Privacy Policy

1. Introduction

In all the organizations that make up CIDETEC (you can see the list at https://cidetec.es/en/about-us) we are committed to protecting the privacy and proper use of the personal data we process and that you provide to us, both online on this website (and, where applicable, any of its subdomains or microsites) and offline.

Please read this policy carefully and ensure that you understand and agree with it before providing us with your personal data. If you do not agree with it, do not use this website or its services, nor provide us with your data. The fact of accessing this site, using any of its services or providing us with your data, whether online or offline, will be understood as a clear affirmative action by which you give us your consent (where necessary) to process your data for the purposes indicated below.

As also indicated in the Legal Notice of this website, this privacy policy applies equally to any of the organizations that make up The Entity indicated above.

2. Who is responsible for processing your data?

Company responsible for processing: FUNDACION CIDETEC

Postal address: PASEO DE MIRAMON 196, CP 20014, Donostia-San Sebastián, (Guipúzcoa/Gipuzkoa)

Email: rgpd@cidetec.es

Telephone: +34 943 30 90 22

To ensure proper management in the processing of your data, CIDETEC has appointed a Data Protection Officer. For any matter related to personal data protection, you can contact us via the email address: dpo@cidetec.es.

3. How have we obtained your data?

• Obtained from the interested party themselves: If you are already one of our industrial partners or companies from different productive sectors with which we collaborate, you provided them to us, whether offline or online, when requesting our services or contacting us to ask for information.
  
  If you sent us a CV to work with us, you provided it to us, whether offline or online, when requesting to join our staff in order to maintain contact and communication with you, manage your CV or, where applicable, maintain the contractual relationship with you.
  
  By providing us with your data, you guarantee that you are authorized to do so, and that the information is true, up to date, and does not infringe any contractual restriction or third-party rights. You are responsible for keeping your data and profile correct and updated, Fundación Cidetec disclaiming all liability if you fail to do so.
• Obtained automatically when visiting our website: when you visit our website or social network profiles, we collect information through cookies and other tracking and web analytics technologies. This means that data is sent from your browser to our servers to optimize our services and improve your user experience. This data may be collected and stored automatically by us or by third parties on our behalf. You can consult our Cookie Policy.
  
  The categories of data that may be included are: user IP address, date and time of the visit, URL of the site from which the user comes, pages visited on our website, information about the browser used (browser type and version, operating system, etc.).
• Communication of third-party data by the interested party: regarding data of other people, you must respect their privacy, taking special care when communicating or publishing their personal data. Only their owner can authorize the processing of their personal data. The publication of third-party data without their consent may infringe, in addition to data protection regulations, those relating to the right to honor, privacy, or self-image of such third parties.
  
  If you provide us with third-party data, it is your responsibility to have their prior and express consent to use it, and it is your duty to inform them of the processing we are going to carry out with their data. By accepting this privacy policy, you expressly guarantee that you have authorization for said contribution, exonerating us from any liability in the event of any claim by an interested party.

4. What categories of data do we process?

The categories of data we process are:

• Identification data: first and last name, Tax ID (NIF), contact details (telephone, postal address, email address, billing address), commercial and economic data (information on requested services, history of companies and industrial partners, and those necessary for payment: bank, account number...) as well as all those necessary to provide you with the service requested in each case.
• Browsing data: user IP address, date and time of the visit, URL of the site from which the user comes, pages visited on our website, information about the browser used (browser type and version, operating system, etc.).

5. For what purposes do we process your data and what is our legal basis for doing so?

The data you provide to us, as well as any other generated during the development of the contractual, pre-contractual, commercial or other relationship we maintain with you, may be processed for different purposes, for example:

6. How long will we keep your data?

The personal data provided will be kept while the contractual, pre-contractual or commercial relationship is maintained and, once ended, as long as the interested person does not request its deletion. Even if deletion is requested, we may keep it for the necessary time and limiting its processing solely to:

• Complying with the legal/contractual obligations to which we are subject,
• and/or during the legal terms foreseen for the prescription of any liability on our part,
• and/or the exercise or defense of claims derived from the relationship maintained with the interested person.

