PRIVACY POLICY

RESPONSIBLE FOR THE TREATMENT

The Responsible of the Treatment is THE SARAO FACTORY, SLU, Avenue of the Toy 39, 03440, Ibi (ALICANTE).

Privacy principles

From THE SARAO FACTORY S.L.U. we are committed with you to work continuously to ensure privacy in the processing of your personal data, and to provide you in every moment the information more fully and clearly than we can. We encourage you to read this section carefully before you provide us with your personal data.

If you're under the age of fourteen years, please do not provide us with your data without the consent of your parents.

In this section we will inform you of how we treat the data of the people that have a relationship with our organization. Starting with our principles:

– Do not ask you for personal information, unless it is necessary to provide the services that you need.

– We never share personal information with anyone except to comply with the law, or where we have your express authorization.

– Never use your personal data for purpose other than those set out in this privacy policy.

– Your data will always be treated with a level of protection appropriate to the legislation on data protection, and not the will to automated decisions.

This privacy policy we have written taking into account the requirements of the current legislation on data protection:

– Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons (RGPD).

– Organic law 3/2018, of December 5, of Protection of Personal Data and guarantee of digital rights (LOPD).

– Royal Decree 1720/2007, of 21 of December (RLOPD).

This privacy policy is drafted on December 6, 2018.

On the occasion of the modification of criteria for the treatment, in order to facilitate its understanding, or to adapt it to the current legislation, it is possible to modify this privacy policy. We will update the date of the same, so that you can verify its validity.

Treatments that we perform

TREATMENT OF ATTENTION TO THE RIGHTS OF THE PEOPLE (ARC)

Legal basis: RGPD: 6.1.c) Processing is necessary for compliance with a legal obligation applicable to the controller. General regulation of Data Protection.

Treatment purposes: Respond to requests in the exercise of the rights provided for in the General Regulation of Data Protection: Right of access, rectification, deletion, limitation, portability and opposition to the decision of automated decisions.

Group: Individuals who request it (employees, customers, suppliers, contact persons)

Categories of Data: Name and surname, address, signature and phone.

Categories of Recipients: Your personal data may be communicated to the Control Authority (Spanish Agency of Protection of Data) in the framework of a research for the protection of rights initiated by the interested party.

International transfers: are Not provided for international transfer of data.

Term Suppression: will Be retained for a period of five years from the time of the request.

Security measures: Adapted to the requirements of the Regulation (EU) 2016/679, General Regulation of Data Protection.

TREATMENT OF CANDIDATE SELECTION PROCESSES (HR)

Legal basis: RGPD 6.1.(a) The person concerned gave their consent to the processing of your personal data for one or more specific purposes. RGPD: 6.1.(b) Processing is necessary for the performance of a contract to which the data subject is party or for the application at the request of the measures pre-contractual.

Purposes of the Processing: staff Selection and provision of jobs.

Collective: Candidates presented to the procedures of provision of jobs.

Categories of Data: – Name and surname, DNI/CIF/Document identification, registration number of staff, address, signature and phone. – Data of personal characteristics: Gender, marital status, nationality, age, date and place of birth and family data. – Data academic and professional Qualifications, training and professional experience. – Detail data of employment.

Categories of Recipients: are Not provided for transfers of data to third parties.

International transfers: are Not provided for international transfer of data.

Term Suppression: will Be kept for the time necessary to fulfill the purpose for which it was collected and to determine the possible responsibilities that may arise from said purpose and the treatment of the data.

Security measures: Adapted to the requirements of the Regulation (EU) 2016/679, General Regulation of Data Protection.

TREATMENT PROVIDERS

Legal basis: RGPD: 6.1.(b) Processing is necessary for the performance of a contract to which the data subject is party or for the application at the request of the latter of measures pre-contractual. RGPD: 6.1.c) Processing is necessary for compliance with a legal obligation applicable to the controller. Real Decreto Legislativo 2/2015, of 23 October, approving the revised text of the Law on the Status of the Workers. Law 58/2003, of 17 December, General Taxation.

