Data controller

ZAYER, S.A.

Postal address: C/Portal de Bergara 7 01013 Vitoria-Gasteiz (Álava)

E-mail: lopd@zayer.es Tel. 945 26 28 00

How we got your data

Information obtained from the data subject: If you are a current or potential customer, or a mere user of our website, you have provided the data, either offline or online, when requesting our services in order to maintain the contractual relationship with you, or when contacting us to request information, or, for example, if you have visited our offices or plant, you have provided them to us when accessing our facilities. Likewise, your data may have been communicated to us by our sales network after your data were provided to one of our sales representatives. The categories of data we process are: identification details; postal or electronic addresses; commercial information and economic data. We do not process specially protected data.

When you provide us with your personal details, you guarantee that you are entitled to provide this information and that the information is accurate, truthful, exact and up-to-date, that it is not confidential, that it does not breach any contractual restriction or rights of third parties, and you undertake to not impersonate other Users.

Information obtained automatically when you visit our website: If you have given us your data through this website, we collect information, for example, when you access the site, register as a user, fill in any form with personal details, or communicate with us directly by email.

When you visit our website, data are sent to our server from your browser in order to optimise our services and improve your user experience, for example when you access the page or log in to our services through third-party services such as social networks or Google. Such data may be collected and stored automatically by us or by third parties on our behalf. These data may include:

• The user's IP address
• The date and time of the visit
• The URL of the site the user comes from
• The pages visited at our website
• Information about the browser used (browser type and version, operating system, etc.)

We may process and record such uses, sessions and related information, either independently or with the help of third party services, including through the use of cookies and other tracking technologies such as flash cookies and web analytics.

Our website has connectors to social networks; when you choose to interact with us through a social network, we cannot be responsible for the privacy settings chosen by the user, and the social network may report your IP address or which page you are visiting on our website, and may install a cookie in order to work correctly, or, for example, your name will appear in the "likes" or in the comments on our social media account when interacting with the site. If you do not want your personal data to be associated with these "likes" or comments, you should configure your privacy settings to avoid this by using pseudonyms for your data, e.g. by entering a nickname or alias that does not reveal your name and surname.

If you log in to one of these social networks during your visit to our website, the social network will be able to add this information to your profile and transfer it to the social network. You can prevent this data transfer by logging out of the social network before entering our website or mobile app, as we do not have any control over this data collection and transfer through the social connectors.

If the user decides to post and/or share texts, photos, videos and any other type of information and/or content on one of our official social media accounts, this user shall be solely liable for ensuring such content complies with all applicable legislation. With regard to other people's data, remember that you must respect their privacy by taking special care when communicating or publishing their personal data. Only the data subject can authorise the processing of personal data. The user may only use this page or our official social media accounts to post personal details, photographs and information or other content he or she owns or has been authorised to use by the relevant third party. Whenever you provide or post third-party data, you are responsible for ensuring you have express consent to use, communicate and publish these data, and for informing the third party that we are to process or you are to publish them. Publishing data of third parties without their consent may breach their right to honour, privacy or image, in addition to the rules on data protection.

In any case, we may remove any content posted on this website or on our social media accounts whenever when we detect that the user has breached current legislation, as indicated in this privacy policy.

Social networks are not hosted directly in our services. Your interactions with them are governed by their policies, not ours. Read the privacy policies of these social networks for detailed information on the collection and transfer of personal data, your rights, and also your privacy settings.

Communication of the data subject's data by a third party: Whenever the data subject's data are provided by a third party, your data may have been communicated to us by our sales network or distributors after they were given to one of our sales representatives.

Third-party data

You must respect the privacy of other people's data, taking special care when it comes to publishing such information. Please remember that, as a user, you can only provide and consent to the processing of your own personal data and not those of third parties, and that providing any data of third parties implies making a transfer of personal data, in which case you shall be liable, firstly, for ensuring you have express consent from these third parties to use their data and to provide them to us, and, secondly, for informing the third parties that their data are to be included on our files.

Publishing the data of third parties without their consent may breach their right to honour, privacy or image, in addition to the rules on data protection, in accordance with the provisions of Act 1/1982 of 5th May on civil protection of the right to honour, personal and family privacy, and image.

Purpose

The data can be processed for different purposes, for example:

1. If you are a current or potential customer, in order to maintain contact and communication with you, and to manage the contractual and/or commercial relationship, including after-sales services and warranty.
2. If you are merely a user of our website or the sender or recipient of an e-mail, to maintain contact and communication with you and to manage any requests you may make online.
3. If you give us a copy of your CV or send us your professional details, to contact you and to manage any recruitment processes we may carry out.
4. In the case of visitor access to our facilities, to manage access and control visits.
5. During the visit to our facilities, you will be able to record and publish audio and images (photos and/or videos) with any audiovisual equipment to report on the visit, document it and become part of the organization’s photographic and videographic memory.
6. To carry out opinion and/or satisfaction surveys and to send you electronic communications with information about activities, products and/or services of ours that are similar to those requested (including advertising and/or commercial communications for the purposes of art. 21 Information Society Services Act 34/2002). If we already have an existing contractual relationship, we will send such communications on the basis of our legitimate interest. If there is no existing contractual relationship, we will only send you this type of communications if you authorise us to do so by opting in on the relevant forms. All electronic communications we send you will include an opt-out option as part of the communication. If you choose to opt out, we will stop sending you this type of communication in the future.
7. Specific information about legitimate interest as the legal basis for recording images during visits to our facilities. This legitimate interest is understood by the interested party (given that this information is relayed when the visit is confirmed and when the visitors reach the facilities). The participant can expect us to record and publish images to document the visit graphically, and always within a businesslike and professional environment. Our procedure for recording and publishing images complies with personal data protection regulations and minimizes the data that require processing. We have conducted a weight of evidence analysis on this legitimate interest, which may be requested by the interested party and the latter may always express their approval or rejection of recording and publishing their images Given the above, we consider that recording images during these activities or events is proportional and poses a minimal impact on privacy. However, your interests, rights and freedoms will always prevail over our legitimate interest. Therefore, if you do not want us to process your data for these purposes, please state so at the event or activity or send us an e-mail stating your wish to lopd@zayer.es, and we will study your request.

