PRIVACY POLICY

LEGAL NOTICE

This website is owned by Madrija Consultoría, S.L. You can contact the owner by phone at +34 925 260 939 or by email at info@madrija.com

Company name: Madrija Consultoría, S.L.
Registered address: Avda. Europa, 5 / 1º A – 45005 Toledo, Spain
Tax ID (CIF): B45838133
Commercial Register: Toledo, Volume 1608, Book 0, Folio 41, Sheet TO-37441, Entry 2

Madrija Consultoría, S.L. guarantees the security and confidentiality of the data provided through this website, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Spanish Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (“LOPDGDD”).

PRIVACY POLICY

Madrija Consultoría, S.L., with registered address at Avda. Europa, 5 / 1º A – 45005 Toledo, Spain and Tax ID B45838133, acts as the Data Controller of the personal data collected through this website.

Data provided through the contact and enquiry forms will be processed to handle requests for information and to manage the business relationship with clients and prospective clients. The legal basis for the processing is the data subject’s consent (Art. 6.1.a GDPR) or the performance of a contract (Art. 6.1.b GDPR), as applicable.

For applications intended for hospitals and public bodies (such as Enigma or Ykonos), Madrija Consultoría acts as data processor (Art. 28 GDPR). Clinical and personal data entered in those applications are stored and managed exclusively by the hospital or client body, which is the data controller for all purposes. Requests relating to that data must be addressed directly to the relevant centre.

Data retention

Personal data will be kept for as long as necessary to fulfil the purpose for which it was collected and, where applicable, for the periods established by law:

  • Client and business contact data will be kept while the relationship lasts and, once it ends, for the limitation periods applicable to legal liabilities.
  • Data provided to receive information or submit enquiries will be kept for 12 months from the last contact, unless the data subject requests deletion earlier.

Once these periods have elapsed, the data will be blocked and subsequently deleted securely in accordance with Madrija Consultoría’s internal procedures.

Data subject rights

In accordance with the GDPR and the LOPDGDD, data subjects may at any time exercise the following rights: access, rectification, erasure, restriction of processing, portability, objection, and the right not to be subject to automated individual decision-making.

To exercise these rights, you can contact us at:

  • Email: privacidad@madrija.com
  • Post: Attn. DPO – Madrija Consultoría, S.L., Avda. Europa, 5 / 1º A – 45005 Toledo, Spain

Requests will be handled within a maximum of 30 days, extendable by up to 3 months in cases of particular complexity, with notice to the data subject within the first month.

Likewise, if you consider that the processing of your data does not comply with the applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

INTEGRATED MANAGEMENT SYSTEM POLICY

October 2026 — Approved by Ismael Moreno Fernández, CEO of Madrija Consultoría S.L.

Madrija Consultoría has unified its management policies into an Integrated Management System (IMS) Policy, which sets out the organisation’s commitments on quality, the environment and information security, in line with ISO 9001, ISO 13485, ISO 14001 and ISO 27001.

Quality Policy (ISO 9001 / ISO 13485)

The purpose of the Quality Policy is to ensure Madrija Consultoría’s ability to provide a product or service that meets the requirements of its clients and other interested parties, increasing their satisfaction through quality and continual improvement.

Management is committed to implementing, maintaining and continually improving the Quality Management System, ensuring compliance with UNE-EN ISO 9001:2015 and UNE-EN ISO 13485:2016, and undertakes to:

  • Strengthen the aspects needed to achieve the desired level of quality.
  • Work with clients to achieve their satisfaction.
  • Provide the necessary human and technical resources.
  • Disseminate the IMS documentation and ensure staff are familiar with it.
  • Develop and apply technologies and methodologies that improve the competitiveness of companies.
  • Carry out R&D&I activities, consolidating Madrija as an entrepreneurial organisation that creates value and innovates.
  • Use the training of technical staff as a lever to improve skills and performance.
  • Exploit and adequately protect the results of R&D&I activities.

Environmental Policy (ISO 14001)

Respect for the environment is a priority and a recognisable factor in the services Madrija Consultoría provides to its clients. General Management, as the highest management body, establishes and manages this policy and undertakes to:

  • Train and involve every employee in respect for the environment.
  • Promote and involve in environmental procedures the various parties who take part, directly or indirectly, in our work.
  • Set environmental objectives and ensure their effective management through monitoring.
  • Protect the environment and prevent pollution directly arising from our activity, reducing waste generation and managing its efficiency.
  • Comply strictly with current environmental legislation and regulations and other applicable requirements.
  • Periodically review the effectiveness of the Environmental Management System to identify weaknesses and take the necessary improvement actions.

Information Security Policy (ISO 27001 / ENS)

15/09/2025

Madrija Consultoría has implemented an Information Security Management System with the aim of protecting information resources against internal or external, deliberate or accidental threats, ensuring the confidentiality, integrity and availability of information.

The effectiveness of the system is the direct responsibility of the Information Security Committee. Everyone whose activity may be affected by its requirements is bound to comply strictly with this policy.

Management establishes the following principles, in accordance with ISO/IEC 27001:2022:

  • Competence and leadership by Management as a commitment to developing the ISMS.
  • Identify the interested parties involved in the ISMS and meet their requirements.
  • Understand Madrija’s context and identify opportunities and risks as a basis for planning.
  • Comply with current legislation on information security.
  • Ensure the confidentiality of data and the availability of systems, preventing undue alteration.
  • Ensure the ability to respond to emergencies, restoring critical services as quickly as possible.
  • Establish appropriate measures to treat the risks identified.
  • Promote information security awareness and training.
  • Set objectives focused on performance evaluation and continual improvement.

NATIONAL SECURITY FRAMEWORK (ENS) POLICY

Madrija Consultoría guarantees the highest level of information protection. Our systems comply with Spain’s National Security Framework (Esquema Nacional de Seguridad, ENS) at High level. If you would like to review our Statement of Applicability or other related documentation, you can request it at calidad@madrija.com.