PRIVACY POLICY

Data Controller:

The management of the website https://the-post-office.tv/ (https://the-post-office.tv/) (hereinafter, the “Website”) entails that THE POST OFFICE, whose contact details are set out below, shall act as controller of your personal data.

THE POST OFFICE VFX, S.L.

Company Tax Number: B-56419765

Address: Calle Gran de Gracia, 1, Pral, 08012, Barcelona

Tel.: +34 628 844 155

E-mail: privacy@twentyfoursevengroup.xyz

The Controller forms part of the 24/7 Group, which is dedicated to the provision of audiovisual production services and associated services for advertising campaigns and creative projects at international level.

Where you provide your data to any entity within the 24/7 Group or enter into a contract with any of them, that entity shall act as controller of your personal data.

A full list of the entities comprising the 24/7 Group and their contact details is available here.

Details of data processing:

Below you will find a summary of the categories of personal data we process about you, the purposes for which they are processed, the legal basis on which we rely, and the sources from which we collect such data.
---------------------------------------------------------------------------------

Purpose: Responding to and handling enquiries, questions and/or requests submitted

Categories of personal data: Identification and contact data such as name, surname(s), e-mail address, telephone number, and any other information included by the user in their enquiry or message.

Legal basis: Art. 6(1)(b) GDPR – performance of, or steps prior to entering into, a contract with you

Source: Directly from you.

Recipients:

Competent public authorities or bodies, where there is a legal obligation to disclose personal data.

Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services.

————————————————————————————————————————————————

Purpose: Managing newsletter subscriptions, including sending communications about our activities, events, and related content

Categories of personal data: Identification and contact data: name, surname(s), e-mail address.

Legal basis: Art. 6(1)(a) GDPR – your consent

Source: Directly from you.

Recipients:

Competent public authorities or bodies, where there is a legal obligation to disclose personal data.

Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services.

—————————————————————————————————————————————————

Purpose: Ensuring the correct technical operation of the website and system security

Categories of personal data: Browsing data such as IP address, device information, browser type, language, access dates and times, and data relating to browsing behaviour and use of the website.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interests in the security and usability of our website

Source: Directly from you, via cookies or similar technologies, in accordance with our Cookie Policy.

Recipients:

Competent public authorities or bodies, where there is a legal obligation to disclose personal data.

Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services.

——————————————————————————————————————————————————

Purpose: Where you are a client, sending you communications about our activities, events, or services similar to those previously contracted

Categories of personal data: Identification and contact data: name, surname(s), e-mail address.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interests in direct marketing and the sending of promotional content

Source: Directly from you.

Recipients:

Competent public authorities or bodies, where there is a legal obligation to disclose personal data.

Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services.

————————————————————————————————————————————————————

Purpose: Sharing your personal data with other entities within the 24/7 Group for internal administrative purposes, including the organisation and coordination of projects and/or events

Categories of personal data: Identification and contact data: name, surname(s), e-mail address.

Browsing data such as IP address, device information, browser type, language, access dates and times, and data relating to browsing behaviour and use of the website.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interests in ensuring the proper provision of services and management of internal resources

Source: Directly from you.

Recipients: Entities within the 24/7 Group.

————————————————————————————————————————————————————

Purpose: Managing the whistleblowing channel, investigating reported matters, and complying with applicable legislation

Categories of personal data: Identification and contact data, and any other data related to the matters reported, both of the reporting person and of any third parties involved, to the extent necessary for the management, investigation, and resolution of reports.

Legal basis: Art. 6(1)(c) GDPR – compliance with a legal obligation

Source: Directly from you, through third-party reporters, or by means of investigations carried out.

Recipients:

Competent public authorities or bodies, where there is a legal obligation to disclose personal data.

Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services.

—————————————————————————————————————————————————————

Purpose: Complying with official control, supervision, and audit obligations, including official reporting and notification obligations, as well as commercial or tax legal obligations

Categories of personal data: Identification and contact data: name, surname(s), e-mail address.

Browsing data such as IP address, device information, browser type, language, access dates and times, and data relating to browsing behaviour and use of the website.

Legal basis: Art. 6(1)(c) GDPR – compliance with a legal obligation

Source: Directly from you.