Purposes of the Processing:

– Purchase of products and/or services that we need for the development of our activity.

– Control of subcontractors, if applicable.

Collective:

– Service providers.

– People who work for our suppliers.

Categories of Data:

– First name and last name, ID card number/identity Document, address, signature and phone.

– Detail data of employment: job. Training in occupational safety.

– Economic-financial data and insurance Data bank.

Categories of Recipients:

– Financial institutions. (Bill payment)

– State Tax Administration agency.

International transfers: are Not provided for international transfer of data.

Term Suppression: will Be kept for the time necessary to fulfill the purpose for which it was collected and to determine the possible responsibilities that may arise from said purpose and the treatment of the data, according to the Law 58/2003, of 17 December, General Taxation.

Security measures: Adapted to the requirements of the Regulation (EU) 2016/679, General Regulation of Data Protection.

TREATMENT OF CUSTOMERS.

Legal basis: RGPD: 6.1.(a) The person concerned gave their consent to the processing of your personal data for one or more specific purposes. RGPD: 6.1.(b) Processing is necessary for the performance of a contract to which the data subject is party or for the application at the request of the latter of measures pre-contractual. RGPD: 6.1.c) Processing is necessary for compliance with a legal obligation applicable to the controller. RGPD: 6.1.f) Processing is necessary for the satisfaction of the legitimate interests of the controller.

Real Decreto Legislativo 2/2015, of 23 October, approving the revised text of the Law on the Status of the Workers. Law 58/2003, of 17 December, General Taxation.

Treatment purposes: Supply of our products / services.

Collective Customers.

Categories of Data:

– First name and last name, ID card number/identity Document, address, signature and phone.

– Economic-financial data and insurance: bank details

Categories of Recipients:

– Financial institutions.

– State Tax Administration agency.

International transfers: are Not provided for international transfer of data.

Term Suppression: will Be kept for the time necessary to fulfill the purpose for which it was collected and to determine the possible responsibilities that may arise from said purpose and the treatment of the data, according to the Law 58/2003, of 17 December, General Taxation.

Security measures: Adapted to the requirements of the Regulation (EU) 2016/679, General Regulation of Data Protection.

TREATMENT OF EMPLOYEES

Legal basis: RGPD: 6.1.(b) Processing is necessary for the performance of a contract to which the data subject is party or for the application at the request of the latter of measures pre-contractual. RGPD: 6.1.c) Processing is necessary for compliance with a legal obligation applicable to the controller. Real Decreto Legislativo 2/2015, of 23 October, approving the revised text of the Law on the Status of the Workers.

Purposes of the Processing:

– Management of staff.

– Personal file. Time Control. Training. Pension plans. The prevention of occupational risks.

– Emission of the payroll staff.

– Management of trade-union activity.

Group: Employees

Categories of Data:

– Name and surname, DNI/CIF/Document identification, registration number of personal, Social Security number/Mutuality, address, signature and phone.

– Special categories of data: data of health (illness, work accidents, and degree of disability, without inclusion of diagnoses), trade union membership, the exclusive purpose of the payment of union dues (in your case), a trade union representative (if applicable), proof of attendance, both own and third parties.

– Data of personal characteristics: Gender, marital status, nationality, age, date and place of birth and family data. Data of family circumstances: Date of high and low, licenses, permits and authorizations.

– Data academic and professional Qualifications, training and professional experience.

– Detail data of employment and administrative career. Incompatibilities.

– Data of control presence: date/time input and output, reason for absence.

– Economic-financial data: financial Data, payroll, credit, loans, guarantees, tax deductions, lower assets corresponding to the position of previous work (in your case), judicial withholdings (in your case), other deductions (in your case). Data bank.

Categories of Recipients:

– Entity to whom is entrusted the management of occupational risks.