Retention period

The personal data you give us will be retained up until the time you ask for them to be deleted. If ask for your data to be deleted, we may nevertheless keep them for the time necessary, always limiting their processing, solely for the purpose of complying with all applicable legal/contractual obligations in force and/or during the legal periods envisaged for the limitation of any liability on our part and/or the exercise or defence of claims arising from the relationship with the data subject.

Legitimation

The legal basis that legitimatises us to process your data can come from a range of sources:

• Firstly, the legal relationship between us if you are a current client/supplier, or the pre-contractual relationship of any kind between the parties if you are a potential client/supplier (for example, if you have asked us for information, an offer or a quote, etc.). Providing the requested data is compulsory, as this is essential to formalise and/or maintain the contractual or pre-contractual relationship and meet the legal obligations derived from it; if you do not provide them, we will not be able to offer the service that would result from this relationship.
• Secondly, your consent if you have made a request through our website as a user, or if you have sent us your C.V. or are a visitor to our facilities. Whenever you provide us with your data, either online or offline, you unequivocally grant us this consent, since providing data is considered a clear affirmative action that manifests such consent. You may withdraw this consent at any time by sending an e-mail to lopd@zayer.es, although any such withdrawal may mean that we cannot answer your request, use your C.V. or give you access to our facilities.
• Thirdly, compliance with legislation on money laundering, tax laws or the criminal code with regards to the setting up of a channel for reporting, in accordance with art. 31-b of this code.

Our legitimate interest as an organisation also provides the legal basis for processing your data to:

Carry out opinion and/or satisfaction surveys

Inform you of our activities, products and/or services (including through electronic communications). If we have an existing contractual relationship, we will send such communications on the basis of our legitimate interest. If there is no existing contractual relationship, we will only send you this type of communications if you authorise us to do so by opting in using the relevant forms. In any case, all electronic communications we send you will include an opt-out option as part of the communication.

Recipients

You are hereby informed that the data you provide may be communicated to third parties for purposes directly related to the legitimate functions of the assignor and the assignee, such as:

1. The transport companies in charge of shipping logistics and delivering our products.
2. Banks, for managing collections and payments.
3. Any organisations or bodies that must be informed for legal reasons (Tax Authority, etc.).
4. Insurance companies, for managing and insuring commercial risks.
5. In the case of ZAYER job applicants who have submitted their C.V., their details may be communicated to companies providing temporary recruitment services to hire the candidate during the trial period.
6. We will duly report all queries sent via our website that must be dealt with by our subsidiaries in other countries, or by agents or distributors in our commercial network. If this involves an international transfer of data to a country outside the European Economic Area, the data subject gives unequivocal consent to such transfer by providing his or her data.

INTERNATIONAL TRANSFERS

Whenever we use American providers who may have access to personal data in order to provide services auxiliary to our activity (hosting, housing, software as a service, remote backup, computer support or maintenance services, e-mail managers, send e-mails and marketing e-mails, file transfers etc.), these companies may be different and vary over time, although, in all cases, we will only choose companies that have signed up to the Privacy Shield agreement between the USA and the EU, or that belong to countries that have been declared countries with a high level of protection, meaning they are obliged to meet EU-standard requirements in terms of data protection. By accepting this data protection policy, you expressly and unequivocally authorise the communication of data to these companies, and understand that this involves an international transfer of data to a country outside the European Economic Area, to which you give your unequivocal consent.

Rights

You can, when appropriate, exercise your rights of access, rectification, deletion, limitation and opposition to processing, as well as to not be the subject of decisions based solely on the automated processing of your data, at the postal or e-mail address indicated at the beginning of this privacy policy; in both cases by sending a written, signed request, enclosing a copy of your ID card, passport or other valid identification document. Any changes to your data must be reported to the same address, with the company declining all liability in the event of failure to do so.

• Right of access: You can ask us which personal data we are processing and also ask us for a copy of it.
• Right of rectification: You may ask us to rectify inaccurate or incomplete personal data, which can also be done by way of an additional declaration.
• Right of erasure (right to be forgotten): You can ask us to delete your personal data when: they are not necessary for the purposes they were collected for, you withdraw your consent, they have been processed illicitly, or deletion is required due to a legal obligation.
• Right to the limitation of processing: You may request a restriction on the processing of your data, in which case we will store them solely in order to process or defend against any claims.
• Right to object: You may object to the processing of your data whenever such processing is based on the legitimate interest of the data controller or is for advertising purposes.

Once we have received any of the above requests, we will respond to you within the legal deadlines. You may issue a complaint to the Spanish Data Protection Agency. Visit the Spanish Data Protection Agency's website at www.aepd.es for more information about the rights you can exercise and to request the relevant forms.

Data category

The categories of data we process are: identification data; professional data; economic, financial data; transactions of goods and services.