Recipients:

Competent public authorities or bodies, where there is a legal obligation to disclose personal data.

Service providers, both internal and external, who may require access to personal data in order to provide their services, including: IT, hosting, communications, and support services.

———————————————————————————————————————————————————————

Purpose: In specific cases, processing your data for the establishment, exercise, or defence of legal claims

Categories of personal data: Identification and contact data: name, surname(s), e-mail address.

Browsing data such as IP address, device information, browser type, language, access dates and times, and data relating to browsing behaviour and use of the website.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interests in the defence of legal claims

Source: Directly from you.

Recipients: In the context of the processing described herein, the following recipients may have access to your data: Lawyers, Consultants, Courts, Mediators

Where you provide your data in the “Work with us” section, the processing of your personal data will be governed by the specific Privacy Policy for candidates.

For further information about these processing activities, including the relevant balancing test conducted in relation to our legitimate interests, please contact us at privacy@twentyfoursevengroup.xyz (mailto:privacy@twentyfoursevengroup.xyz).

Retention period:

The data collected will be retained for as long as necessary to fulfil the purposes for which it was collected. As a general rule, data will be retained for the duration of the relationship with the user and, once that relationship has ended, for the periods necessary for the establishment, exercise, or defence of legal claims, as well as to comply with legal and contractual obligations, during which time it will be duly blocked.

Where processing is based on consent (such as for newsletter subscriptions), data will be retained until the user withdraws their consent or requests its erasure.

In relation to the whistleblowing channel, data will be retained only for the time strictly necessary to decide whether to initiate an investigation and, in any event, in accordance with the time limits established under applicable legislation, and may thereafter be retained in blocked form for the purpose of complying with legal obligations or for legal defence purposes.

International transfers of personal data:

Some of the entities within the 24/7 Group are located outside the European Economic Area, in countries such as the Dominican Republic, Chile, and Brazil. Accordingly, access to personal data by those entities may entail the making of international transfers of personal data.

In this regard, the 24/7 Group has an intra-group agreement in place between its entities that incorporates Standard Contractual Clauses (SCCs) approved by the European Commission, which provide appropriate safeguards for the protection of personal data in the context of such transfers.

The 24/7 Group may also engage information technology, hosting, and marketing service providers located outside the European Economic Area, in particular in the United States. In such cases, international transfers of personal data are carried out subject to appropriate safeguards in accordance with applicable legislation, such as adherence to the EU-U.S. Data Privacy Framework (EU-U.S. DPF) or the execution of SCCs.

Beyond the cases described above, no international transfers of personal data are made. However, should the 24/7 Group engage new service providers located outside the European Union, it will ensure that the processing of personal data is always covered by the appropriate safeguards required under applicable legislation, and will duly inform data subjects accordingly.

For further information about international transfers of personal data, please contact us at privacy@twentyfoursevengroup.xyz (mailto:privacy@twentyfoursevengroup.xyz).

Rights:

Right to request access to your personal data: you may ask the 24/7 Group whether it is processing your personal data and, if so, to access such data.

Right to request rectification of inaccurate data, or completion of incomplete data.

Right to request the erasure of your personal data.

Right to request restriction of processing: in such case, your data will only be retained for the establishment, exercise, or defence of legal claims.

Right to object to processing: the 24/7 Group will cease processing your personal data, unless it must continue to be processed on legitimate grounds or for the establishment, exercise, or defence of legal claims.

Right to data portability: where you wish to have your data processed by another controller, the 24/7 Group will facilitate the transfer of your data to the new controller.

Where you have given your consent for a specific purpose, you may withdraw such consent at any time without affecting the lawfulness of processing based on your consent prior to its withdrawal.

To exercise any of your rights, please contact us in writing at privacy@twentyfoursevengroup.xyz (mailto:privacy@twentyfoursevengroup.xyz).

You are also entitled to lodge a complaint with the supervisory authority, in particular with the Spanish Data Protection Agency (www.aepd.es (http://www.aepd.es)), as well as any other competent public body, in respect of any claim arising from the processing of your personal data.

Last updated: May 2026

Spanish version here