We would like to inform you that we have experienced technical problems with our information systems. During this incident, personal data of third parties may have been put at risk, although there is no evidence of information leakage.
As soon as we became aware of the incident, the necessary measures were put in place to stop it immediately and to prevent a recurrence. In parallel, we brought the incident to the attention of the Spanish Data Protection Agency and the competent authorities.
We are contacting you to inform you of this circumstance and to be particularly vigilant with regard to electronic communications and any atypical or unusual activity that may relate to your personal data in the coming weeks.
In particular, we recommend you to:
- Be wary of emails or messages that do not clearly identify the sender, when they ask you for sensitive information such as your account number, payment card details, or passwords to access services. Neither Sando nor any other company in the group will request this information by these means.
- Be particularly cautious with links included in e-mails. Do not open them unless you have full confidence in their origin.
- Contact your IT department, your mobile operator or an independent expert if you notice any issues.
You can obtain more information on the measures to be taken from the National Security Institute – INCIBE-CERT and the Spanish Data Protection Agency.
We apologise for any inconvenience this situation may cause you and would like to take this opportunity to make ourselves available to answer any questions you may have regarding this incident by contacting the Data Protection Officer at the following e-mail address: RGPD-Sando@sando.com.
This information is communicated in accordance with Article 34.3 of Regulation (EU) 2016/679 of the European Parliament and of the Council of the General Data Protection Regulation (GDPR). As stated in section C on the communication to data subjects, it is indicated that when it involves a “disproportionate effort” it may be done by “a public communication or similar measure informing data subjects in an equally effective manner”.
Likewise, this communication follows the guidelines of the Spanish Data Protection Agency’s Guide for the notification of personal data breaches, which in section V (d) indicates that it should be published in spaces such as “websites such as corporate blogs”.
Kind regards,
Grupo Empresarial Sando, S.A.
