Privacy policy and data protection

BASIC INFORMATION ON THE PRIVACY POLICY OF ALVINESA NATURAL INGREDIENTS S.A.U.:

In compliance with the General Data Protection Regulation, we inform you:

1. Responsible Entity. Who will handle your data?

ALVINESA NATURAL INGREDIENTS S.A.U.

2. Data Protection Officer

You can contact us regarding data protection regulations and to exercise the corresponding rights at dpo@alvinesa.com.

3. Purpose. What will your data be used for?

3.1. If you access our facilities, to ensure security through video surveillance.

3.2. If you exercise a data protection right: To manage the obligations of attending to the exercise of data protection rights.

3.3. If you are notified of a security breach: To manage and evaluate the security breaches that occur.

3.4. If you send your CV to participate in selection processes: To manage job candidates through selection processes.

3.5. If you have a business or administrative relationship with us: If you are involved in a contract as a freelancer or an individual, to manage the service you have contracted. If you are a representative or contact person of a legal entity, the purpose is to maintain contact with the entity you represent or work for.

3.6. If you are an individual or a contact person of a legal entity or an individual entrepreneur, to manage commercial and marketing actions.

4. Retention Periods or Criteria. How long will we keep your data?

4.1. If you visit or access our centers and we record your image: The data is deleted one month from its capture unless related to criminal or administrative offenses, an ongoing police investigation, or an open judicial or administrative procedure.

4.2. If you exercise a data protection right: They will be kept for three years from the termination of the right’s attention. Statute of limitations for very serious offenses (Draft Organic Law on Data Protection, Article 72).

4.3. If you are notified of a security breach: They will be kept for three years from the termination of the right’s attention. Statute of limitations for very serious offenses (Draft Organic Law on Data Protection, Article 72).

4.4. If you send your CV to participate in selection processes: For the necessary time to fulfill the purpose for which they were collected and to determine possible responsibilities and attend to future claims that may arise against the entity. If we keep your data for subsequent selection processes, as long as you do not request their deletion.

4.5. If you have a business or administrative relationship with us: If you are involved in a contract and are a freelancer or an individual, the data will be kept for the necessary time to fulfill the purpose for which they were collected and to determine possible responsibilities and attend to future claims that may arise against the entity. If you are a representative or contact person of a legal entity, while you maintain your representation or professional position or unless you request their deletion.

4.6. If you are a contact person of a legal entity or an individual entrepreneur and the legal entity or your company is a recipient of our commercial offers, we will keep them until you exercise your right to object.

5. Legal Basis. Why are we authorized to process your personal data?

5.1. If you visit or access our offices and we record your image: Our authorization to process the data is based on our legitimate interest provided in Article 9.2.f) of the General Data Protection Regulation (EU) 2016/679) to carry out image processing through cameras or video cameras to preserve the security of people, property, and facilities, as this interest does not override your interests or fundamental rights and freedoms.

5.2. If you exercise a data protection right: Because the processing is necessary for compliance with a legal obligation applicable to the data controller (Article 6.1.c) of the General Data Protection Regulation (EU) 2016/679).

5.3. If you are notified of a security breach: Because the processing is necessary for compliance with a legal obligation applicable to the data controller (Article 6.1.c) of the General Data Protection Regulation (EU) 2016/679).

5.4. If you send your CV to participate in selection processes: Because the processing is necessary for the application of pre-contractual measures (Article 6.1.b) of the General Data Protection Regulation (EU) 2016/679).

5.5. If you have a business or administrative relationship with us: If you are involved in a contract and are a freelancer or an individual, the purpose of the processing is to maintain and develop the contractual relationship. We are authorized because Article 9.2.c) of the General Data Protection Regulation (EU) 2016/679) allows us to do so as it is necessary for the execution of a contract or for the application of pre-contractual measures at the request of the data subject. If you are involved in a contract as a representative of a legal entity or are a contact person of said legal entity, we are authorized to process your data because the processing is necessary for the satisfaction of legitimate interests pursued by the data controller or by a third party (Article 6.1.f) of the General Data Protection Regulation (EU) 2016/679).

