In short
- We collect what we need to answer you, run your account and execute a transaction, and nothing beyond that
- We never sell personal data and we never share it for someone else's marketing
- Payment details are handled by a licensed payment institution rather than by us
- You can ask to see, correct or delete your data at any time by writing to info@souqoconnect.com
This summary is written for convenience and has no legal effect. The sections below govern
Who we are
The data controller is the company identified below. It decides why and how personal data is processed on this website and on the SouqoConnect platform
- Controller
- SouqoConnect, S.L.
- Registered office
- registered address, Barcelona, Spain
- Tax identification
- NIF
- Commercial registry
- Registro Mercantil de Barcelona, volume, folio, sheet
- info@souqoconnect.com
We have not appointed a Data Protection Officer, because none of the conditions in Article 37 of the GDPR applies to our activity. Data protection enquiries should be sent to the email address above
Scope
This policy covers personal data processed through souqoconnect.com, through the SouqoConnect platform, and in business correspondence with us. It applies to visitors, enquirers, buyers, suppliers and the representatives of partner organisations
It does not cover third-party websites we link to, or the processing carried out by our payment, logistics or certification partners under their own responsibility. Those parties publish their own policies
What we collect
Data you give us
- Identification: name, surname, position or role
- Business contact: company name, work email, telephone or messaging number, country
- Commercial: product categories, volumes, origins, minimum lots, delivery points
- Account: username, password in hashed form, interface language and settings
- Content: the text of your messages and anything you attach to them
- Documents: halal certificates, production licences, company documents and, for suppliers, the details needed to admit a counterparty
Data collected automatically
- Technical: IP address, browser and device type, operating system, screen size
- Usage: pages viewed, time and date of access, referring page, actions taken in the interface
Which of this is collected through cookies, and on what basis, is set out in the cookie policy
Data from other sources
- Public commercial registries, for confirming that a company exists and is trading
- Public registers maintained by certification bodies, for confirming the status of a certificate
- European Commission lists and the TRACES system, for confirming import admissibility
- Our payment, logistics and customs partners, for the status of a transaction or a consignment
Why we use it and on what basis
Every processing operation we carry out has a purpose and a legal basis under Article 6 of the GDPR. The table sets out both, together with how long the data is retained
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering enquiries and sending information you asked for | Steps taken at your request before entering a contract, Art. 6(1)(b), or our legitimate interest in responding to business contact, Art. 6(1)(f) | 24 months from the last contact |
| Creating and operating a platform account | Performance of a contract, Art. 6(1)(b) | Life of the account, then 6 years |
| Admitting and verifying counterparties, checking certificates and import admissibility | Performance of a contract, Art. 6(1)(b), and our legitimate interest in preventing fraud, Art. 6(1)(f) | Life of the relationship, then 6 years |
| Executing, coordinating and monitoring transactions | Performance of a contract, Art. 6(1)(b) | 6 years, Art. 30 Spanish Commercial Code |
| Invoicing, accounting and tax | Legal obligation, Art. 6(1)(c) | Up to 6 years, or longer where tax law requires |
| Sanctions screening and anti-money-laundering checks where they apply to a transaction | Legal obligation, Art. 6(1)(c) | 10 years, Ley 10/2010 |
| Sending commercial information about the platform | Your consent, Art. 6(1)(a), or our legitimate interest towards existing clients, Art. 6(1)(f) | Until you withdraw or object |
| Keeping the site secure and preventing abuse | Legitimate interest, Art. 6(1)(f) | 12 months |
| Measuring how the site is used | Your consent, Art. 6(1)(a) | As stated in the cookie policy |
Providing the data marked as required on our forms is necessary to answer you or to open an account. Without it we cannot do either. Everything else is optional and its absence has no consequence beyond a less useful first reply
Who we share it with
We disclose personal data only where it is necessary, and only to the following categories of recipient
- Hosting, storage and infrastructure providers operating within the European Union
- The licensed payment institution that provides escrow and settlement, which processes payment data under its own responsibility as a regulated entity
- Logistics operators, freight visibility platforms and customs representatives, for the consignment you are party to
- Communication, messaging and email delivery providers
- Professional advisers bound by confidentiality, including lawyers, accountants and auditors
- Public authorities, courts and regulators, where a legal obligation requires it
