1. INFORMATION TO THE USER

Who is responsible for processing your personal data?GRUPO EMPRESARIAL SANDO, S.A. and its subsidiaries are responsible for processing the personal data of the USER and inform you that these data will be processed in accordance with the provisions of Regulation (EU) 2016/679, of April 27 (GDPR), and Organic Law 3/2018, of December 5 (LOPDGDD). Why do we process your personal data and for what purpose? Depending on the form from which we have obtained your personal data, we will process them confidentially to achieve the following purposes: Contact Form:

• To respond to inquiries or any type of request made by the user through any of the contact methods made available on the website of the responsible party (for the legitimate interest of the responsible party, art. 6.1.f GDPR) and to conduct statistical analysis and market studies (for the legitimate interest of the responsible party, art. 6.1.f GDPR).

Curriculum Form:

• To involve the interested party in recruitment processes and analyze the applicant’s profile with the aim of selecting a candidate for the vacant position (with the consent of the interested party, 6.1.a GDPR).

Whistleblower Channel Form:

• To properly manage the ethical channel, processing the corresponding irregularities reported through it, and deciding whether to initiate an investigation to detect possible crimes and prevent the imposition of any type of responsibility, as well as to prevent any behavior contrary to the internal or external regulations of the entity (to comply with a legal obligation, 6.1.c GDPR).

Supplier Portal Form:

• To manage the provision of requested services (as necessary for the execution of the contract that involves such services, art. 6.1.b GDPR) and to send communications about products or services (with the consent of the interested party, art. 6.1.a GDPR).

FichSANDO Form:

• To carry out the hourly registration of the working day of employees through a geolocation system, verifying only the start and end times of their activity. Legal basis for processing: compliance with a legal obligation of the data controller (art. 6.1.c GDPR), in this case, art. 10 of RDL 8/2019 of March 8, on urgent measures for social protection and the fight against job insecurity in the working day, which adds section 9 to article 34 of the Workers’ Statute. Processing methods: through the GPS of the employee’s mobile device. Data retention criteria: they will be kept for four years and will be available to employees, their legal representatives, and the Labor and Social Security Inspectorate.

How long will we keep your personal data? They will be kept no longer than necessary to maintain the purpose of the processing or as long as there are legal prescriptions that dictate their custody, and when no longer necessary, they will be deleted with appropriate security measures to ensure the anonymization of the data or the total destruction of the same. To whom do we provide your personal data? No communication of personal data to third parties is foreseen unless necessary for the development and execution of the purposes of the processing, to our service providers related to communications, with whom the RESPONSIBLE has signed the confidentiality and data processing agreements required by current privacy regulations. What are your rights? The USER’s rights are:

• Right to withdraw consent at any time.
• The right to access, rectify, transfer, and delete your data, and to limit or oppose its processing.
• The right to file a complaint with the supervisory authority (www.aepd.es) if you consider that the processing does not comply with current regulations.

Contact details for exercising your rights:GRUPO EMPRESARIAL SANDO, S.A. Avda. Ortega y Gasset, 112, – 29006 Málaga (Málaga). E-mail: rgpd-sando@sando.com Contact details of the Data Protection Officer: pmedina@ml-asociados.es

2. MANDATORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED BY THE USER

Users, by checking the corresponding boxes and entering data in the fields marked with an asterisk (*) on the contact form or presented in download forms, expressly and freely and unequivocally accept that their data are necessary to meet their request by the provider, being voluntary the inclusion of data in the remaining fields. The USER guarantees that the personal data provided to the RESPONSIBLE are true and is responsible for communicating any changes to them.
The RESPONSIBLE informs that all the data requested through the website are mandatory, as they are necessary for the optimal provision of service to the USER. If not all the data are provided, it is not guaranteed that the information and services provided will be completely tailored to their needs.

3. SECURITY MEASURES

In accordance with the provisions of current regulations on personal data protection, the RESPONSIBLE is complying with all the provisions of the GDPR and LOPDGDD regulations for the processing of personal data for which they are responsible, and expressly with the principles described in Article 5 of the GDPR, by which they are processed lawfully, fairly, and transparently in relation to the data subject and are adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
The RESPONSIBLE guarantees that they have implemented appropriate technical and organizational policies to apply the security measures established by the GDPR and the LOPDGDD in order to protect the rights and freedoms of the USERS and has communicated the appropriate information so that they can exercise them. For more information on privacy guarantees, you can contact the RESPONSIBLE through GRUPO EMPRESARIAL SANDO, S.A. Avda. Ortega y Gasset, 112, – 29006 Málaga (Málaga). E-mail: rgpd-sando@sando.com Contact details of the Data Protection Officer: pmedina@ml-asociados.es