Legal
Last updated: 5 September 2026
This policy explains how Tacting SL treats personal data when you use tacting.es, contact us, or receive our services. It is written to meet Regulation (EU) 2016/679 (the GDPR), Organic Law 3/2018 (LOPDGDD) and the information duties that apply to a Spanish company.
The controller is Tacting SL, a Spanish limited company, tax identification number B22677868, registered at the Mercantile Registry of Málaga, section 8, sheet MA-191776, entry 1.
Registered office: Calle Arbolete de Noria Golf 3, Bloque 2, Escalera 5, 2.º A, 29649 Mijas (Málaga), Spain. Correspondence and the address used on this website: Calle Arbolete 1, 29649 La Cala de Mijas, Málaga, Spain.
Email: info@tacting.com. Telephone: +34 625 956 512.
Tacting has not appointed a data protection officer. Questions about personal data should be sent to the address or email above. Part of the work may be carried out by our Swedish organisation, under our instruction and responsibility.
It covers visitors to the website, people who write to us or call us, clients and their staff, suppliers, candidates in a recruitment or staffing process, people who take part in a second-opinion assessment, and people who use a whistleblowing channel that we provide or administer.
It does not replace the contract, proposal or information notice we give you for a specific assignment. If those documents say something more precise, they apply to that assignment.
We only process what is needed for the purpose. Depending on the relationship, that may include:
We do not ask for special-category data through the website form. If you send such data of your own accord, we will only keep it if there is a lawful basis and it is necessary.
Directly from you, through the contact form, email, telephone or meetings. From the company you represent, when they name you as a contact. From candidates, referees and, where the law allows, public professional sources. From tests and tools used in an agreed assessment. From the website itself (technical logs and, with consent, cookies). From a reporting channel, when someone files a report.
The contact form is sent to our systems so that we can answer you. A hidden field is used only to stop automated spam. Consent to storage is required before a form is sent.
We do not use your data for a new purpose that is incompatible with the original one, unless the law allows it or you agree.
Where we rely on legitimate interest, we have weighed that interest against your rights. You can object. We will stop unless we have compelling grounds or need the data for a legal claim.
When we help a company hire, staff a role or take a second view of a person, we process professional data to assess suitability for a role or a decision. The method is competence-based. Consultants may use validated tests and analyses approved by EFPA, and certification through DNV to ISO 10667.
The company that asked for the work is usually the controller for its own hiring or internal decision. Tacting processes data to deliver the service, under that assignment and under our professional duty. The person concerned should be told that the assessment is taking place, and by whom.
Legal bases: pre-contract or contract with the client, Article 6(1)(b); our and the client's legitimate interest in a careful decision, Article 6(1)(f); and, where the law requires it, the candidate's consent, Article 6(1)(a). If an assessment could include special-category data, we only process it with an Article 9 basis, usually explicit consent or employment law.
We do not use assessment data to sell other services to the person tested. Access is limited to people who need it for the assignment.
If we provide or administer a confidential reporting channel, reports are handled so that the person who speaks can do so without fear, and so that the organisation can meet its duty to listen. The legal framework is Directive (EU) 2019/1937 and, in Spain, Law 2/2023.
Legal basis: legal obligation, Article 6(1)(c), and where needed legitimate interest in preventing and detecting wrongdoing, Article 6(1)(f). The identity of the reporting person is protected as the law requires. Access is restricted to authorised case handlers.
The client organisation is typically the controller for reports about its own activity. The contract states each party's role. This website is not itself a channel for filing a report unless we have given you a separate address or login for that purpose.
We do not sell personal data. We share it only when it is necessary:
We aim to keep personal data in the European Economic Area. Some providers may process data outside the EEA. When that happens, we require an adequacy decision or appropriate safeguards, normally the European Commission's standard contractual clauses, and any extra measures that are needed.
We keep data only as long as the purpose requires, or as long as the law says we must. As a guide:
You can ask us to:
Write to info@tacting.com or to the registered office. We may need to verify your identity. We answer without undue delay, and within one month, or we will tell you if we need more time as the GDPR allows.
You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), the supervisory authority for Tacting SL, at www.aepd.es. If you live in another EU or EEA country you may also contact your national authority. That does not stop you contacting us first.
We apply technical and organisational measures suited to the risk: access control, encryption in transit to our form endpoint, limited internal access, and retention limits. No method is perfect. If a breach is likely to result in a high risk to your rights, we will notify you and the authority as the GDPR requires.
The website and our services are aimed at businesses and adults. We do not knowingly collect data from children. If you believe we have data relating to a child, write to us and we will delete it unless the law requires us to keep it.
Necessary cookies run so that the site and your cookie choice can work. Analytics and marketing cookies run only if you accept them. You can change or withdraw that choice at any time. Details are in the cookie policy.
We may update this policy when the law, the site or our services change. The date at the top will change. The published version is the one that applies.
For privacy questions, write to info@tacting.com or to Tacting SL, Calle Arbolete de Noria Golf 3, Bloque 2, Escalera 5, 2.º A, 29649 Mijas (Málaga), Spain. See also the legal notice.