The other party to your transaction receives the data needed to perform it, which for a buyer means the supplier's business details and for a supplier means the buyer's business and delivery details
Every provider acting on our instructions does so under a written data processing agreement meeting Article 28 of the GDPR. We do not sell personal data, and we do not disclose it for third-party marketing
International transfers
Personal data is hosted within the European Union. Our business, however, runs across a corridor that reaches Algeria, Morocco, Tunisia and Türkiye, so some transfers outside the European Economic Area are unavoidable
- Where a transfer to a supplier, a bank or a customs representative outside the EEA is necessary to perform the contract you have asked us to perform, we rely on Article 49(1)(b) of the GDPR
- Where a processor operates outside the EEA, we rely on an adequacy decision where one exists, and otherwise on the Standard Contractual Clauses adopted by the European Commission, together with any supplementary measures the transfer requires
You may request a copy of the safeguards applied to a specific transfer by writing to the address in section 14
How long we keep it
Retention periods are set out per purpose in section 4. Once a period ends, data is deleted or irreversibly anonymised, except where it must be blocked and preserved for the limitation period of a possible claim, as provided by Article 32 of the Spanish Data Protection Act
How we protect it
- Encryption of data in transit and at rest
- Role-based access control, with access granted on a need-to-know basis and reviewed periodically
- Passwords stored only as salted hashes, never in readable form
- Logging of access to production systems, and separation of development from production data
- Written confidentiality obligations for staff and contractors
No system is perfectly secure. Where a breach is likely to result in a risk to your rights and freedoms we notify the Spanish Data Protection Agency within 72 hours, and we notify you directly where the risk is high, as required by Articles 33 and 34 of the GDPR
Your rights
Under the GDPR you have the following rights over your personal data
- Access, to obtain confirmation of whether we process your data and a copy of it
- Rectification, to have inaccurate data corrected and incomplete data completed
- Erasure, to have data deleted where we no longer have a basis to keep it
- Restriction, to have processing limited while a dispute about accuracy or basis is resolved
- Portability, to receive the data you gave us in a structured, machine-readable format and to have it sent to another controller
- Objection, to object at any time to processing based on legitimate interest, and at any time and without reason to direct marketing
- Withdrawal of consent, at any time, without affecting the lawfulness of processing carried out before withdrawal
- Complaint, to lodge a complaint with the supervisory authority
How to exercise them
Write to info@souqoconnect.com with the subject line Data protection, stating which right you are exercising. We may ask for information that lets us confirm your identity, and we ask for nothing beyond what that requires
We answer within one month of receiving a request. Where a request is complex, or where several requests arrive together, that period may be extended by two further months, and we will tell you within the first month if that happens
Exercising a right costs nothing. Where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or decline to act, and we will explain why
If you are not satisfied with our response, you may complain to the Spanish Data Protection Agency, Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, at www.aepd.es
Automated decisions
The platform performs automated checks, principally the reconciliation of a certificate against an issuing register and the checking of a product category and origin against European Commission lists. Those checks concern products, establishments and companies
They do not produce legal effects concerning a natural person, or similarly significantly affect one, and we do not carry out profiling within the meaning of Article 22 of the GDPR. Where a check results in a supplier not being admitted, a person reviews the decision before it takes effect
Minors
SouqoConnect is a business-to-business service. It is not directed at anyone under the age of 18 and we do not knowingly collect data from minors. If you believe a minor has provided us with personal data, write to us and we will delete it
Changes
We may update this policy to reflect changes in the service, in our processing or in the law. The version and the date at the top of this page always identify the text in force
Where a change materially affects how we use your data, we notify registered users by email at least 15 days before it takes effect
Contact
For any question about this policy, or to exercise a right, write to info@souqoconnect.com or to the registered office given in section 1
Related documents: the cookie policy explains what we store on your device, and the terms of use govern the service itself
SouqoConnect, S.L. · Privacy policy v1.3 · 1 August 2026
Back to the top