Legal notice and privacy policy

Website Owner

In compliance with the disclosure requirement set forth in Article 10 of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI-CE), we hereby inform you that the owner of this website is:

• Company name: MERCURY STEAM ENTERTAINMENT, S.L.
• Tax ID Number: B31749369
• Registered office: CALLE LANZAROTE 19, 1ª PLANTA, OFICINA Nº4 DE 28703 SAN SEBASTIAN DE LOS REYES (MADRID)
• Email: info@mercurysteam.com

Official records

• Navarra Commercial Registry, Volume: 909, Folio: 114, Section: 8, Page: 18400

Applicable Regulations

• Law 34/2002, of July 11, on Information Society Services and Electronic Commerce.
• EU Regulation 2016/679 of April 27 on Data Protection (GDPR), and Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
• Regarding privacy in electronic communications and cookies, Directive 2002/58/EC and Article 22 of Law 34/2002.
• Legislation on the protection of intellectual and industrial property, in particular Royal Legislative Decree 1/1996, of April 12 (Intellectual Property Law), and Royal Decree-Law 24/2021, of November 2, which transposes Directive (EU) 2019/790.
• Regulation (EU) 2024/1689 of June 13, 2024, establishing harmonized rules on artificial intelligence, in particular with regard to the reservation of rights concerning the training of artificial intelligence systems set forth in section 2.8.
• Law 2/2023, dated February 20, regulating the protection of individuals who report regulatory violations and the fight against corruption, in particular Article 6 regarding the management of the Internal Reporting System by an external third party. Access to the reporting channel is provided on the homepage of this website, in a separate and easily identifiable section (Art. 25 of Law 2/2023).

1. Privacy Policy

1.1. Data Controller

• Company name: MERCURY STEAM ENTERTAINMENT, S.L.
• Tax ID Number: B31749369
• Registered office: CALLE LANZAROTE 19, 1ª PLANTA, OFICINA Nº4 DE 28703 SAN SEBASTIAN DE LOS REYES (MADRID)
• Email: info@mercurysteam.com

1.2. Data Protection Officer (DPO)

Our Data Protection Officer is Consulting & Strategy GFM (GFM Servicios). You can contact them via email at dpo@gfmservicios.com or by phone at 948152929 for any questions you may have regarding our obligations and your rights under the law regarding the protection of personal data.

1.3. Our Commitment to the Processing of Your Data

Before providing us with any personal data through the forms on this website, please read this document carefully. If any term is unclear, we will be happy to assist you.

We respect the fundamental right to data protection and are committed to proactively protecting the information you entrust to us. Your data belongs to you, and when you provide it to us, we process it lawfully, fairly, and transparently, solely for the purposes we have disclosed to you, limiting ourselves to the necessary data and retaining it only for as long as is strictly necessary. We implement appropriate technical and organizational security measures to ensure the confidentiality of your data and to prevent its loss or unauthorized access. We treat you equally, without discrimination of any kind, and we provide you with access to your data and the ability to exercise your rights at all times, in accordance with section 1.12.

1.4. Data Processing We Perform on This Website: Purpose, Legal Basis, and Retention Period

1) Data from non-essential cookies

The purposes, duration, and other information regarding each cookie are detailed in our Cookie Policy.

When you access the website, a notice appears asking you to indicate whether you wish to accept, reject, or configure cookies for each of the specified purposes. You may revoke your consent at any time by clicking a button that allows you to do so easily.

The legal basis for the processing of data collected through non-essential cookies is your consent, in accordance with Article 6.1.a) of EU Regulation 2016/679 of April 27 on Data Protection.

Technical or strictly necessary cookies are exempt from the consent requirement under Article 22(2) of Law 34/2002; therefore, they will be used to enable you to access and browse the website.

Regarding data retention, this is detailed in the Cookie Policy, which provides specific information for each cookie.

2) Information we collect on the “VIEW JOB OPENINGS” form

When you fill out our form by clicking the “VIEW JOB OPENINGS” button, you provide us with your information for the purpose of applying for the job openings offered by our organization. To fulfill this purpose, we need to communicate with you, and our HR department will review your information (without using AI tools) to evaluate your suitability for the position you are applying for. Your information will not be subject to decisions based solely on automated processing.

Our process may include communications inviting you to participate in selection exams, interviews, tests, and reference checks. Only if you provide your specific consent by checking the box included for that purpose on the form will we retain your application for future recruitment processes and may inform you of new positions that match your profile. If you are offered the position, we may use your personal data to sign employment contracts.

