PRIVACY POLICY AND PERSONAL DATA PROTECTION

In compliance with the principle of transparency and the duty of information established by the applicable community and national data protection regulations, CERDAGROUP S.L. informs the interested parties about the circumstances and conditions of the processing of their data, as well as their rights.

The Privacy Policy is part of the General Terms and Conditions governing this website and applies to all entities belonging to CERDAGROUP S.L..

Who is responsible for processing your data?

We reserve the right to modify or adapt this Privacy Policy at any time. We recommend reviewing it regularly to stay updated.

If you belong to any of the following groups, please refer to the detailed information:

CLIENTS

What personal data do we process?

We process the identification and contact data of our clients' representatives in order to manage the contractual relationship we have with the legal entities they represent. If you are an individual, we will process your identification, contact, and financial data solely to manage the contractual relationship we have with you.

What purposes will we process your personal data for?

• Preparation of the quote and its follow-up through communications between both parties.
• Provide the contracted services, as well as manage and maintain the commercial relationship with our clients.
• Provide information through electronic means regarding your requests.
• Provide commercial or event information through electronic means, provided that there is explicit consent or it is within our legitimate interest.
• Invoicing and declaration of applicable taxes.
• Perform the necessary transactions.
• Manage control and collection processes.

What is the legal basis for processing your data?

• Existence of a contractual relationship between the parties or application, at the request of the interested party, of pre-contractual measures.
• Compliance with a legal obligation applicable to the Data Controller.
• Consent granted by the interested party or their legal representative.
• Legitimate interest of the Data Controller.

How long will we retain your personal data?

For the duration of the relationship between the parties and, once terminated, duly blocked during the applicable statute of limitations period.

WEBSITE OR EMAIL CONTACTS

What data do we collect through the website?

If you provide us with information through a contact form, we will process your identification, contact, and any other data you share with us through this form.

In addition, we may process your IP address, the type of operating system or browser used, as well as the duration of your visit, in a pseudonymized manner.

What purposes will we process your personal data for?

• Manage the requested service, respond to your request, or process your inquiry.
• Provide commercial or event information via electronic means.
• Perform analyses and improvements on the CERDAGROUP S.L. website, regarding the products or services offered, as well as enhance the commercial strategy.

What is the legal basis for processing your data?

The user's consent or the existence of a contractual relationship between the parties.

How long will we retain your personal data?

As long as you are linked to us or until you exercise a right involving the deletion of your data, keeping the data duly blocked for the legally established statute of limitations periods.

SUPPLIERS

What personal data do we process?

We process the identification and contact data of our suppliers' representatives to manage the contractual relationship we have with the legal entities they represent.

What purposes will we process your personal data for?

• Preparation/approval of the quote and follow-up through communications between both parties.
• Follow-up of the contracted services and management of the commercial relationship.
• Invoicing and declaration of applicable taxes.
• Provide commercial or event information via electronic means, provided that there is explicit consent or it is within our legitimate interest.
• Perform the necessary transactions, as well as manage control and collection processes.

What is the legal basis for processing your data?

• Existence of a contractual relationship between the parties or application of pre-contractual measures.
• Compliance with a legal obligation applicable to CERDAGROUP S.L..
• Consent granted by a legal representative of the supplier.
• Legitimate interest of CERDAGROUP S.L..

How long will we retain your personal data?

For the duration of the relationship between the parties and, once terminated, duly blocked for the applicable statute of limitations period.

NEWSLETTER CONTACTS

What data do we collect through the Newsletter?

Identification data (name and surname) and contact data (email address).

What purposes will we process your personal data for?

Periodic sending of news, promotions, and information of interest.

What is the legal basis for processing your data?

Consent granted by the interested party or their legal representative.

How long will we retain your personal data?

Until the consent granted is revoked, which may be done at any time without retroactive effects, keeping the data duly blocked for the legally established statute of limitations periods.

The interested party will always have the option to unsubscribe from any communication.

JOB APPLICANTS

What personal data do we process?

We process the data you share with us in the selection process or spontaneous application. In general, we process your identification data, contact data, CV, and data related to your professional and/or academic experience.

What purposes will we process your personal data for?

• Organizing selection processes for hiring employees.
• Inviting you for job interviews and evaluating your application.
• Storing your CV for future selection processes if you are not selected for the process you applied for.

What is the legal basis for processing your data?

• Application of pre-contractual measures at the request of the interested party.
• Consent granted by the interested party or their legal representative for storing the CV and data related to their professional and/or academic experience.

How long will we retain your personal data?

Until the selection process is completed, and if we have authorization, for a maximum period of 1 year, keeping the data duly blocked for the legally established statute of limitations periods after the indicated periods.

QUALITY SURVEYS

What data will we process?

Your identification data and the data derived from the responses provided in the survey.

What purposes will we process your personal data for?

Assessing the quality of the service or product provided, as well as improving the services or products offered.

