Personal Data Protection Policy of the company CONGALSA

In compliance with current regulations on data protection, Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 (GDPR), Organic Law on Personal Data Protection (LOPDCP, 15/99), Implementing Regulation of the LOPDCP (Royal Decree 1720/2007 of 21 December), we hereby inform you of the Personal Data Protection Policy, pertaining to the processing of personal data, which is detailed below.

Personal data controller

The data controller is the legal entity that determines the purposes and means for processing personal data. In other words, the controller decides how and for what purpose the personal data will be processed. For the purposes of this Data Protection Policy, the personal data controller is:

• Company name: CONGALSA
• TIN:B-15.269.392
• Address: polígono industrial A Tomada, P13-14-15, 15940 Pobra do Caramiñal (A Coruña)
• Email: info@congalsa.com
• Telephone:981 83 44 00
• Activity: Production and commercialisation of food products.

What personal data do we process and how do we protect them?

Personal information is information about an individual that can be used to identify them. For the purposes of this Privacy Policy, the controller collects and processes the personal data explained in each type of processing, which will depend on the different services users request or the contractual relationship with us. Our organisation agrees to treat your data confidentially and to adopt suitable security measures, which may be physical, technical or organisational, in order to protect your personal data. In any case, you guarantee and are liable for the veracity, accuracy, validity and authenticity of the personal data provided and you agree to keep them up to date.

“Client” data processing

What type of personal data do we process?

Identifying data: name, ID, address, telephone, email address.
Financial data: bank account, credit card data.
Academic and professional data: profession, role, experience, degrees.
Transaction data: products and services provided.

For what purposes do we process your personal data?

We process the personal data you provide to manage company client information, to maintain the commercial relationship, accounting, administrative and invoicing management, as well as tax obligations. Purposes also include advertising and commercial prospecting, for which the interested party is also asked for consent. The personal data provided will be stored as long as the commercial relationship is maintained. If you decide to delete your personal data, said data may remain on our database for a period of time allowed by the law in order to fulfil tax and accounting obligations. The data will be deleted after this period or any applicable period has elapsed.

What grounds are there for processing your data?

The legal basis for processing your data is the execution of a contract, as well as complying with the controller’s legal obligation. Communicating offers and promotions that may be of interest will be based on express consent, which will be requested.

Who will we send your data to?

We will not send your personal data to any other entity, except when legally required to share the information with government bodies. The data will not be transferred internationally.
Processing of “Contact and potential client” data

What type of personal data do we process?

Identifying data: name, address, telephone, email address.

For what purposes do we process your personal data?

We process the personal data provided to manage the information of commercial contacts and potential clients. Purposes also include advertising and commercial prospecting, for which the interested party is also asked for consent. The personal data provided will be stored as long as the commercial relationship is maintained. If you decide to delete your personal data, they will be removed from our contact database.

What grounds are there for processing your data?

The legal grounds for processing your data is the express consent you give.

Who will we send your data to?

Your personal data will not be passed on to other parties. The data will not be transferred internationally.

“Supplier” data processing

What type of personal data do we process?

Identifying data: name, ID, address, telephone, email address.
Financial data: bank account.
Academic and professional data: profession, role, degrees.
Transaction data: products and services delivered.

For what purposes do we process your personal data?

We process the personal data you provide to manage company supplier information, to maintain the commercial relationship, accounting, administrative and payment management, as well as tax obligations. The personal data provided will be stored as long as the commercial relationship is maintained. If you decide to delete your personal data, said data may remain on our database for a period of time allowed by the law in order to fulfil tax and accounting obligations. The data will be deleted after this period or any applicable period has elapsed.

What grounds are there for processing your data?

The legal basis for processing your data is the execution of a contract, as well as complying with the controller’s legal obligation.

Who will we send your data to?

We will not send your personal data to any other entity, except when legally required to share the information with government bodies. The data will not be transferred internationally.

“Employee” data processing

What type of personal data do we process?

Identifying data: name, ID, date of birth, address, telephone, email address, signature, image.
Personal characteristics data: Sex, marital status, nationality, age, date and place of birth and family information.
Social circumstances information: licences and permits.
Economic-financial data: bank account, payroll information, tax deductions, other withholdings (if any).
Academic and professional data: profession, role, experience, degrees.
Presence control data.

For what purposes do we process your personal data?

We process the personal information you provide to manage the work relationship, payroll management, administrative and payment management, fulfilling the company’s tax and labour obligations, controlling access, managing training and professional development and preventing labour risks. The personal data provided will be stored as long as the employment relationship is maintained. If you decide to delete your personal data after the end of the employment relationship, the data will be kept until the end of the legal terms set out in accounting, tax, and labour regulations. After these periods have elapsed, your data will be removed from our system.

What grounds are there for processing your data?

The legal basis for processing your data is the execution of a contract, as well as fulfilling the controller’s legal obligation.

Who will we send your data to?

Any necessary transfers to government bodies or legally required transfers will be made: Tax Agency, Social Security, Mutual Insurance Company, etc. Data will also be transferred for legitimate purposes associated to the company’s activities:
Banking data (TIN, name and surname and account number) must be transferred to the financial entities responsible for taking part in paying salaries.
Personal identifying information and contact information about said employees could be delivered to travel agencies responsible for managing travels abroad, process visas, booking hotels and plane tickets.
In addition, in cases where it is necessary to justify personnel expenses on additional aid, training or project finances with public funds, payroll information may be passed on to government administrations responsible for assessing said aid or projects, according to current regulations.
The photograph of an employee may be used in a publication or website in order to advertise an event or action related to the company’s activities, for which the interested party will be asked for consent.
The data will also not be transferred internationally.

