ENTITY RESPONSIBLE FOR PROCESSING
ISATI ENGINEERING SOLUTIONS, S.L.
Address: Vitoriabidea 17, 01010 Vitoria-Gasteiz (Álava)
Tel. 945 197 111
HOW WE OBTAINED YOUR DATA
Obtained from the party concerned
If you are a current or potential customer, or simply a user of our website, you have provided your data to us, either offline or online when requesting our services in order to enable us to maintain the contractual relationship with you, or to contact us asking for information or, for example, if you have sent us your CV.
The categories of data we process are: personal data, postal or electronic addresses, professional and academic data and data on employment details, commercial information, and financial data. We process specially protected data in the event of an accident at work with sick leave.
When you provide us with your personal information, you guarantee that you are authorised to provide this information and that it is true, accurate and up-to-date, that it is not confidential, that it does not violate any contractual restrictions or third party rights and that you undertake not to impersonate other users.
Obtained automatically when visiting our website
If you have provided us with data through this website, we collect information, for example, when you access a page, when you fill out any form with personal data, or when you communicate with us directly by email.
When you visit our website, data is sent from your browser to our server in order to optimise our services and improve your user experience, for example when you access the site or when you sign in to our services via third-party services such as social networks or Google. Such data may be automatically collected and stored by us or by third parties on our behalf. This data may include:
· the user’s IP address
· the date and time of the visit
· the URL of the site the user came from
· the pages visited on our website
· information on the browser used (type and version of browser, operating system etc).
We may process and record such uses, sessions, and related information, either independently or with the help of third-party services, including through the use of “cookies” and other tracking technologies such as flash cookies and web analytics.
As regards other people’s data, you should respect their privacy by taking special care when publishing their personal data. We remind you that, as a user, you can only provide and consent to the processing of your own personal data, not that of third parties. If you provide us with data from third parties you are making a transfer of personal data, and it is your responsibility to have the prior and express consent of those third parties to use the data and provide it to us, and you are responsible for informing the third party of the inclusion of their data in our files.
In addition to data protection regulations, the publication of a third party’s data without their consent may infringe their right to honour, privacy or their own image. These rights are protected by the provisions of Spanish Law 1/1982, of 5 May, on the civil protection of the right to honour, personal and family privacy and an individual’s own image.
The data can be processed for different purposes, for example:
· If you are a current or potential customer, to maintain contact and communication with you, manage the contractual and / or commercial relationship, including after sales services and warranty.
· If you are simply a user of our website or the sender or recipient of an e-mail, to maintain contact and communication with you and manage the requests you make to us online.
· If you provide us with your career details or send us your CV, to contact you and manage the selection processes that we carry out.
· To carry out opinion and/or satisfaction surveys and to send you, by means of electronic communications, information about our activities, products and/or services similar to those requested (including advertising and/or commercial communications for the purposes of Article 21 LSSICE 34/2002). If we already have a prior contractual relationship, we will forward such communications on the basis of our legitimate interest. If we do not have a previous contractual relationship, we will only send you this type of communication if you authorise us to do so by marking the option that is expressly included for this purpose on the relevant forms. The electronic communications we send you will include, in the communication itself, the option to stop receiving them. If you so choose, we will stop sending you these types of communications in the future.
The personal data you provide us with will be kept for as long as you do not ask us to delete it. Even when such a request is made, we may keep the data for the necessary and limited time required for processing, only to comply with the legal/contractual obligations to which we are subject and/or during the legal periods foreseen for the prescription of any responsibilities on our part and/or the exercise or defence of claims derived from the relationship maintained with the interested party.
There are a range of legal bases that entitle us to process your data:
Firstly, it can be the legal relationship that unites us, if you are a current customer/supplier, or the pre-contractual relationship of any kind that exists between the parties if you are a potential customer/supplier (for example if you have asked us for information, an offer or a quote…). The provision of the requested data is compulsory as it is essential to formalise and/or maintain the contractual or pre-contractual relationship and to fulfil the legal obligations arising from it; if you do not provide it, we will not be able to provide the service originating from this relationship.
It can also be your consent, if you have made an enquiry through our website while using it or if you have sent us your CV. You give us this consent unequivocally when you provide us with your data online or offline, and this is considered a clear affirmative act that expresses your consent. You may withdraw this consent at any time by sending us an e-mail to email@example.com but such a withdrawal may mean that we cannot answer your request or take your CV into account.
It can also be in compliance with regulations such as tax, labour, or prevention of occupational hazards.
Our legitimate interest as an organisation also constitutes a legal basis for processing your data:
· To conduct opinion and/or satisfaction surveys.
· To inform you about our activities, products and/or services (including by means of electronic communications). If we already have a prior contractual relationship, we will forward such communications on the basis of our legitimate interest. Otherwise, we will only send you such communications if you give us your consent by ticking the option that is expressly included for this purpose in the relevant forms. In any case, the electronic communications we send you will include, in the communication itself, the option to stop receiving them in the future.
· In accordance with GDPR recital 48, to communicate your data to other companies in the group in order to provide the customer with a comprehensive or specialised service requiring the intervention of interdisciplinary teams; or for internal administrative purposes including the processing of personal data of customers or employees
We inform you that the data you provide may be communicated to third parties for the fulfilment of purposes directly related to legitimate functions of transferor and transferee such as:
· To banks for the management of collections and payments
· To entities or bodies to which there is a legal obligation to communicate data (Tax administration…)
· To insurance companies for the management and insurance of commercial risks
· To client companies to which ISATI deploys workers
· To any of the companies that make up the business group (currently, ISATI SWITZERLAND GMBH and ISATI ENGINEERING SOLUTIONS, S.L.): for internal administrative purposes, including the processing of personal data of customers, suppliers or staff
We may also make international transfers of data if they are necessary for: the execution of a contract between the data subject and the data controller; or between the data controller and a third party in the interest of the data subject, as may be the case when we communicate data on our employees to customers to whom we transfer employees.
In the event that we use U.S. suppliers, who may have access to personal data, for the purpose of providing services ancillary to our business (hosting, housing, software as a service, remote backup, support services or computer maintenance, email managers, sending e-mails and e-mail marketing, file transfer etc…), these companies may be different and vary over time but we will always choose companies that have adhered to the Privacy Shield agreement between the USA and the EU, or belong to countries that have been declared to be countries with an adequate level of protection, which means that they are obliged to comply with requirements equivalent to the European data protection requirements. In any case, by accepting this data protection policy you expressly and unequivocally authorise the communication of the data to said companies, knowing that this implies an international transfer of data to a country outside the European Economic Area and giving your unequivocal consent to this transfer.
Right of access: You can ask us what personal data we are processing and request a copy of it.
Right of correction: You can ask us to correct inaccurate personal data or to complete data that is incomplete, including by making an additional declaration.
Right of suppression (right to forget): You can ask us to delete your personal data when: it is not necessary for the purposes for which it was collected, you withdraw your consent, there has been an unlawful processing of the data or for compliance with a legal obligation.
Right to limitation of processing: You can ask us to limit the processing of your data, in which case we will only keep it for the exercise or defence of claims.
Right of opposition: You may object to the processing of your data if such processing is based on the legitimate interest of the data controller or is for advertising purposes.
Once we have received any of the above requests, we will respond within the legally established deadlines. You can complain to the Spanish Data Protection Agency. If you would like more information about the rights you can exercise, and to request copies of the forms for exercising your rights, you can visit the website of the Spanish Data Protection Agency at www.aepd.es
The categories of data we process are: personal data, professional data, economic/financial data, transactions of goods and services.