– General treasury of the Social Security.

– Union organizations.

– Financial institutions.

– State Tax Administration agency.

– Main contractors who provide services as a subcontractor.

International transfers: are Not provided for international transfer of data.

Term Suppression: will Be kept for the time necessary to fulfill the purpose for which it was collected and to determine the possible responsibilities that may arise from said purpose and the treatment of the data. The economic data of this treatment activity will be retained under the provisions of Law 58/2003, of 17 December, General Taxation.

Security measures: Adapted to the requirements of the Regulation (EU) 2016/679, General Regulation of Data Protection.

TREATMENT OF CONTACTS

Legal basis: Consent of the interested party.

Purposes of the Processing: to Attend to your request, send you information and keep track of the request.

Collective: contact Persons, customers, suppliers.

Categories of Data: Name and surnames, telephone, e-mail address.

Categories of Recipients: does Not contemplate transfer of data to third parties.

International transfers: are Not provided for international transfer of data.

Term Suppression: The contact data will be retained for an indefinite period, or until the data subject requests its deletion.

Security measures: Adapted to the requirements of the Regulation (EU) 2016/679, General Regulation of Data Protection.

TREATMENT OF NOTIFICATION OF SECURITY BREACHES

Legal basis: RGPD: 6.1.c) Processing is necessary for compliance with a legal obligation applicable to the controller. General regulation of Data Protection. Articles 33 and 34.

Purposes of the Treatment: Management and evaluation of the security breaches that occur in our organization.

Collective: Variable: Employees, Customers, Suppliers, Contact Persons (depend on the security gap)

Categories of Data: Variable. (Will depend on the security gap)

Categories of Recipients: – Spanish Agency of Data Protection. – Security forces and Bodies of the State.

International transfers: are Not provided for international transfer of data.

Term Suppression: will Be kept for the time necessary to fulfill the purpose for which it was collected and to determine the possible responsibilities that may arise from said purpose and the treatment of the data. Shall apply the provisions of the regulations of files and documents.

Security measures: Adapted to the requirements of the Regulation (EU) 2016/679, General Regulation of Data Protection.

YOUR RIGHTS

You have the right to ask us for a copy of your personal data, rectify inaccurate data or to complete them if they are incomplete, or in your case delete them when no longer needed for the purposes for which they were collected.

You also have the right to limit the processing of your personal data and to obtain your personal data in a structured format and readable.

You can oppose the processing of your personal data in some circumstances (in particular, where we don't have to process them in order to comply with a contractual requirement or other legal requirement, or when the object of the treatment is the direct marketing).

When you have given us your consent, you can withdraw it at any time. At that time we will no longer process your data, or, in your case, we will do it for that specific purpose. If you decide to withdraw your consent, this will not affect any processing that has taken place for as long as your consent was valid.

These rights may be limited; if, for example, in order to meet your request had to reveal information about another person, or if you request that we delete certain records that we are required to maintain a legal obligation or a legitimate interest, as it may be to exercise or defend against claims. Or even in those cases where you must prevail the right to freedom of expression and information.

You can contact us by any of the means indicated in paragraph Responsible for the Treatment of this privacy policy, providing a copy of a document proving your identity (usually your social security number). The most convenient way of exercising their rights is accessing our PORTAL RIGHTS.

Another one of your rights is not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or shake you.

In front of any violation of your rights, as, for example, that we have not addressed your request, you have the right to lodge a complaint with the supervisory Authority in data protection. This can be in your country (if you live outside of Spain) and the Spanish Agency of Protection of Data (if you live in Spain).

Links to third-party web sites.

Our website may sometimes contain links to other web sites. It is your responsibility to ensure that you read the data protection policy and the legal terms and conditions that apply to each site.

Third party data.

If you provide us with data of third parties, you assume the responsibility to inform them in advance according to what is established in article 14 of the RGPD.