Security Policy
Last updated: July 2026
1. Objective
The purpose of this policy is to describe the security measures applied by CARNS I EMBOTITS TORRA SL to protect the information processed through its website.
2. Infrastructure
The website is hosted on a private server (VPS) managed directly by CARNS I EMBOTITS TORRA SL and contracted from an external cloud infrastructure service provider.
3. Technical security measures
The website uses a secure HTTPS connection to protect data transmission. In addition, secure server configuration measures, regular system updates and access controls based on authentication credentials are implemented.
4. Data processing and storage
Data received through the contact form, including name, email address and telephone number, is received by email through a system with its own security measures. Data relating to users who have consented to receive commercial communications is stored in the database of the Listmonk email delivery platform, hosted on the same server managed by CARNS I EMBOTITS TORRA SL, with restricted access. In both cases, data is retained only for the periods specified in the Privacy Policy, and users may request its erasure at any time.
5. Backups
Periodic backups of systems and databases are performed and stored securely to ensure the availability and recovery of information in the event of an incident.
6. Access to information
Access to the information received is restricted exclusively to authorised personnel of CARNS I EMBOTITS TORRA SL.
7. External providers
The cloud infrastructure provider acts as a data processor under a contract that guarantees the confidentiality, integrity and security of the processed data, in accordance with Article 28 of the GDPR.
8. Incident prevention
Technical and organisational measures are implemented to prevent unauthorised access, data loss and improper use of information.
9. Notification of security breaches
In the event of a personal data breach that is likely to pose a risk to the rights and freedoms of individuals, CARNS I EMBOTITS TORRA SL will notify the Spanish Data Protection Agency within a maximum of 72 hours of becoming aware of the breach, as established in Article 33 of the GDPR. Where the breach is likely to result in a high risk to the rights and freedoms of individuals, affected users will also be informed directly, in accordance with Article 34 of the GDPR.
10. Security limitations
Despite the security measures adopted, no system connected to the internet can guarantee absolute security.
11. Contact
For any matter relating to information security, you can contact us at [administracio@carnstorra.cat](mailto:administracio@carnstorra.cat).