisation of their legal representatives.
We apply appropriate technical and organisational measures in accordance with Articles 24, 25 and 32 GDPR, aimed at ensuring the confidentiality, integrity, availability and resilience of systems, restoring access to data in the event of incidents and regularly testing their effectiveness, including pseudonymisation and encryption where appropriate. The Group is in the process of implementing an Information Security Management System in accordance with the ISO 27001 standard. We have an internal procedure for managing security breaches and notifying them to the AEPD (Article 33 GDPR) and, where applicable, to the data subjects (Article 34 GDPR). No security measure on the internet is infallible, so we cannot guarantee absolute invulnerability.
The measures applied by the Group companies to comply with the GDPR and the LOPDGDD are as follows:
Related legislation:
If you would like more information about the legislation governing your rights, these are the main laws on which this privacy policy is based:
CONTACT: If you need any clarification about this Privacy Policy, wish to raise a question or complaint or exercise your rights, you can write to our Data Protection Officer (DPO) using the details below, stating «Data Protection» in the subject line
The use of cookies and tracking technologies is governed by our Cookie Policy (https://apipana.io/cookie-policy/).
We may update this policy to adapt it to new legislation or case law or to changes in our processing activities or in the structure of the Group. We will publish any changes on this page reasonably in advance and will always indicate the date of the last update.
Last updated: 8 October 2026
