In application of the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and of Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rightsGrupo Aldesa, S.A. (hereinafter ALDESA or the Entity) informs users of its website www.aldesa.com through this Privacy Policy, about the processing and protection of personal data of users that may be collected through browsing or contracting services carried out on this portal.

CONTROLLER OF THE PROCESSING OF PERSONAL DATA

The controller of the processing of the personal data provided by the user when accessing and using the website, as owner thereof, is ALDESA, with Tax Identification Number A-85289155, with registered office at Calle Bahía de Pollensa 13 and 17, 28042 – Madrid, Spain.

ALDESA has appointed a Data Protection Officer (DPO), whom users may contact to raise any issue related to the processing of their personal data, at the following email address: DPD@aldesa.com.

ALDESA adopts the necessary measures to guarantee the security, integrity, and confidentiality of data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data and the free movement of such data, and, where not provided for therein, by Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights and Law 34/2002 of 11 July on Information Society Services and Electronic Commerce.

PERSONAL DATA WE PROCESS

ALDESA may process personal data of the following types, depending on the relationship established with the user:

Identification and contact data (e.g. name and surname, email address, postal address, telephone number, IP address, etc.)

Academic or professional data and/or employment details (e.g. data contained in your curriculum vitae).

Personal characteristics and social circumstances data (e.g. age, sex, date of birth, number of children, tastes, hobbies, and lifestyle, etc.).

Commercial information (type of business).

Browsing and location data (e.g. use of ALDESA websites, sections visited, data that the user provides through social networks when indicating their location, etc.).Datos identificativos y de contacto (p.ej., nombre y apellidos, correo electrónico, dirección postal, teléfono, dirección IP, etc.).

ALDESA informs users that when personal data are collected through a form made available on our website, the user must provide at least those data marked with an asterisk (*). In the event of not providing at least such data, considered necessary, ALDESA will not be able to manage the provision of the service or respond to the query or complaint made by the user.

In addition, the user guarantees that the data provided are true, accurate, complete, and up to date.

PURPOSES AND LEGAL BASES FOR THE PROCESSING OF DATA

Personal data will be processed by ALDESA for the following purposes, depending on the interactions that the user establishes with ALDESA through the website and the type of data provided by the user:

PURPOSE 1 – Contact and management of website users

• Description of the purpose: The personal data of users who contact ALDESA through any of the contact channels made available on the website managed by ALDESA will be processed for the purpose of managing such contact, responding to requests received through them, and providing the services requested, such as, where applicable, providing consumer service support.
• Legal basis: Art. 6.1.a) GDPR – The data subject gives express and explicit consent for the processing of their personal data in order to respond to their queries.

PURPOSE 2 – Management of your application for an open recruitment process

• Description of the purpose: The personal data of users who wish to participate in our personnel recruitment processes are collected through the ALDESA website with URL https://jobsite.aldesa.es/. The data provided will be processed for the purpose of managing the receipt of CVs sent to ALDESA, as well as for the purpose of analysing the professional profile of the candidate and, where applicable, enabling participation in the personnel recruitment processes of ALDESA and, where applicable, of Grupo Aldesa companies.
• Legal basis: Art. 6.1.b) GDPR – The processing is necessary for the application of pre-contractual measures in accordance with registration for the job offer.

PURPOSE 3 – Management of cookies on the website

• Description of the purpose: In the event that users accept our Cookie Policy, in particular our analytics, personalisation, advertising, and social media cookies, users’ personal data may be processed by ALDESA for the purpose of (i) monitoring and analysing their behaviour on the website (e.g. counting visits and traffic sources in order to evaluate website performance and improve it), (ii) providing better functionality and personalisation of the website (e.g. the user may access certain criteria on their device such as language, browser type used to access the site, etc.), (iii) managing advertising, and (iv) managing the social media services we have added to allow sharing of our content, as well as creating a profile of user interests through monitoring their browsing on other websites, respectively. More information about the cookies we use can be found in our Cookie Policy.
• Legal basis: Art. 6.1.a) GDPR – The data subject gives express and explicit consent for the processing of their personal data for one or more specific purposes.

PURPOSE 4 – Management and receipt of communications relating to the ethics channel

• Description of the purpose: Users’ personal data may be processed by ALDESA for the purpose of managing and ensuring that any person, both internal and external to the organisation, may raise concerns confidentially, in accordance with applicable legislation. To this end, the organisation has the internal procedures, means, and resources necessary to carry out the investigations required to clarify the facts and prevent any conduct contrary to business ethics.
• Legal basis: Art. 6.1.c) GDPR – The processing is necessary for compliance with a legal obligation applicable to the controller, contained in Law 2/2023 of 20 February regulating the protection of persons who report regulatory infringements and the fight against corruption.