What is the legal basis for processing your data?

Your consent, which may be revoked at any time without retroactive effects.

How long will we retain your personal data?

Until the consent granted is revoked, which may be done at any time without retroactive effects, keeping the data duly blocked for the legally established statute of limitations periods.

VIDEO SURVEILLANCE

What personal data do we process?

We process your image and, in the case of external cameras or parking lot cameras, we process your vehicle's license plate.

What purposes will we process your personal data for?

To ensure the security of goods, facilities, and people.

What is the legal basis for processing your data?

The legal basis legitimizing the processing is the performance of a task carried out in the public interest.

How long will we retain your personal data?

For a period of 1 month from its capture, unless there is an incident, in which case they may be stored for a longer period until the incident is resolved or until the recordings are communicated to the law enforcement authorities or competent authorities.

ETHICAL CHANNEL

What data will we process?

If identified, we may process the following data: name, surname, email, phone, and personal data of third parties provided in the communication.

What purposes will we process your personal data for?

• Manage communications.
• Take corrective measures as necessary.
• If necessary, inform you of the outcome of the process.

What is the legal basis for processing your data?

The legal basis legitimizing the processing is the fulfillment of a legal obligation applicable to the Data Controller.

How long will we retain your personal data?

The data will be kept for the time strictly necessary to clarify the communicated facts. In any case, three months after receiving the communication or, if no acknowledgment of receipt was sent to the informant, three months after the expiration of the seven-day period following the communication, unless special complexity cases require an extension, in which case it may be extended up to a maximum of three additional months, after which the provided data will be deleted, unless investigated in a different legal environment.

SOCIAL MEDIA

What personal data do we process?

We will use the data available in your user profile, as well as the data you provide when contacting us through our social media profiles.

What purposes will we process your personal data for?

• Process and respond to your queries, requests, or inquiries.
• Manage the requested service.
• Post your image on our profiles, at your request.
• Interact with you and create a community of followers.

What is the legal basis for processing your data?

The bases legitimizing the processing are the voluntary consent of the interested party to contact us and, if applicable, the acceptance of a contractual relationship in the corresponding social network environment. The processing of data within the Social Network will be carried out according to their Privacy Policies.

How long will we retain your personal data?

We can only consult or delete your data in a restricted manner, as you have a specific profile. We will process your data as long as you keep following us, being friends, or clicking “like,” “follow,” or similar buttons.

Any rectification of your data or restriction of information or publications must be done through the settings of your profile or user on the social network itself.

ADDITIONAL INFORMATION ON THE PROCESSING OF YOUR DATA

Do we include personal data of third parties?

No, as a general rule, we only process the data provided by the data subjects. If you provide us with third-party data, you must inform them in advance and obtain their consent, otherwise, you exempt us from any liability for failure to comply with this requirement.

What about minor data?

We do not process data from minors under 14 years old. Therefore, please refrain from providing such data if you are under this age or, if applicable, from providing data from third parties who do not meet the required age. CERDAGROUP S.L. is exempt from any responsibility for failure to comply with this provision.

What security measures do we apply?

Rest assured, we have adopted an optimal level of protection for the personal data we manage and have implemented all available technical measures according to the state of technology to prevent loss, misuse, alteration, unauthorized access, and theft.

Who will your data be shared with?

Your data will not be shared with third parties, unless legally required or prior consent has been given by you. However, your data may be communicated to the State Tax Administration Agency and banks and financial institutions for the collection of the provided service or acquired product.

To fulfill the purposes outlined in this Policy, we will collaborate with service providers who may have access to your personal data. CERDAGROUP S.L. has signed the corresponding data processing contract with them, which imposes, among other things, the following obligations: apply appropriate technical and organizational measures; process the personal data for the agreed purposes and only in accordance with the instructions provided by CERDAGROUP S.L.

What rights do you have?

• Access your personal data.
• Request the rectification of your data if it is inaccurate.
• Request the deletion of your data.
• Withdraw any consent given.
• Request the limitation of the processing of your data.
• Not to be subject to automated decisions.
• Port your data, which will be provided in a structured, commonly used, or machine-readable format.
• File a complaint with the Spanish Agency for Data Protection (www.aepd.es)

If you modify any data, please let us know so we can keep them updated.

How can you exercise your rights?

• We have forms for exercising your rights, which you can request at the postal or electronic addresses listed at the beginning or, if you prefer, you can use those provided by the Spanish Agency for Data Protection or third parties.
• Forms can be submitted in person, sent by mail, or by email to the Responsible Party's address, available at the beginning of this text.
• If there is a reasonable doubt about your identity, we will be required to ask for additional identification information to process your request.

How long does it take us to respond to the exercise of rights?

One month from receipt, extendable by two additional months if the exercise of the right requires additional complexity, notifying you in time and form.

Do we process cookies?

If we use cookies other than necessary ones, you can consult the Cookie Policy in the corresponding link, available at the beginning of our website.