Processing of personal data

The personal data collected on our website is processed in compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as with Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights.

Likewise, we guarantee that personal data is processed in a lawful, fair and transparent manner, and is collected for specified, explicit and legitimate purposes, being kept limited to those purposes and updated where necessary. The identification of data subjects will not be permitted for longer than necessary and their security will be guaranteed through appropriate technical and organisational measures.

Who is responsible for your personal data?

• Company name: Alerce Informática Aplicada, S.A.U. (hereinafter, ALERCE)
• Tax ID: A50231182
• Address: Calle Bari núm. 25 dup, Plataforma Logística PLA-ZA, 50197 Zaragoza (España)
• Email address: infozaragoza@alerce-group.com
• Data Protection Officer contact: dpo@alerce-group.com
• Contact telephone: +34 976 25 34 00

For what purposes do we process your data and what legal basis allows us to do so? Why can we process your data?

Personal data will be processed by the responsible entity when you provide it by completing registration or contact forms, sending emails or calling by telephone.

The data will be processed for the purpose of communicating with data subjects by any means and responding to queries and requests for information.

• Responding to queries and requests for information. When a data subject sends us a query or request for information, we process their data with their consent in order to respond to the query or request by communicating commercially. Data subjects may object in the communication sent and additionally through the mechanism provided in the section "What are your rights?". Personal data will be kept for as long as it is necessary for the purpose for which it was collected and, in any case, will be deleted when data subjects withdraw their consent.
• Considering candidates for our selection processes. If the data subject provides us with a curriculum vitae, their data will be used to include them in current and future selection processes within our organisation and to communicate with them, including by electronic means, regarding their application, based on their consent or because it is necessary for the application of pre-contractual measures. The personal data of candidates will be kept until the selection process ends and, subsequently, for a maximum period of six months, and in any case will be deleted when data subjects withdraw their consent.
• Using data storage and retrieval devices. When the data subject visits our website, we will use, with their express consent, cookies and other tools for the purposes set out in our Cookie Policy where further information can be found.
• Managing our Ethics Channel, based on compliance with a legal obligation established in Law 2/2023 and with the sole purpose of preventing conduct that could entail criminal liability for the company, we make available to all our employees, suppliers and other interested third parties an Ethics or whistleblowing channel through the corresponding web form, so that they may report any conduct contrary to our internal regulations or that may constitute a criminal offence. The channel will collect, anonymously and confidentially for ALERCE, contact details guaranteeing the confidentiality of the whistleblower's data, keeping them anonymous unless their identification constitutes a necessary and proportionate obligation imposed by EU or national law in the context of an investigation carried out by national authorities or within the framework of judicial proceedings, in which case it must be communicated to the competent authorities in the matter.

To whom do we provide your data?

We may communicate personal data to third-party processors (legal, tax and accounting advisors) with the sole purpose of providing us with certain services following our instructions without using the data for their own purposes, and in order to carry out our own activities, or to the competent public authorities in compliance with legal obligations.

Except for the use of Google Analytics described below, we do not carry out international transfers of personal data to third countries.

Additionally, although the controller follows Google's recommended practices to avoid sending personally identifiable information, the use of Google Analytics cookies may involve an international transfer of personal data to Google LLC in the United States, with the security guarantees of a European Commission adequacy decision (EU-US Data Privacy Framework).

You may request further information by contacting our Data Protection Officer at dpo@alerce-group.com

How long do we keep your data?

As a general rule, data will be kept for as long as it is compatible with the purpose for which it was collected, in compliance with legal retention obligations and to address any liabilities that may arise from the processing, before being deleted.

• Data collected for the purpose of commercial communication will be kept for as long as that purpose persists or the user objects to the processing.
• Data collected for the purpose of managing our Ethics Channel will be kept within the system for a period of 3 months, which may be extended to 6 months in cases of particular complexity. After this period, it will be destroyed, but may remain blocked where necessary to demonstrate the functioning of the crime prevention model or when it may be required by the competent authority.
• Personal data relating to information received and internal investigations carried out to clarify the facts will only be kept for the period that is necessary and proportionate for the purposes of complying with this law, and in no case will be kept for a period exceeding 10 years.

Personal data whose relevance is not apparent for processing specific information will not be collected or, if collected accidentally, will be deleted without undue delay.

In the event that the person to whom the facts described in the communication refer, or to whom the public disclosure refers, exercises the right to object, it will be presumed that, unless proven otherwise, there are compelling legitimate grounds justifying the processing of their personal data.

What are your rights?

You may:

• Obtain further information
• Withdraw your consent where it has been given for a specific processing activity
• Stop receiving our commercial communications by sending "I wish to stop receiving commercial communications" to the controller's email address.
• Exercise your rights of:
  • Access, or to know what personal data we process about you;
  • Rectification, or to correct incorrect or inaccurate personal data;
  • Erasure, or to delete personal data we hold about you that we are not legally obliged to retain;
  • Objection, or to have us stop processing your personal data for a specific purpose;
  • Restriction, or to limit the processing we carry out;
  • Portability, or to have us provide you with the personal data we hold;

In order to exercise any of the rights granted to you by data protection regulations, you may request a rights exercise form from the controller or download any of the forms proposed by the Spanish Data Protection Agency directly through this link, and submit it completed with the additional information needed to verify your identity, to the controller's address or email.

• Company name: Alerce Informática Aplicada, S.A.U. (hereinafter, ALERCE)
• Address: Calle Bari núm. 25 dup, Plataforma Logística PLA-ZA, 50197 Zaragoza (España)
• Data Protection Officer contact: dpo@alerce-group.com

You can find more information about your rights or lodge a complaint with the competent supervisory authority at the Agencia Española de Protección de Datos - C/ Jorge Juan, 6. 28001 – Madrid (901 100 099 - 912 663 517).

How do we guarantee the security of your data?

We have adopted appropriate technical and organisational measures to ensure an adequate level of security that prevents the accidental or unlawful destruction, loss or alteration of personal data, or the unauthorised communication or access to such data.

We have also put in place procedures to respond within the applicable legal timeframes to any security breach that may occur in relation to your personal data.

When engaging suppliers, we ensure that they implement adequate security measures for the protection of personal data.

Changes to the Privacy Policy

Policy updated to make it more transparent.

This latest Policy is dated: 04/01/2024