In the case of complaints made through the whistleblowing channel: the data of the person making the communication and of the employees or third parties appearing in the complaint will be kept in the whistleblowing system solely for the time essential to decide on the advisability of initiating an investigation into the reported facts. In any case, three months after the entry of the data, it will be deleted from the whistleblowing system, unless the purpose of retention is to leave evidence of the operation of the crime prevention model by the legal entity. Complaints that have not been acted upon may only be kept in anonymized form. After said 3-month period, the data may continue to be processed by the corresponding body, in accordance with section 2 of article 24 LOPDGDD, for the investigation of the reported facts, not being kept in the internal whistleblowing information system itself.

In coordination with the above criteria, the deletion of personal data, whether in computer records or on paper, may be carried out, at the organization's discretion, based on logistical and/or storage space needs that make it advisable to delete information or documentation.

7. To which recipients may we communicate your data?

To our Industrial Partners or Companies from different productive sectors, mentioned above, for internal administrative and management purposes.

1. To third entities related to legitimate functions of the transferor and assignees, such as: To Public Administration bodies to which there is a legal obligation to communicate data: to the Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offences to report suspicious operations, Tax Administration, Social Security bodies, Labor Inspectorate...
2. To banking entities for the management of collections and payments.
3. To Notaries, Registries, Mutual Insurance Companies, Courts or Tribunals, Registries, Court Attorneys...
4. To insurance companies, and experts.
5. To the mutual company and external prevention service: in compliance with obligations regarding occupational health surveillance and risk prevention at work.

8. International data transfers

We will endeavor to ensure that personal data is always processed and located within the European Economic Area. However, in certain circumstances, we may make international data transfers, for example, where necessary for the conclusion or execution of a contract, in the interest of the data subject or where necessary for the execution of a contract between the data subject and Fundación Cidetec with which the client has contracted, for example when using service providers located outside the European Union, which may have access to personal data, for the provision of auxiliary services to our activity (hosting, housing, SaaS, remote backups, IT support or maintenance services, email managers, sending emails and email marketing, file transfer, etc.) or for the execution of pre-contractual measures adopted at the request of the interested party.

These entities may be different and vary over time, but we will endeavor to choose entities either belonging to countries that have a level of protection equivalent to the European one in terms of data protection, or that have appropriate guarantees to achieve that level, or they will be carried out on the basis of any of the exceptions provided for this purpose in the GDPR.

9. What are your rights when you provide us with your data?

You can, when applicable, exercise your rights of access, rectification, deletion, limitation and opposition to their processing, as well as other rights, at the postal or email address indicated at the beginning of this privacy policy; in both cases by written and signed request attaching a copy of the DNI or passport or other valid document that identifies you. In case of modification of your data, you must notify it at the same address, this entity disclaiming all liability in case of failure to do so.

Right of access: You can ask us what personal data we are processing and even request a copy of it.

Right of rectification: You can ask us to rectify inaccurate personal data or complete incomplete data, including by means of an additional statement.

Right of deletion (right to be forgotten): You can ask us to delete your personal data when: it is no longer necessary for the purposes for which it was collected, you withdraw your consent, there has been unlawful processing thereof, or to comply with a legal obligation.

Right to limitation of processing: You can ask us to limit the processing of your data, in which case we will only keep it for the exercise or defense of claims.

Right to object: You can object to the processing of your data if said processing is based on the legitimate interest of the data controller or is for advertising purposes.

Right to portability: You can receive your personal data, in a structured, commonly used and machine-readable format, to transmit it to another data controller provided that the processing is carried out by automated means and when processing is based on consent or a contract.

Once any of the above requests is received, we will respond to you within the legally established deadlines. You can lodge a complaint with the Spanish Data Protection Agency. If you want more information about the rights you can exercise and to request form templates for exercising rights, you can visit the website of the Spanish Data Protection Agency, www.aepd.es.