Privacy policy

We care about your privacy. ENTIDAD NACIONAL DE ACREDITACIÓN, as the entity responsible for this website, seeks to provide the strictest legal guarantees with regard to your privacy and to explain clearly and transparently everything that you are consenting to in relation to the processing of personal information on this website. Information updated on 22-05-2018.

This Privacy Policy is applicable only to personal data obtained on the Website and shall not apply to information collected by third parties on other websites, even if these were linked by the Website.

ENTIDAD NACIONAL DE ACREDITACIÓN (ENAC) has adapted this website to the requirements of Organic Law 15/1999, of 13 December, on the Protection of Personal Data (“LOPD”) and Royal Decree 1720/2007, of 21 December, referred to as the Implementing Regulations of the LOPD. It also conforms to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons (“GDPR”) and to Law 34/2002, of 11 July, on Services of the Information Society and Electronic Commerce (“LSSICE” or “LSSI”).

1. Who is the controller of your data?

  • Identity: ENTIDAD NACIONAL DE ACREDITACIÓN, Tax ID Code G-78373214
  • Postal address: C/ Serrano 240, 3ª 28016 Madrid
  • Telephone: 91 457 32 89
  • E-mail:


2. Why do we process your personal data? 

ENAC processes the information it receives from data subjects for the following purposes:

  • Contact. To get in touch with you, whether by telephone or by e-mail, or to answer questions or requests for information, quotes, etc. that you address to us via our Website or by e-mailing us at the address established for this purpose. Queries. To answer the queries that you address to us so that we can provide you with the appropriate information. Obtain information about your complaints or success stories. To process and respond to the needs and expectations of all Users regarding accreditation and accredited conformity assessment services. Your data will only be used to handle the complaint or information provided when completing the questionnaire in our “Let us know” sections or by e-mailing Likewise, Users who have used the accredited services and reaped the benefits or solved a specific problem can tell us about it by e-mailing
  • Subscriptions to Accreditation News. To sign up for free to ENAC’s online information, including news and publications about accreditation activities, developments and events. You may cancel your subscription at any time using the subscription form, simply by entering your e-mail address and selecting the “unsubscribe” option or by using any of the channels for this purpose.
  • Take out training courses. This includes administrative and accounting management and, if you have given us permission, the opportunity to tell you about similar courses or competitions of possible interest to you. All the information about the purchase process is available in the general contracting conditions section.
  • Join us. To process your application for a job vacancy published by ENAC, for which the data subject has sent ENAC his or her CV or to process applications to collaborate with ENAC as an Assessor or Technical Expert in any of the schemes and fields in which ENAC delivers services, for which the data subject has sent ENAC his or her CV.  

Data accuracy and veracity

As User, you are solely responsible for the veracity and correctness of the data that you submit and release ENAC from any liability in this regard. The User warrants and shall in all events be held liable for the accuracy, validity and authenticity of the personal data supplied and undertakes to keep it updated.

Acceptance and consent

The User warrants that he/she has been informed of all conditions relating to personal data protection and accepts and consents to the processing of such data by ENAC in the manner and for the purposes stated in this privacy policy and in the forms or channels through which it is collected.

Commercial messages

In compliance with the LSSICE, ENAC does not engage in spam. This means that it does not send out commercial e-mails not previously requested or authorised by the User. Consequently, on each of the forms contained on the website, the User has the option of giving his/her express consent to receiving such messages.


3. How long will we keep your data?

If you are an ENAC client, your data will be retained for the duration of the contractual relationship. At the end of the contract, ENAC will keep your personal data locked for the legal prescription periods. At the end of the legal prescription periods, we will destroy your data.

If the data was supplied for the purpose of a complaint or market information, it will be stored for the time needed for its proper management. At the end of this period, ENAC will keep your personal data locked for the legal or contractual prescription periods. We will destroy your data when this period expires.

If the data was collected for subscription purposes, it will be retained until you end your subscription or the service is terminated. If it is to evaluate an application that proves unsuccessful, this will be after processing.


4. What is the lawful basis for processing your data?

If you are an ENAC client, the lawful basis for processing your data is our contractual relationship or, if you are a User of the website, it is your consent if we need to obtain it in order to deliver the services on our website.

Withdrawal. The consent you gave for processing can be withdrawn at any time by notifying ENAC under the terms set out in this Policy for the exercise of rights.


5. Data privacy and security

ENAC agrees to use and process the personal data of Users, respecting its confidentiality and the purpose for which it was provided, complying with its obligation to store such data and adopt all necessary measures to prevent its alteration, loss, unauthorised processing or access, under current data protection legislation.

ENAC cannot guarantee the total impregnability of the Internet and consequent breach of the data through fraudulent access thereto by third parties.

Confidentiality of processing

ENAC will ensure that any person authorised by our company to process the data of clients and Users (including their staff, collaborators and providers) is subject to the relevant duty of confidentiality (whether contractual or legal).

Security incident response

When a security incident is detected, ENAC must report it without undue delay to the client or User and provide timely information as is known in relation thereto or when reasonably requested by the Client or User.


6. To which recipients can your data be transferred?

The ENAC website may provide access to other websites, including official ENAC social media profiles, designed to improve the understanding of our business and to create an alternative channel of communication with people interested in our Organisation, informing the User that clicking on these links will re-direct him/her to a page for which ENAC is not responsible. Note that the owners of these Sites external to ENAC may collect, use or transfer your Personal Data under different terms and conditions so we recommend that when you contact one of these websites, you should read their privacy policy, general terms of use or how they use cookies, as we cannot control how these Websites use the personal information that you disclose.

ENAC hereby informs you that it will conduct third-party processing in accordance with the GDPR, requiring the data processor to comply with all data protection guarantees. All utilities offered by third parties are strictly necessary for the delivery of our services and have been selected on the basis of fulfilment of the rights upheld on this website. In particular, web backup and analytics services are available.

Disclosure of data for legal reasons

ENAC may find itself under a legal obligation to disclose your personal data under a subpoena, mandate or court order in any of the countries in which we operate, and may disclose your personal data for the purpose of enforcing the Terms of Use of our Website or in emergency situations to protect the personal safety of the general public or of the Website.


7. What rights do you have to the data you provide?

You can exercise your rights under the GDPR free of charge:

  • Right to request access to personal data concerning the data subject,
  • Right to request rectification or erasure,
  • Right to request the restriction of processing. You can request this:
    • When the accuracy of the personal data is contested,
    • During the period in which the controller is allowed to verify the accuracy of the data,
    • When the processing is unlawful and the data subject opposes the erasure of the personal data,
    • When the controller no longer needs the personal data for processing purposes, but the data subject needs it for making a complaint, etc.
  • Right to object to the processing,
  • Right to data portability.

You likewise have the right to withdraw your consent, which means that you will be removed from the services, given that the latter legitimise us to process your data.

You can exercise your rights of access, rectification, erasure, objection, portability and restriction of processing of your data by writing to ENTIDAD NACIONAL DE ACREDITACIÓN, C/ Serrano 240, 3ª 28016 Madrid or e-mailing, attaching a copy of your ID card as proof of your identity, indicating the reference “Data Protection”. Your request must include: Name, surname(s) and photocopy of your ID card, the details of your request and your address for notification purposes.

If you are not satisfied with the response of ENTIDAD NACIONAL DE ACREDITACIÓN, you have the right to lodge a complaint with the supervisory authority, the Spanish Data Protection Agency ( to request the protection of your rights.