5.6. If you are a contact person of a legal entity or an individual entrepreneur and the legal entity or your company is a recipient of our commercial offers, because the processing is necessary for the satisfaction of legitimate interests pursued by the data controller or by a third party, provided that these interests are not overridden by the interests or fundamental rights and freedoms of the data subject that require the protection of personal data (Article 6.1.f) of the General Data Protection Regulation (EU) 2016/679).

6. Obligation to Provide Your Data. Why are you required or not required to provide your data?

6.1. If you have a business or administrative relationship with us as a client or supplier and must sign a contract: You are required to provide your data because it is necessary to carry out the contract, therefore, the refusal to provide them prevents us from signing the contract.

7. To whom will your data be communicated or transferred?

7.1. If you access our company’s facilities, to the State Security Forces and Corps in case of an incident.

7.2. If you exercise a data protection right: The data may be communicated to the Spanish Data Protection Agency. Compliance with a legal obligation applicable to the data controller (Article 6.1.c) of the General Data Protection Regulation (EU) 2016/679).

7.3. If you are notified of a security breach: The data is communicated to the Spanish Data Protection Agency. Compliance with a legal obligation applicable to the data controller (Article 6.1.c) of the General Data Protection Regulation (EU) 2016/679). They may also be communicated to the State Security Forces and Corps.

7.4. If you send your CV to participate in selection processes: The data will not be transferred to third parties nor will we make any international transfer of data to third countries or international organizations.

7.5. If you have a business or administrative relationship with us: If you are involved in a contract and are a freelancer or an individual, the data will be sent to banks and savings banks for payment and collection of invoices and expenses to comply with contractual obligations. They will also be submitted to the Tax Agency in the filed tax declaration forms: Law 58/2003, of December 17, General Tax Law. If you are involved in a contract as a representative of a legal entity or are a contact person of said legal entity, we will not communicate the data to third parties unless we have a legal obligation. We will not make any international transfer of data to third countries or international organizations.

7.6. If you are a contact person of a legal entity or an individual entrepreneur and the legal entity or your company is a recipient of our commercial offers: The data will not be transferred to third parties nor will we make any international transfer of data to third countries or international organizations.

7.7. If you are interested in our products, the data will be communicated to third parties for sending advertising communications related to the services we offer or that you have contracted, as long as you give us your consent at the time of registration.

8. What are your rights when you provide us with your data and how can you exercise them?

8.1. Right of access: The right to obtain confirmation about whether ALVINESA NATURAL INGREDIENTS S.A.U. is processing personal data that concerns you or not.

8.2. Right of rectification: The right to request the modification or rectification of your data if they are inaccurate.

8.3. Right of erasure: The right to request the deletion or erasure of your data due to unlawful data processing, the disappearance of the purpose that motivated the processing or collection, or when you revoke your consent or object to their processing.

8.4. Right to restrict processing: If you contest the accuracy of the data while we verify such accuracy or if you have exercised your right to object to data processing while we verify whether the legitimate grounds of the controller override your rights.

8.5. Right to data preservation: If the processing is unlawful and you object to the deletion of the data requesting the limitation of its use; if the data is needed for the formulation, exercise, or defense of claims.

8.6. Right to data portability: In a structured, commonly used, and machine-readable format, as long as it is technically feasible for its portability and when they have been used/processed with your consent or because a contract exists. You can exercise these rights before the Data Protection Officer whose contact details we have incorporated in the section regarding this figure.

Additionally, you have the right to:

• Revoke the consent given: If the processing is based on consent, you have the right to revoke it.
• File a complaint: You can always contact the Data Protection Officer, and you also have the right to file a complaint with the Spanish Data Protection Agency.