POLICY PRIVACY

Compliance with the principle of limitation of the retention period of personal data Fulfillment of the requirements of Regulation (EU) 2016/679 and Organic Law 3/2018. Administrative management of private customers Carrying out the sale or provision of the contracted service – A commercial or user profile may be created, based on the information provided or obtained. It is expressly stated that under no circumstances will profiles be created with the data of a minor. – The personal data provided by you will be kept for the duration of the contractual relationship or until you exercise your right of opposition or withdraw the consent granted. For this, you can contact the corresponding section on our website or send an email to the address indicated in the section regarding the controller.

Why do we use them? We are authorized to process your personal data for the following reasons: – Your explicit, informed, and express consent, where legally required. The withdrawal of this consent does not affect in any case the execution of other treatments whose legitimization is different, and does not affect the lawfulness of the treatment prior to the withdrawal of it. – A legal obligation of the data controller. – The performance of the contract for the provision of services and/or the sale of the corresponding products, signed by you. – The legal basis for the processing of your data is a legitimate interest of the controller. This interest is based on a previous assessment of the proportionality or balancing between the legitimate interest of the controller and the interests or rights and freedoms of the data subjects. This assessment has involved the evaluation of the interest, the evaluation of the impact of the processing on the data subjects, the balance between the two concepts mentioned above, and the implementation of additional guarantees. Since the final balancing is in favor of the controller, the processing can be carried out in accordance with the applicable data protection regulations. For any questions or clarifications, you can contact us by email, which is provided in the section regarding the controller.

With whom can we share your personal data? – Your personal data will be communicated to the following companies and organizations: Tax Agency Public Employment Service General Treasury of Social Security National Data Protection Agency Banks and savings banks – Your personal data will not be transferred to any third country or international organization.

What data do we process and how did we obtain it? – Your personal data will be included in the following files, owned by the organization: FG01 Own accounting management FG02 Own labor management FG15 Own tax management. Data collection FE01 Computer maintenance FE02 Occupational safety FE03 Transport and shipment FE04 Own legal matters FR01 Received information requests FR03 Own staff selection FR04 Advertising campaigns FR05 Emails FR07 Incident and/or security violation management FR08 Obtain the opinion of interested parties FR09 Security measures in software and hardware FE07 Document destruction FE08 Data protection FP01 Customers – The personal data that we process in our organization come from the following sources: The interested party himself

What rights can you exercise? – We guarantee you the right to exercise the rights that correspond to you in relation to the processing of your personal data. In particular, we inform you that you have the right to: · Obtain confirmation as to whether your data are being processed. · Exercise the right of access to the personal data concerning you, obtaining information about the purposes of the processing, the category of data processed, possible recipients, the retention period, the origin of the data, and, where appropriate, the creation of profiles or automated decision-making. · Exercise the right to rectification. To this end, we remind you that the personal data we have must always be a faithful reflection of reality, so do not hesitate to exercise your right in case any data undergoes modification, change, or cancellation. You guarantee that the personal data you have provided to us by any means are true and accurate, and undertake to notify us of any changes or modifications to them, being solely responsible for any loss or damage caused to the controller or any third party by reason of a communication of erroneous, inaccurate, or incomplete information. · For reasons related to your particular situation, you may object to the processing of your data, in which case our organization will cease processing the data, unless there are legitimate reasons that prevent it. · Request the deletion of your personal data when, among other reasons, they are no longer necessary for the purposes described above or we no longer have the legitimacy to process them. · Exercise the right to data portability when the processing is carried out by automated means and you are linked to our entity based on a signed contract or have given consent to the processing carried out. In these cases, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, or to have them transmitted directly to another controller, where technically feasible. · Under certain circumstances, you may request the restriction of the processing of your data, in which case we will only retain the data for the exercise or defense of claims. · Object to automated decision-making, including profiling. These rights may be exercised free of charge, except in cases provided for by law, by written request signed by you or, where appropriate, by your representative, addressed to the controller, at the addresses provided for this purpose in the first section, or physically at any of our establishments. – You also have the right to lodge complaints, either with the Spanish Data Protection Agency (on the website https://www.agpd.es/) or with the competent supervisory authority. – Likewise, you may go to the courts to claim compensation. – Finally, you have the right to withdraw your consent with the same ease with which you granted it. To do this, you can go to our website, where you will find the necessary information to quickly and easily revoke the authorization granted to us to make these communications. You can also send an email to the address indicated in the section regarding the controller. – Furthermore, we inform you that in each processing of your personal data, the possible threats and impacts that may arise from them are determined, mitigating or eliminating potential damages through the application of the corresponding security measures, which are periodically reviewed to determine their effectiveness. Our control system also allows us to comply with the principles of the processing of your data, being able to demonstrate to the data subject the principle of limitation to the purpose of the processing, the principle of limitation to the retention period, the principle of data minimization, as well as the principle of integrity and confidentiality. Finally, we also inform you that you will periodically receive surveys that will allow us to know your opinion on any suggestions regarding the processing of your personal data, in order to comply with the principle of transparency and accuracy of the processed data. For any questions or clarifications, you can contact us by email, which is provided in the first section. Sincerely,

The Controller