Legal basis for the processing: to manage your application for the specific job opening and to implement pre-contractual measures taken at your request, in accordance with Article 6.1.b) of EU Regulation 2016/679 of April 27 on Data Protection. To retain your application for future recruitment processes and to send you information about new job openings, your specific consent in accordance with Article 6(1)(a) of the same Regulation, which you may withdraw at any time.

Required information: The information marked as required on the form is necessary to process your application; if you do not provide it, we will not be able to consider your application. Please do not include in your resume any special category data (health, political views, religion, union membership, ethnic origin, or similar) or third-party data without their authorization.

Retention of Your Data: The data contained in the forms and the data from resumes received as attachments will be retained for the duration of the selection process for which you are applying and, if you have consented to its retention for future selection processes, for a maximum of two years from the date of receipt, unless you withdraw your consent earlier. If you are hired, your data will become part of your personnel file, and you will be provided with specific information regarding that processing.

3) Data collected through the REPORTING CHANNEL tool

In accordance with Law 2/2023 of February 20, we hereby inform you that when reporting information through our INTERNAL WHISTLEBLOWER CHANNEL, you may provide your identifying information as a whistleblower or do so anonymously (Art. 7.3 of Law 2/2023). The information you report may also include personal data of third parties (affected individuals, witnesses, or others). The identity of the whistleblower will remain confidential and will not be disclosed to the individuals to whom the reported facts refer (Article 33 of Law 2/2023).

This tool, as well as the information received, is managed by an EXTERNAL PROCESSOR (in accordance with Art. 6 of Law 2/2023 of February 20) that has been appointed by our company for the purpose described.

The legal basis for processing is compliance with a legal obligation, in accordance with Article 6.1.c) of EU Regulation 2016/679 of April 27 on Data Protection, in conjunction with Article 30.2 of Law 2/2023 of February 20.

Our external manager and data processor is Consulting & Strategy GFM (GFM Servicios), and the information received will be forwarded to the Head of the Internal Information System designated within our organization (Art. 8 of Law 2/2023) for review and investigation; where appropriate, it will be forwarded to the Public Prosecutor’s Office or the competent authorities if the facts appear to constitute a crime, in accordance with the legislation governing this reporting channel.

Data Retention: The data will be retained only for the time strictly necessary to decide whether to initiate an investigation. If, three months after receipt of the report, no investigative proceedings have been initiated, the data will be deleted, unless its retention is intended to provide evidence of the system’s operation: reports that have not been acted upon may only be retained in anonymized form. The data contained in the logbook will be retained for as long as necessary and proportionate, without exceeding ten years in any case (Articles 26.3 and 32 of Law 2/2023).

Exercise of rights: If the individual to whom the described events refer exercises their right to object, it will be presumed —unless proven otherwise— that there are compelling legitimate grounds justifying the processing of their personal data (Art. 31.4 of Law 2/2023).

More information on the terms of use and privacy policies regarding this tool and its use is available at canaldenunciasgfm.es.

1.5. Recipients and Data Processors

Data collected through the use of the Internal Whistleblower Channel

This data will be processed by Consulting & Strategy GFM (GFM Servicios) in accordance with the service agreement as the manager of the information received, pursuant to Article 6 of Law 2/2023 of February 20.

Browsing and Selection Process Data

Your data may be accessed by the web hosting and maintenance providers and the cookie management tool provider, in their capacity as data processors and solely for the purpose of providing their services to us; we have entered into the corresponding contract with them in accordance with Article 28 of the GDPR. We do not disclose your data to third parties, unless required by law.

1.6. International Data Transfers

To use certain tools on this website, we rely on technology providers; this may involve the transfer of data to their servers outside the European Economic Area for the purpose of providing their services, specifically to the United States and/or the United Kingdom.

In the event of data transfers to the United States, the transfer will be covered by the European Commission’s adequacy decision regarding the EU-U.S. Data Privacy Framework —Implementing Decision (EU) 2023/1795 of July 10, 2023, pursuant to Article 45 of Regulation (EU) 2016/679 of April 27 on data protection— provided that the recipient provider is certified under that Framework. If the recipient provider is not certified, the transfer will be based on the standard contractual clauses approved by the European Commission (Article 46(2)(c) of the GDPR), together with any necessary supplementary measures.

In the event of data transfers to the United Kingdom, the transfer is covered by the European Commission’s adequacy decision —Implementing Decision (EU) 2021/1772 of June 28, 2021, on the adequate protection of personal data by the United Kingdom, as amended by Implementing Decisions (EU) 2025/1226, dated June 24, 2025, and (EU) 2025/2574, dated December 19, 2025— in accordance with Article 45 of Regulation (EU) 2016/679 of April 27 on Data Protection, without the need for additional safeguards.

You may request information about processing activities that may involve a data transfer by sending your request to info@mercurysteam.com or to our DPO via email at dpo@gfmservicios.com.