PURPOSE 5 – Customer service, promotions, and advertising – responding to queries and presenting offers and news

• Description of the purpose: Users’ personal data may be processed by ALDESA for the purpose of sending personalised commercial, advertising, or promotional information by telephone, postal mail, email, SMS, and other electronic communication media, exclusively in the event that the user has consented to such processing purpose by expressly accepting the personalised commercial communications checkbox.
• Legal basis: Art. 6.1.a) GDPR – The data subject gives express and explicit consent for the processing of their personal data for one or more specific purposes.

PURPOSE 6 – Development of the People Value Programme

• Description of the purpose: Personal data may be processed for the purpose of communicating and disseminating the experience of working at Aldesa, including the publication of content on the working environment, the benefits offered by the company, the impact of our activities on society, and the recognition obtained through certifications and collaborations with different entities.

• Legal basis: Art. 6.1.a) GDPR – The data subject gives express and explicit consent for the processing of their personal data in order to respond to their queries.

PURPOSE 7 – Improving the browsing experience

• Description of the purpose: Personal data collected during browsing of this website may be processed for the purpose of analysing user usage and browsing habits, with the aim of optimising the structure, content, and usability of the website, as well as improving the overall browsing experience.
• Legal basis: Art. 6.1.f) GDPR – The legitimate interest of the controller in offering a quality website adapted to user needs.

DATA COMMUNICATION

As a general rule, personal data will not be communicated to third parties, except for those service providers that support us in offering the aforementioned products and services, as well as in cases where communication must be made due to a legal obligation, in which case such third parties may include Public Administrations, Judges and Courts, and persons interested in procedures related to submitted complaints, among others.

We inform you that, in general, no international transfers are made outside the European Economic Area (EEA). In the event of a data transfer outside the EEA, ALDESA will have the appropriate safeguards in place to carry out such a transfer, in accordance with the requirements established by the General Data Protection Regulation.

DATA STORAGE PERIOD

Your personal data will be retained for the time necessary to fulfil the purpose for which they were collected. If your data are used for several purposes that require us to retain them for different periods, we will apply the longest retention period.

In all cases, we limit access to your data only to those persons who need to use them for the performance of their functions.

Our data retention periods are based on business needs, therefore, with regard to personal data that are no longer necessary, access thereto will either be limited to compliance with strictly legal obligations or they will be securely destroyed.

DATA SUBJECT RIGHTS

ALDESA informs you that you have the right to obtain confirmation as to whether or not we are processing personal data concerning you. Likewise, ALDESA informs you that you have the following rights regarding your personal data:

• To access your data: You have the right to access your data to know which personal data concerning you are being processed.
• To request rectification of your data: In certain circumstances, you have the right to rectify personal data that you consider inaccurate and that are being processed by ALDESA.
• To request erasure of your data: In certain circumstances, you have the right to request the erasure of your data when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
• To request restriction of the processing of your data: In certain circumstances, you will have the right to request restriction of the processing of your data, in which case we inform you that we will only retain the data in respect of which you have requested restriction for the exercise or defence of claims.
• To data portability: In certain circumstances, you will have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, as well as to have them transmitted by ALDESA to another controller.
• To object to the processing of your data: In certain circumstances and for reasons related to your particular situation, you will have the right to object to the processing of your data, in which case we will stop processing them unless we must continue doing so for compelling legitimate reasons or for the exercise or defence of possible claims.

You may also withdraw any consents you have given for the processing of your data, without affecting the lawfulness of processing based on consent prior to its withdrawal.

ALDESA informs you that you may exercise your rights regarding your personal data through any of the following means:

• By written request addressed to ALDESA, S.A., to the attention of the Data Protection Officer, at Calle Bahía de Pollensa 13 and 17, 28042 – Madrid, Spain.
• By written request addressed to ALDESA, S.A. to the email address: ARCOPOL@aldesa.com.

ALDESA will provide the requested information within a maximum period of one month from receipt of the request. This period may be extended by a further two months if necessary, taking into account the complexity and number of requests.

ALDESA informs you that you may lodge a complaint with the Spanish Data Protection Agency, especially when you have not obtained a satisfactory response in the exercise of your rights, by written request through the website (www.aepd.es) or at Calle Jorge Juan, No. 6, 28001 – Madrid.

CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be revised from time to time in order to update changes in current legislation, update procedures for collecting and using personal information, the appearance of new services, or the exclusion of others. These changes will become effective upon their publication on the website; therefore, it is important that you regularly review this Privacy Policy in order to remain informed of any changes made.