Privacy policy and data protection

 

PRIVACY POLICY OF THE ALVINESA GROUP

In compliance with the General Data Protection Regulation (GDPR), we inform you:

1. Data Controller – Who will process your data?

The data will be processed for the purposes detailed in this policy under the responsibility of:

• ALVINESA NATURAL INGREDIENTS S.A.U., with registered office at Ctra. Valdepeñas Km. 4,850, 13250 Daimiel – Ciudad Real, and CIF A30423073.
• ALVINESA LOGISTICA S.L., with registered office at Ctra. Valdepeñas Km. 4,850, 13250 Daimiel – Ciudad Real, and CIF B86378882.
• GENOSA ID S.L., with registered office at C. Iván Pavlov, 8, edif.1 bajo g, Campanillas, 29590 Málaga, and CIF B92284512.
• CADES PENEDÉS S.A., with registered office at Camí Can Batlle S/N, 08793 Avinyonet del Penedés – Barcelona, and CIF B08297509.

 

2. Data Protection Officer

You can contact the Data Protection Officer (DPO) for matters related to data protection regulations for the corporate group, as well as to exercise the corresponding rights, at dpo@alvinesa.com, indicating in the subject line the specific Data Controller within the group you are addressing.

3. Purpose – How will your data be used?

3.1. If you access the facilities of our group’s entities: To ensure security through video surveillance.

3.2. If you exercise a data protection right: To manage the obligations related to the exercise of data protection rights.

3.3. If you are notified of a security breach: To manage and assess security breaches.

3.4. If you submit your CV for selection processes: To manage job candidates in selection processes.

3.5. If you have a business or administrative relationship with us:

• If you are a party to a contract as a self-employed individual or private person, for the management of the service you have contracted.
• If you are a representative or contact person of a legal entity, to maintain contact with the entity you represent or work for.

3.6. If you are a private individual, contact person for a legal entity, or a sole proprietor: To manage commercial and marketing activities.

4. Retention Period – How long will we keep your data?

4.1. If you visit our facilities and we record your image: Data will be deleted within one month unless related to legal infractions, ongoing investigations, or judicial/administrative proceedings.

4.2. If you exercise a data protection right: Data will be retained for three years from the resolution of the request.

4.3. If you are notified of a security breach: Data will be retained for three years from the resolution of the case.

4.4. If you submit your CV for selection processes: Data will be retained for as long as necessary for selection purposes unless you request its deletion.

4.5. If you have a business or administrative relationship with us:

• If you are a private individual or self-employed, data will be retained for as long as necessary to fulfill contractual obligations and manage claims.
• If you are a representative or contact person of a legal entity, data will be retained while your role is active or until you request its deletion.

4.6. If you are a contact person for a legal entity or sole proprietor receiving our commercial offers: Data will be retained until you exercise your right to object.

5. Legal Basis – Why are we authorized to process your personal data?

5.1. If you visit our offices and we record your image: Processing is based on our legitimate interest in ensuring security (Article 9.2.f) GDPR).

5.2. If you exercise a data protection right: Processing is necessary to comply with a legal obligation (Article 6.1.c) GDPR).

5.3. If you are notified of a security breach: Processing is necessary to comply with a legal obligation (Article 6.1.c) GDPR).

5.4. If you submit your CV for selection processes: Processing is necessary for pre-contractual measures (Article 6.1.b) GDPR).

5.5. If you have a business or administrative relationship with us:

• If you are a self-employed individual or private person, processing is necessary for contractual execution (Article 9.2.c) GDPR).
• If you are a representative or contact person of a legal entity, processing is based on legitimate interest (Article 6.1.f) GDPR).

5.6. If you are a contact person for a legal entity or sole proprietor receiving our commercial offers: Processing is based on legitimate interest (Article 6.1.f) GDPR).

6. Obligation to Provide Data – Do you have to provide your data?

6.1. If you are a client or supplier and must sign a contract: You must provide your data, as it is necessary for contractual purposes. Refusal to do so prevents contract signing.

7. Data Recipients – Who will receive or have access to your data?

7.1. If you access our facilities: Data may be disclosed to law enforcement in case of incidents.

7.2. If you exercise a data protection right: Data may be disclosed to the Spanish Data Protection Agency (AEPD).

7.3. If you are notified of a security breach: Data will be disclosed to the AEPD and law enforcement authorities.

7.4. If you submit your CV for selection processes: Data may be shared with group companies for recruitment purposes (Recital 48 GDPR).

7.5. If you have a business or administrative relationship with us:

• If you are a self-employed individual or private person, data may be shared with banks for payment processing and with tax authorities as required by law.
• If you are a representative or contact person of a legal entity, data will not be shared with third parties unless legally required.
• No international data transfers will be made.

7.6. If you are a contact person for a legal entity or sole proprietor receiving our commercial offers: Data will not be shared with third parties, nor will international transfers be made.

7.7. If you are interested in our products: Data may be shared with third parties for advertising communications, provided you consent during registration.

8. Your Rights – What are your rights, and how can you exercise them?

8.1. Right of Access: Right to obtain confirmation about whether we are processing your personal data.

8.2. Right to Rectification: Right to request correction of inaccurate data.

8.3. Right to Erasure: Right to request deletion of data when no longer necessary, unlawfully processed, or if you withdraw consent.

8.4. Right to Restriction of Processing: Right to request processing restriction if data accuracy is contested or while evaluating an objection request.

8.5. Right to Data Retention: Right to request data retention if processing is unlawful but deletion is opposed or if data is needed for legal claims.

8.6. Right to Data Portability: Right to receive data in a structured format and transfer it to another controller where technically feasible.

You can exercise these rights by contacting the Data Protection Officer at the email provided above.

Additionally, you have the right:

• To withdraw consent if processing is based on consent.
• To file a complaint with the Spanish Data Protection Agency.