Privacy policy
Last updated: October 2026
This is a translation provided for information purposes. In the event of any discrepancy, the Spanish version shall prevail.
This policy explains how LLIÇA PACKAGING, S.L.U. (trade name Click & Pallet) processes the personal data of people who use this website or contact the company, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
1. Data controller
| Controller | LLIÇA PACKAGING, S.L.U. (Click & Pallet) |
|---|---|
| Tax ID (NIF) | B66313792 |
| Address | Carrer Miquel Martí i Pol, s/n, Polígon Industrial Pla de la Costa – 08182 Sant Feliu de Codines (Barcelona), Spain |
| info@clickandpallet.es | |
| Telephone | +34 669 883 985 |
2. What data we process, why and on what legal basis
2.1. Quote requests and enquiries
When you contact us through the contact form, WhatsApp, email or telephone, we process the data you provide (full name, company, email address, telephone number, service you are interested in, approximate volume and the content of your message) in order to handle your request and send you a proposal.
Legal basis: taking steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR) and the consent you give when sending us your request (Art. 6(1)(a) GDPR).
Retention: for as long as needed to respond and, if no business relationship is established, for a maximum of 12 months.
2.2. Customers and suppliers
We process the contact details of customers, suppliers and the contact persons at their companies in order to provide and manage the contracted services (storage, order picking and shipping), as well as invoicing, collections and payments.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR), compliance with legal, tax and accounting obligations (Art. 6(1)(c) GDPR) and, regarding company contact persons, our legitimate interest in maintaining the business relationship (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD).
Retention: for the duration of the business relationship and thereafter for the statutory periods (generally 6 years under the Spanish Commercial Code and 4 years for tax purposes).
2.3. Data of our customers’ end customers (fulfilment)
In our fulfilment service, we process the data of shoppers of the online stores that hire us (name, delivery address, telephone, email and order contents) solely to prepare and ship their orders and handle returns. In this case, Click & Pallet acts as a data processor on behalf of the online store, which is the data controller. This processing is governed by the data processing agreement signed with each customer under Art. 28 GDPR. If you are a shopper at one of those stores, please contact the store where you made your purchase to exercise your rights, or write to us and we will forward your request.
2.4. Marketing communications
We may send our customers information about services similar to those they have contracted, in accordance with Art. 21.2 of the Spanish LSSI-CE. We will only send marketing communications to non-customers if they have expressly consented. You can unsubscribe at any time using the link included in each communication or by writing to info@clickandpallet.es.
Legal basis: legitimate interest (customers) or consent (all other cases).
Retention: until you object or withdraw your consent.
2.5. Job applications
If you send us your CV, we will process it to assess your application for current or future recruitment processes.
Legal basis: your consent (Art. 6(1)(a) GDPR).
Retention: a maximum of 12 months, unless you tell us otherwise.
2.6. Browsing the website
When you visit the website, the server logs technical data such as your IP address, browser, and the date and time of access, which are needed to serve the pages and keep the site secure.
Legal basis: our legitimate interest in the operation and security of the website (Art. 6(1)(f) GDPR).
2.7. Web analytics and campaign measurement
If you accept them in the cookie banner, we use Google Analytics and Google Ads (loaded through Google Tag Manager) to obtain statistics on how the website is used and to measure the effectiveness of our advertising campaigns. These services process cookie identifiers, IP address, device and browser data and the pages visited.
Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE), which you can withdraw at any time via “Cookie settings”.
Retention: Google Analytics data is kept for 14 months. The duration of each cookie is set out in the Cookie policy.
More information in the Cookie policy.
3. Mandatory data
Fields marked as mandatory in the forms are required to handle your request. If you do not provide them, we will not be able to process it. You guarantee that the data you provide is accurate and, if it relates to third parties, that you have informed them and have their authorisation.
4. Recipients
We do not disclose your data to third parties except where required by law (for example, to the Spanish Tax Agency, to banks for managing collections and payments, or to the competent authorities when they so require).
To provide our services we use suppliers who access data as data processors, with whom we have signed the agreements required by Art. 28 GDPR:
| Supplier | Service | Location |
|---|---|---|
| Netlify, Inc. | Website hosting and receipt of the contact form (Netlify Forms) | United States (see section 5) |
| Transport companies | Delivery of orders and goods | Spain / EU |
| Google Ireland Limited | Web analytics and campaign measurement (only with your consent) | EU, with possible access from the United States (see section 5) |
If you choose to contact us via WhatsApp, the communication takes place through the WhatsApp Ireland Limited service, which processes your data in accordance with its own privacy policy.
5. International transfers
The website is hosted by Netlify, Inc., a company based in the United States. Technical browsing data and data sent through the contact form are processed on servers located in the United States. Netlify, Inc. is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission, and has also signed the Standard Contractual Clauses approved by the Commission. You can read its policy at netlify.com/privacy.
If you accept analytics or advertising cookies, Google may process that data on Google LLC servers in the United States. Google LLC is also certified under the EU-US Data Privacy Framework.
6. Your rights
You may exercise the following rights at any time:
- Access to your personal data.
- Rectification of inaccurate data.
- Erasure of your data when it is no longer needed.
- Objection to processing, including marketing communications.
- Restriction of processing in the cases provided for by law.
- Portability of your data.
- Withdrawal of consent at any time, without affecting the lawfulness of prior processing.
To exercise them, write to info@clickandpallet.es or by post to the address given in section 1, stating the right you wish to exercise. If necessary to verify your identity, we may ask you for a supporting document.
If you believe we have not processed your data correctly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).
7. Security
We apply appropriate technical and organisational measures to protect your data against loss, misuse, unauthorised access or alteration, taking into account the state of the art and the risks of the processing.
8. Minors
This website is aimed at businesses and professionals. We do not knowingly collect data from children under 14.
9. Changes to this policy
We may update this policy to reflect legal changes or changes in our processing. The version in force is always the one published on this page, with its update date.