GDPR Art. 14 Information
Last updated: 29 May 2026 · Information provided in accordance with Article 14 of Regulation (EU) 2016/679 (GDPR)
Where personal data is not obtained directly from the data subject, Article 14 of the GDPR requires the controller to provide certain information. LeadsBase processes professional contact data of Spanish companies sourced from public sources and third parties, so this page fulfils that information duty.
1. Data controller
- Company name: lintatalle SL
- Registered office: Calle Cenicero 6, 28014 Madrid (Spain)
- Trade name: LeadsBase (TRESAAA family of B2B sales intelligence services)
- Contact: hola@leadsbase.es
- Data Protection Officer (DPO): dpo@leadsbase.es
2. Categories of data processed
We process identifying and contact data of a commercial and corporate nature relating to legal persons:
- Legal-person data: company name, tax ID, registered office, CNAE code, activity, age and published economic activity data.
- Generic corporate contact data: switchboard phone number, generic company email (info@, contacto@, ventas@) and web address published by the company itself.
We process exclusively data on legal persons and generic corporate contacts. We do not offer or market data on natural persons (names, positions or personal contacts of directors, representatives or employees), nor special categories of data (Art. 9 GDPR), nor data of a personal or household nature.
3. Source of the data (Art. 14(2)(f) GDPR)
The data is not obtained from the data subject, but from a set of publicly accessible sources and licensed providers:
- BORME — Official Gazette of the Commercial Registry, the official public source of commercial publicity (Royal Decree 1784/1996).
- Official registers and gazettes — BOE, public procurement registers and publicly accessible grant databases.
- Corporate websites — information that companies themselves publish freely on the internet.
- Open geographic sources — OpenStreetMap, Overpass API and public cartographic data.
- Third-party providers — commercial databases lawfully acquired under a usage licence.
- AI enrichment — models that infer sector classification and descriptions from the public information above.
4. Purpose and legal basis
Purpose: to enable our clients to carry out legitimate B2B sales prospecting between Spanish companies (identification of companies by sector, territory and activity).
Legal basis: legitimate interest (Art. 6(1)(f) GDPR). The processing of professional contact data for direct marketing purposes between businesses constitutes a legitimate interest recognised by Recital 47 of the GDPR. We have carried out and documented the corresponding Balancing Test / Legitimate Interest Assessment (LIA), available on reasoned request to dpo@leadsbase.es.
5. Recipients and data processors
The data is made available to LeadsBase clients who have agreed to the service's terms of use. To support our infrastructure we use data processors with a signed Art. 28 GDPR contract: Cloudflare (CDN/DNS), Google Cloud (Vertex AI, enrichment) and Stripe Inc. (payments). Where providers outside the European Economic Area are involved, transfers are covered by Standard Contractual Clauses or by the EU-US Data Privacy Framework.
6. Retention period
We retain the data for as long as the company is listed as active in the Commercial Registry and for the 5 years following its deregistration (commercial limitation period). If you exercise your right to object or to erasure, we block your data immediately and exclude it from future deliveries.
7. Your rights as a data subject
Since the data was not obtained directly from you, you have the right to information(this very page) and, in addition, you may exercise at any time the rights of:
- Access — to know what data of yours we process and its source.
- Rectification — to correct inaccurate or incomplete data.
- Erasure — to request the deletion of your data.
- Objection — to object to processing based on legitimate interest, including direct marketing (see section 8).
- Restriction — to restrict processing in the cases provided for by law.
- Portability — to receive your data in a structured, commonly used format.
8. How to object to the processing (opt-out)
You can object to the processing of your data or request its erasure in any of these ways:
- By writing to dpo@leadsbase.es stating the company or the data item you wish to exclude.
- By writing to hola@leadsbase.es.
We process objection and erasure requests automatically within a maximum of 30 days. Once your request has been handled, your data is blocked and excluded from future deliveries to clients. Objecting is free of charge and you do not need to justify the reason when it concerns direct marketing.
9. Complaint to the supervisory authority
If you believe that the processing of your data does not comply with the regulations, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid — aepd.es.
10. Related information
Data controller: lintatalle SL — Calle Cenicero 6, 28014 Madrid.