- USER INFORMATION
Who is the controller of your personal data?
GIDEA GESTION INTEGRAL PRODUCTO GRAN CONSUMO, SL and MESAG SL (Correduría de Seguros) are joint controllers of the USER’s personal data. GIDEA operates the website and general communications; MESAG SL acts as controller for all insurance brokerage activities (quote requests, policy intermediation, commission management).
Both entities process your data in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Organic Law 3/2018 of 5 December (LOPDGDD).
For what purpose do we process your personal data and why do we do it?
Depending on the form from which we have obtained the personal data, we will process it confidentially for the following purposes:
- Responding to general enquiries sent through contact forms
- Providing insurance quotes, intermediating insurance contracts, and managing your policy as your broker (correduría de seguros)
- Sending commercial communications about our insurance products (only with your consent)
- Processing referral attribution and commission payments to collaborator partners when you reach us through a referral link
Legal basis for processing: your consent (Art. 6.1.a GDPR) for commercial communications; contract performance (Art. 6.1.b) for quote requests and policy management; legal obligation (Art. 6.1.c) for tax, accounting, and insurance-regulatory record-keeping; legitimate interest (Art. 6.1.f) for commission attribution and fraud prevention.
Special-category data (health information)
When you request a health, life, or travel insurance quote, we may process information about your health, age-related risk factors, or pre-existing conditions. This is special-category data under Article 9 GDPR. We process it under Article 9.2.a (your explicit consent, given when you submit the quote form) and Article 9.2.h (necessary for the provision of health-related insurance services).
Health data is shared only with the insurance companies required to issue the quote you requested. It is never shared with referral partners or used for marketing.
For how long will we keep your personal data?
Retention periods depend on the type of data:
- Quote requests that do not result in a policy: 12 months
- Signed insurance policies and related records: the duration of the contract plus 6 years (Código de Comercio art. 30), or 10 years where anti-money-laundering obligations apply (Ley 10/2010)
- Invoicing and tax records: 6 years from the end of the fiscal year
- Commercial communications consent records: until you withdraw consent
- Commission and referral records: 6 years
After these periods the data is erased with appropriate security measures to ensure anonymisation or complete destruction.
To whom do we disclose your personal data?
We may share your personal data with the following categories of recipients, only to the extent necessary for the purposes stated above:
- Insurance companies (Sanitas, DKV, Adeslas, Asisa, Salus, Helvetia, ARAG, and other insurers in our brokered portfolio) — to issue quotes and manage policies
- Our gestor and accountants — to meet tax, accounting, and regulatory obligations
- Hosting, email, and IT service providers acting as data processors — under data processing agreements
- The Spanish General Directorate of Insurance and Pension Funds (DGSFP) and the tax authorities (AEAT) — where legally required
- Referral partners / collaborators — see the next section
International transfers outside the European Economic Area are not foreseen. If they become necessary (for example, when using non-EU hosting services), they will only be made to countries with an adequacy decision or under appropriate safeguards (Standard Contractual Clauses).
Referral partners and affiliate tracking
Some users reach our website through a personalised link shared by a referral partner (collaborator). When this happens:
- A tracking cookie is placed on your device for up to 60 days to attribute any resulting policy to the correct partner. You can reject this cookie via our cookie banner.
- If you sign a policy originating from such a referral, we share with the partner a limited dataset for the sole purpose of commission verification: a policy reference code, the number of insured persons, the policy activation date, and the commission amount payable to them.
- We do not share your name, contact details, identification number, address, health data, or policy terms with referral partners.
- The partner acts as an independent data controller for this limited dataset, limited to commission reconciliation and their own tax obligations.
Cookies and tracking
Our website uses cookies, including a first-party affiliate attribution cookie (60-day duration) when you arrive via a referral link. You can accept, reject, or customise non-essential cookies at any time through the cookie banner displayed on your first visit. Essential cookies required for the site to function are always active.
What are your rights?
The rights of the USER are:
Right to withdraw consent at any time.
Right of access, rectification, portability and erasure of your data and the limitation or objection to their processing.
The right to file a claim with the Spanish Supervisory Authority (www.aepd.es) if you consider that the processing does not comply with the current legislation.
Contact information for exercising rights:
GIDEA GESTION INTEGRAL PRODUCTO GRAN CONSUMO, SL / MESAG SL. Avenida del Puerto, 189 3 A1 – 46022 Valencia (València). E-mail: privacy@gideagestion.com
2. COMPULSORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED BY THE USER
The USERS, by marking the corresponding boxes and entering data in the fields, marked with an asterisk (*) in the contact form or download forms, accept expressly and in a free and unequivocal way that their data are necessary for the supplier to meet their request, voluntarily providing their data in the remaining fields. The USER ensures that the personal data provided to the CONTROLLER are true and is responsible for communicating any changes to them.
The CONTROLLER informs that all data requested through the website are mandatory, as they are necessary for the provision of an
optimal service to the USER. In the event that not all of the data is provided, there is no guarantee that the information and services provided will be completely adapted to the User’s needs.
3. SECURITY MEASURES
That in accordance with the provisions of the current regulations on the protection of personal data, the CONTROLLER is complying with all the provisions of the GDPR and LOPDGDD regulations for processing the personal data for which they are responsible, and is manifestly complying with the principles described in Article 5 of the GDPR, by which they are processed in a lawful, fair and transparent manner in relation to the data subject and appropriate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
The CONTROLLER guarantees that all appropriate technical and organisational policies have been implemented to apply the security measures established by GDPR and LOPDGDD in order to protect the rights and freedoms of the USERS, and has communicated the appropriate information for them to be able to exercise their rights and freedoms.
For more information about privacy safeguards, you can contact the CONTROLLER via GIDEA GESTION INTEGRAL PRODUCTO GRAN CONSUMO, SL / MESAG SL. Avenida del Puerto, 189 3 A1 – 46022 Valencia (València). E-mail: privacy@gideagestion.com