“Applicant” data processing

What type of personal data do we process?

Identifying data: name, ID, date of birth, address, telephone, email address, image.
Personal characteristics data: Sex, marital status, nationality, age, date and place of birth.
Academic and professional data: profession, role, experience, degrees.

For what purposes do we process your personal data?

We process the personal data you provide to manage the company’s selection processes. The personal data provided will be stored as long as the interested party has not withdrawn their consent to continue saving their CV for future selection processes. If you decide to delete your personal data, they will be removed from our employment candidate database.

What grounds are there for processing your data?

The legal grounds for processing your data is the express consent you give.

Who will we send your data to?

No transfers will be made. The data will also not be transferred internationally.

“Video surveillance” data processing

What type of personal data do we process?

Identifying data: image.

For what purposes do we process your personal data?

We process personal data to store video surveillance images at the company’s premises for security reasons. The personal data is stored for the legally permitted length of time (one month).

What grounds are there for processing your data?

The legal grounds for processing your data is satisfying the legitimate interests of the data controller.

Who will we send your data to?

We will not send your personal data to any other entity, except when legally required to share the information with Security Enforcement Bodies. The data will not be transferred internationally.

“Visitor Control” data processing

What type of personal data do we process?

Identifying information: name, ID.
Academic and professional data: company, role.

For what purposes do we process your personal data?

We process personal data to manage visitors and access to the company’s premises for security reasons. Personal data will be kept as long as the interested party does not request that the data is deleted. If you decide to delete your personal data, they will be removed from our database.

What grounds are there for processing your data?

The legal grounds for processing your data is satisfying the legitimate interests of the data controller.

Who will we send your data to?

We will not send your personal data to any other entity, except when legally required to share the information with Security Enforcement Bodies. The data will not be transferred internationally.

“Consumer” data processing

What type of personal data do we process?

Identifying data: name, ID, address, telephone, email address.
Transaction data: products and services provided.

For what purposes do we process your personal data?

We process personal data provided to manage the data of the company’s consumers, in order provide after-sales services and manage incidents and complaints. The personal data provided will be stored as long as the commercial relationship is maintained. If you decide to delete your personal data, they will be removed from our contact database.

What grounds are there for processing your data?

The legal grounds for processing your data is agreeing a contract.

Who will we send your data to?

Your personal data will not be passed on to other parties. The data will not be transferred internationally.

What are your rights when you provide your data?

According to applicable regulations on data protection, you have a range of rights regarding the processing of your personal data. Exercising these rights will be free, except where you make manifestly make unfounded or excessive (especially repetitive) requests. These rights are the following:

1. Right to information: You have the right to be informed in a concise, transparent, intelligible and easy-to-access way, using simple and clear language, regarding the use and processing of your personal data.

2. Right to access: You have the right to request at any time that we confirm whether we are processing your personal information, to request access to said information and information regarding processing, and to obtain a copy of said data. The copy of your personal data that we provide will be free. However, additional copies may be subject to a reasonable charge based on administrative costs. We may ask you to prove your identity or request additional information to manage your request.

3. Right to amend: You have the right to request that inaccurate, outdated or incomplete information is corrected. You may request that incomplete data is completed, including by means of an additional declaration.

4. Right to suppression: You have the right to request that your personal information is suppressed in the event that the data is no longer needed for the purposes for which it was originally collected, or for a different reason. Nevertheless, this right is not absolute. Our organisation may retain the information, while blocking them, in the events set out in applicable regulations.

5. Right to limit processing: You have the right to request that we limit the processing of your personal data, which means that we can continue storing them, but we can no longer process them if any of the following conditions are met:

• You challenge the accuracy of the data, for a period that allows the controller to verify their accuracy;
• Processing is illicit and you oppose the suppression of data and request that their use is limited;
• Our entity no longer needs the data for processing purposes, but you need them to formulate, exercise or defend claims;
• You have opposed processing while it is verified if the legitimate purposes of our entity prevail over yours.

6. Right to data portability: You have the right to have your data be sent to a different data controller in a commonly used, structured format that can be read mechanically. This right is applied in the event that the processing of your personal data is based on consent or the execution of a contract, and said processing is carried out through automated means.

7. Right to oppose: This right allows you to oppose the processing of your personal data, including creating profiles. We cannot address your claim in a cost-effective manner in the event that we have legitimate reasons to process your data or we need to make or defend against claims.

8. Right to submit to automated decisions, including profiles: This right allows you to not be the object of a decision economically based on automated processing, including creating profiles that have legal or similar effects. Except if said decision is necessary to agree a contract, is permitted by law, or is based on consent.

9. Right to withdraw consent: In the event that we have obtained your consent to process your personal data in relation to certain activities (for examples, to send you advertising information), you may withdraw this consent at any time. If you withdraw your consent, we will stop performing this specific activity for which we previously obtained consent, except if there is a different reason that justifies continuing to process your data for this reason, in which case we will let you know of this fact.

10. Right to make a claim before a control authority: You can make a claim before the Spanish Data Protection Agency, C/ Jorge Juan, 6, 28001 Madrid, 901 100 099 – 912 663 517 (www.agpd.es), or by going to: https://sedeagpd.gob.es/sede-electronica-web/vistas/formQuejasSugerencias/seleccionarQuejaSugerencia.jsf

You can exercise the above rights by writing to our Customer Care Department, or by emailing info@congalsa.com, attaching a copy of your ID and providing the necessary details to process your request. Interested parties may obtain additional information regarding their rights on the website of the Spanish Data Protection Agency, www.agpd.es.