Privacy Policy

Last updated: May 2026

This Privacy Policy governs the processing of personal data that the user provides through this website (hereinafter, "the Site"), in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (GDPR) and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data Controller and Data Processor

Data Controller: MGS Seguros Generales y Reaseguros, S.A. ("MGS Seguros"), with operator registration code C079439925304H in the Spanish Insurance Distributors Register (DGSFP).

Data Processor: Alba Fabregat Solé, exclusive insurance agent for MGS Seguros, who acts on behalf of the Data Controller under Article 28 GDPR.

• Identity of the processor: Alba Fabregat Solé
• Spanish Tax ID (NIF): 39925304H
• Address: Partida Illetes, 4 — 43747 Miravet (Tarragona, Spain)
• Professional office: Carrer d'Antoni Asens, 23 — 43740 Móra d'Ebre (Tarragona, Spain)
• Email for the exercise of data protection rights: info@albafabregat.es
• General contact email: info@albafabregat.es
• Phone: +34 650 54 35 38
• Exclusive agent code: 38298

2. Personal data processed

The following personal data are collected through the contact form on the Site:

• Identification data: name.
• Contact data: phone number and email address.
• Data about the request: type of customer (individual or business), insurance product family of interest and any free-text message the user chooses to provide.
• Technical data associated with the submission: date and time of submission, source IP address and HTTP header data strictly necessary to log the operation and prevent abuse.

The user is responsible for the accuracy of the data provided. Filling in the fields marked as mandatory is a necessary requirement for the processor to handle the request.

Special categories of personal data are not collected or requested through the Site (health data, sensitive financial data, data on sexual orientation, religion, etc.). Any data of this nature, if necessary for processing an insurance contract, will be collected later and through channels other than the Site.

3. Purposes of processing

The personal data provided through the Site are processed for the following purposes:

1. Handling the contact request: contacting the user to address their request for information or advice on insurance products.
2. Personalised study of insurance needs and preparation of proposals for insurance products distributed by MGS Seguros, where applicable.
3. Maintaining an internal record of commercial opportunities (CRM) within the processor's professional management system, in order to organise the follow-up of the request and, if applicable, the subsequent contracting.
4. Compliance with legal obligations arising from insurance distribution regulations and data protection regulations.

The data will not be used to send commercial communications unrelated to the original request without the prior, specific consent of the user.

4. Legal basis for processing

• User consent (art. 6.1.a GDPR), provided by ticking the acceptance box of this Privacy Policy in the contact form.
• Performance of pre-contractual measures at the request of the data subject (art. 6.1.b GDPR) where the user's request aims at preparing an insurance contract.
• Compliance with legal obligations (art. 6.1.c GDPR) applicable to insurance distribution activity (Spanish Royal Decree-Law 3/2020).

5. Retention period

Personal data will be retained for a maximum period of twenty-four (24) months from the user's last interaction, unless:

• The user expressly requests their deletion before that.
• The user's request results in the actual contracting of an insurance policy, in which case subsequent processing will be governed by the privacy policy of MGS Seguros, in its capacity as insurance company.
• A legal obligation requires a different retention period.

Once the period has elapsed, the data will be deleted or, where applicable, anonymised.

6. Recipients and data processors

The personal data provided through the Site are processed by the processor on behalf of the Data Controller (MGS Seguros) and, on behalf of the processor, by the following providers acting as sub-processors:

• Supabase, Inc. (United States), provider of the database service where the request record is stored. The international transfer is carried out under the Standard Contractual Clauses approved by the European Commission (Decision (EU) 2021/914) and the additional technical and organisational measures offered by the provider.
• Vercel, Inc. (United States), provider of the web hosting service. Same legal basis for the international transfer.

Additionally, data may be communicated to:

• MGS Seguros Generales y Reaseguros, S.A., in its capacity as insurance company, only when the user's request leads to the formalisation of an insurance contract or the sending of a specific proposal. From that moment, MGS Seguros will become controller or joint controller of the data related to the policy, in accordance with its own privacy policy.
• Competent public administrations, courts and tribunals, where there is a legal obligation to communicate.

No other transfers of data to third parties are made.

7. International transfers

As indicated in the previous section, the providers Supabase, Inc. and Vercel, Inc. are based in the United States. International transfers of data to these providers are made with the safeguards required by the GDPR (European Commission Standard Contractual Clauses + additional technical measures).

8. User rights

The user may exercise the following rights in relation to their personal data:

• Access: obtain confirmation as to whether their data are being processed and, if so, access them.
• Rectification: request the correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request the deletion of their data when no longer necessary.
• Objection: object to certain processing.
• Restriction of processing: request the restriction of processing in the cases provided for by law.
• Portability: receive their data in a structured, commonly used format and/or request their transmission to another controller.
• Withdrawal of consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

To exercise any of these rights, the user may contact the processor at info@albafabregat.es, indicating the right they wish to exercise and attaching a copy of an identity document.

The user also has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es), particularly when they have not obtained satisfaction in the exercise of their rights.

9. Security

The processor has adopted reasonable technical and organisational measures to guarantee the security of personal data and prevent their alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data stored and the risks to which they are exposed.

10. Modifications

The processor reserves the right to modify this Privacy Policy to adapt it to legislative or jurisprudential changes, as well as industry practices. Modifications will be published on the Site with the date of the last update.