1. Data Controller

DEOLEO, S.A. is a Spanish company, with headquarters in Rivas-Vaciamadrid (Madrid), calle Marie Curie number 7, Beta Building (Rivas Futura Business Park), registered in the Commercial Registry of Córdoba in Volume 2.425, Folio 56 Y, Page CO-35003, and with Identification Number A-48.012.009..

Contact details for the data controller • Identity: DEOLEO S.A. • Fiscal ID Number: A-48.012.009 • Registered office: Ctra. N-ÍV, Km 388, Alcolea (Córdoba) • Postal address: headquarters in Rivas-Vaciamadrid (Madrid), calle Marie Curie number 7, Beta Building (Rivas Futura Business Park) • Email for privacy purposes: rgpd@deoleo.com.DEOLEO acts as the data controller and service provider to the members, users, associates and visitors to this website.

2. Purpose

We process the data provided to us by data subjects in order to:

1. Manage service delivery to consumers and data subjects of DEOLEO’s products based on their consent, the execution of a contract or in compliance with the data controller’s legitimate interest.

2. Manage job offers and applicants based on their consent or on the execution of a contract or pre-contract.

3. Commercial communications of group companies, for linked services based on the data controller’s legitimate interest.

4. Manage the information necessary for shareholders for the Management Board and activities relating to the company on the basis of their consent and pursuant to a legal obligation.

5. Video surveillance of facilities based on the data controller’s legitimate interest.

Whether there is an obligation to provide data and the consequences of failing to do so

The data requested is necessary in order to enter into a contract with Deoleo. Should all the data requested not be obtained, you will not be able to enter into a contractual relationship with the data controller.

3.Conservation

The data will be retained until the purpose for which your personal information is being processed has been accomplished. Once this happens, the data will be retained but blocked, pending possible legal or administrative requirements for the latter, until it has been time barred.

4.Recipients

Recipients or categories of recipients.

1. In general, the public administration, the tax agency, authorities with jurisdiction and government bodies in relation to legal compliance established for any Deoleo company.

2. The parent company of the Deoleo group in Spain for Deoleo’s subsidiaries, delegations and branches worldwide.

Aside from previous data transmissions, Laboral Kutxa collaborates with some third-party service providers and they have access to your personal data and process this data on behalf of Laboral Kutxa as a result of a service provision agreement.

5. RIGHTS

How to exercise the rights to access, rectify and erase data and the right to data portability, and restrict or object to personal data being processed.

The rights recognised by the GDPR are:

• Right to request access to personal data relating to the data subject
• Right to request rectification or erasure
• Right to request that processing your data be restricted
• Right to object to your data being processed
• Right to data portability
• To exercise your rights you need only send an email to the following address rgpd@deoleo.com, requesting the right concerned and attaching to the email your registration email and your telephone number, so you can be identified.

What are your rights:

Access

You are entitled to be informed of the following:

• The purpose for which your data is being processed, categories of personal data being processed, possible data transmissions and the recipients of the latter.
• If possible, the period for which your data will be kept. If this is not possible, the criteria used to determine this period.
• The right to request data be rectified or deleted, to restrict or object to the data being processed.
• The right to make a complaint to the Supervisory Authority.
  If there is an international data transfer, to receive information about the appropriate guarantees.
• On the existence of automated processing (including profiles), decisions, the logic applied and the consequences of this processing

Rectification

You have the right, in addition to rectifying inaccurate data, to complete any incomplete personal data, including through an additional statement ERASURE. (THE “RIGHT TO OBLIVION”) With this right you can request:

• That personal data be erased without undue delay when any of the cases provided for is applicable. For example, unlawful data processing, or where the purpose motivating the processing or collection has ceased to exist.
• However, the regulations envisage a number of exceptions in which this right will not be applicable. For example, when the right to freedom of expression and information should prevail

Restricting processing

This right entitles you to:

• Request that the data controller stop processing data when: The accuracy of the data is contested, while the data controller verifies its accuracy. The person concerned has exercised their right to oppose the processing of the data, while it is checked if the data controller’s legitimate reasons prevail over the rights of the data subject.
• Request that the data controller conserve your personal data when: Processing the data is unlawful and the data subject is opposed to the erasure of their data and requests instead that its use be limited, the data controller no longer needs the data for the purposes of processing, but the data subject does need it to formulate, exercise or defend their claims.

Data portability

You can be provided with your personal data in a structured, commonly used and machine-readable format, and have the ability to transmit it to another data controller, whenever technically possible.

On the other hand, the data owner expressly authorises that, in cases where portability is requested, your personal data is assigned so it can be transferred, in order to carry out such transactions.

Objection Using the right to object you can oppose the processing of your personal data:

• Where for reasons relating to your personal situation, the processing of your data must cease unless a legitimate interest can be proven, or it is necessary to exercise or defend a claim.
• Where the processing is intended for direct marketing.

Where you will not be subject to individualised decision making

You have the right not to be subjected to a decision based solely on automated processing, including profiling, which may have legal effects or affect you.

• There is an exception to the above when it is necessary to complete or perform a contract. It is permitted by EU law or that of a Member State, with appropriate measures to safeguard the rights and freedoms of the data owner. There is explicit consent from the data owner.

Right to withdraw consent once given.

You can always refuse to receive monthly information by email. Should you not consent to the main processing of your data we cannot establish a client relationship with you.

Right to complain to the Supervisory Authority.

Request to submit a claim for protection of rights to the Supervisory Authority.

6.Origin of the Data and Categories

To achieve the purposes described above, we collect or receive personal information:

• Directly from candidates applying for a job.
• Directly from shareholders according to DEOLEO’s obligations.
• Images obtained through video camera recordings when accessing the facilities.
• From contractors in relation to the data of workers contracted in accordance with the legislation currently in force.

Publicity

We hereby clarify that we can offer you direct or indirect advertisements, both on our digital products and outside of them, according to the cookie setting.

When you pay a visit to or carry out an action on any of our products, we link you to the contents displayed or shared through your browser using cookies, which you can disable or delete when you decide to do so.

Categories of data being processed

“Personal data” includes any information which can be directly (for example, name, surname) or indirectly (for example, an ID card) identified with a physical person.

The categories of data being processed are:

• Identification data: names, addresses, telephone numbers.
• ID codes or passwords issued by public bodies, for example, passport, National ID Document.
• Personal characteristics, for example, postal or electronic addresses.
• Employment information.
• Financial data from the services provided.
• Information about cookies, for example, cookies and similar technologies on web sites and applications (see also our Cookie Policy).
• Images if you access our facilities.
  Special category data is not processed.

7.Security Measures

DEOLEO has adopted the technical and organisational measures to ensure the security and integrity of the data, as well as to prevent its alteration, loss, unauthorised processing or access.

8. Reviewing the Privacy Policy

DEOLEO will carry out regular reviews of the privacy policy, unless there are demands, regulatory or otherwise, that make it necessary to adapt the policy more frequently. Therefore, users are advised to regularly consult its contents.