1.7. Supervisory Authority

In Spain, the supervisory authority responsible for enforcing this legislation is the Spanish Data Protection Agency, to which you may file a complaint at any time. For more information, visit www.aepd.es.

1.8. Data Retention Periods

As a general rule, we retain each piece of data for only as long as is strictly necessary for the purpose that justifies its collection, after which it is blocked and made available to the authorities for the applicable statute of limitations periods. We have specified the data retention period for each purpose.

1.9. Processing of minors’ data

MERCURY STEAM ENTERTAINMENT SL does not direct its services or forms to individuals under the age of 18. If we discover that we have collected data from a person under the age of 18, we will delete it immediately. If you are a parent or guardian and believe that a minor in your care has provided us with data, please contact us at info@mercurysteam.com or through our DPO at dpo@gfmservicios.com.

1.10. Security Measures and Breaches

We implement technical and organizational security measures —which have been determined following a risk analysis conducted with the guidance of our DPO— to minimize risks, and we review them periodically, including cybersecurity audits regarding data custody. We establish, through a contract with our data processors in accordance with Article 28 of EU Regulation 2016/679 of April 27 on Data Protection, the instructions and measures to ensure the integrity and confidentiality of the information.

As part of our proactive approach, we have a protocol —known to all staff— for coordinating a response to a potential data loss or security breach, minimizing its risks and consequences, and, where applicable, making the legally required notifications (Articles 33 and 34 of the GDPR).

1.11. Withdrawal of Consent

For all processing of your data where the legal basis is consent pursuant to Article 6.1.a) of EU Regulation 2016/679 of April 27 on Data Protection, you may withdraw your consent at any time by sending us an email to info@mercurysteam.com or through our DPO at dpo@gfmservicios.com. Your request does not affect the lawfulness of processing carried out prior to your request. In the case of non-essential cookies, you may withdraw your consent through the system we have implemented, which allows you to easily modify your settings using a button.

1.12. Your rights and how you can exercise them

Data protection regulations grant you a series of rights that you can exercise with us free of charge.

These rights are governed by Articles 15 through 22 of EU Regulation 2016/679 of April 27 on Data Protection, as well as by Organic Law 3/2018 of December 5.

These rights are characterized by the following: as we have already mentioned, exercising them is free of charge; in accordance with the law, we must respond to your request within one month, which may be extended by an additional two months depending on the complexity and number of requests; if a request is manifestly unfounded or excessive, the law allows us to charge a proportionate fee or to refuse to act, providing a transparent explanation for such a decision; if we do not process your request, we will inform you within one month of the reasons and of your right to file a complaint with the supervisory authority; and you may exercise these rights personally or through a representative.

Your rights are as follows:

• Access: to find out whether we process your data and, if so, to obtain a copy of it and information regarding the purposes, categories of data and recipients, retention periods, the origin of the data, the existence of automated decision-making, and safeguards for international transfers.
• Rectification: to have inaccurate data corrected and incomplete data completed.
• Erasure: to request the deletion of your data when, among other circumstances, it is no longer necessary, you withdraw your consent, you object to the processing, or it has been processed unlawfully.
• Objection: object to processing based on legitimate interests or a public interest mission, as well as, in all cases, to processing for direct marketing purposes, after which we will cease to process your data for that purpose.
• Restriction of processing: request that we suspend processing in the cases provided for by law, retaining your data solely for the establishment, exercise, or defense of legal claims.
• Portability: When the processing is based on your consent or a contract and is carried out by automated means, you have the right to receive the data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller; where technically feasible, you may ask us to transmit the data directly to that other controller.
• Not to be subject to automated individual decision-making: not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects you, subject to the exceptions and safeguards set forth in Article 22 of EU Regulation 2016/679 of April 27 on Data Protection.

To exercise your rights, you may contact us using the “Exercise of Arsol Rights” form available on the MERCURY STEAM ENTERTAINMENT SL website or by emailing dpo@gfmservicios.com.

We have a defined protocol for handling these requests and regularly train our staff to respond to requests regarding your rights within the established timeframes.

If you deem it necessary, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es), which is the supervisory authority in Spain; its forms and information regarding your rights are available on its website.

1.13. Principles We Follow

The processing of your data is governed by the principles of lawfulness, fairness, and transparency, and this policy is written so that you can easily understand it. We also adhere to the principles of purpose limitation (we process data only for the purposes described), retention period limitation, accuracy (we ask for accurate data, and you may correct it at any time), data minimization (we ask only for the necessary data), and integrity and confidentiality, with the security measures already described. If at any time you have questions about the scope of this policy, please contact us and we will clarify it for you.

2. More Legal Information You Should Know

2.1. User Responsibility for Use and Content

Access to the website and the use of the information and content contained therein are the sole responsibility of the user. The use of the information, images, content, or products accessible through the website is subject to applicable national or international law and to the principles of good faith and lawful use. MERCURY STEAM ENTERTAINMENT, S.L. assumes no liability, direct or indirect, for any misuse of the services or content by users or third parties.

2.2. Definition of “User”

Browsing the website, as well as entering data into its forms, confers the status of “user” and implies acceptance of this Legal Notice in the version published at the time of access. Since the text is subject to change, we recommend that you read it each time you intend to use the website. Users who provide us with information through the forms on the website become JOB APPLICANTS or WHISTLEBLOWERS THROUGH THE WHISTLEBLOWER CHANNEL.

2.3. Language

The language of this Legal Notice is Spanish. In the event of any translation into another language, the original provisions in Spanish shall prevail.

2.4. Social Media

MERCURY STEAM ENTERTAINMENT, S.L. may maintain profiles on major social media platforms and, on those profiles, is responsible for processing the data that its followers include in said profiles, within the scope permitted by each platform for business profiles and, where applicable, under a joint liability arrangement with the social media platform itself, in accordance with Article 26 of the GDPR.

It may inform its followers, through the channels provided by the social media platform, about its activities, products, events, and customer service. We will not collect data from social media platforms unless we obtain the user’s specific and express consent. The user accepts the terms and privacy policies of each social media platform on which they have a profile.

2.5. Links

MERCURY STEAM ENTERTAINMENT SL is not responsible for third-party websites that may be accessed through links included on this website, nor for content made available by third parties. Access to a third-party website is at the user’s own risk.

The link to the REPORTING CHANNEL leads to a webpage containing a tool designed to comply with current legislation; this webpage belongs to the data processor contracted by our organization to provide its services, in accordance with Article 6 of Law 2/2023 of February 20. Before entering any data into this tool, you must read the terms of use and privacy policy, as well as the rest of the information provided on that page.

2.6. Disclaimer and Limitation of Liability

The information and services on this website may contain inaccuracies or typographical errors and are updated periodically. MERCURY STEAM ENTERTAINMENT, S.L. may make improvements or changes at any time.

2.7. Disclaimer Regarding Technical and Content-Related Issues

MERCURY STEAM ENTERTAINMENT, S.L. is not liable for any interruptions or malfunctions in the services or content when these are due to causes beyond its control, nor for network outages, power outages, or other indirect damages beyond its control. Nor does it guarantee the absence of errors or harmful components, although it uses its best efforts to prevent such incidents. The foregoing is without prejudice to any liability that cannot be legally excluded, particularly in cases of willful misconduct or gross negligence.

2.8. Intellectual and Industrial Property

The contents of this website —including text, images, forms, indexes, software, and other formal expressions— constitute or may constitute a work protected by intellectual and industrial property laws and/or applicable international conventions; their use without express written authorization is prohibited.

The reproduction, distribution, modification, or any other exploitation of such content without the prior written permission of MERCURY STEAM ENTERTAINMENT, S.L. is prohibited, as is the inclusion of its content on other websites through framing or similar techniques that mislead regarding its ownership, or the creation of links for defamatory purposes or that falsely imply a relationship with MERCURY STEAM ENTERTAINMENT, S.L.

In accordance with Article 4.3 of Directive (EU) 2019/790 and Article 67.3 of Royal Decree-Law 24/2021, MERCURY STEAM ENTERTAINMENT SL expressly reserves the right to use the content, trademarks, designs, and images on this website for text and data mining, including the training of artificial intelligence systems. This reservation is also stated via machine-readable formats on the website itself, and providers of general-purpose artificial intelligence models are required to respect it. In the event of non-compliance, the company will take appropriate legal action to defend its rights. MERCURY STEAM ENTERTAINMENT, S.L. may restrict access to the website and implement the necessary filters to prevent the posting of illegal or harmful content.

Our legal compliance team periodically reviews the website; if it detects any content it considers illegal or offensive, it may report it to info@mercurysteam.com. Opinions or comments submitted by users via email will only be published or displayed by MERCURY STEAM ENTERTAINMENT SL with their prior and express consent, in accordance with the terms established by law, without compensation.

2.9. Dispute Resolution and Governing Law

If the user qualifies as a consumer, he or she may bring a case before the courts with jurisdiction over the matter, which are generally those in the user’s place of residence.

If the user does not qualify as a consumer, and unless a mandatory provision provides otherwise, the parties agree to submit to the courts of Madrid, as that is the registered office of the entity that owns the website.

2.10. Applicable Law

This website is governed by European and/or Spanish law.