CONTACT PERSON PRIVACY POLICY

This privacy policy applies solely to Grupo Antolín contact persons at current and/or potential clients, providers and investors of Grupo Antolín, media outlets and public agencies.

1. DATA CONTROLLER:

The company indicated in the first layer of information included in the email received by you (hereinafter, “Antolín” or the “Company”) is the controller of the personal data processed for the purposes of answering your messages, maintaining and/or promoting the relationship established between your employer (or you, if you are a self-employed worker) and Antolín, and maintaining the existing institutional contact between the two parties. This clause provides information on the use that the Company will make of your personal data and your rights under the General Data Protection Regulation (“GDPR”). Should you have any doubts regarding the processing of your data, please write to Grupo Antolín Irausa, S.A. at (Ctra. Madrid-Irún Km. 244,8 09007 Burgos) or via the Company’s website, at: https://www.antolin.com/en/contact-us?contact=privacy. Should you wish to use the whistle-blowing channel made available to you by Antolín, you may do so by accessing the following link: https://extranet.grupoantolin.com/Web/GA.CanalTransparencia.Web.

2. PURPOSES OF THE PROCESSING, LEGAL GROUNDS AND DATA DISCLOSURES:

In the following table you can consult the purposes of the processing of your data, the legal grounds that entitle the Company to process your data for those purposes, the possible disclosure of your data to third parties and the existence of potential international data transfers. You will receive information on the storage periods of your data on the Company’s systems, notwithstanding the obligations to block data set forth in applicable legislation. You may request a list of recipients of your data by writing to https://www.antolin.com/en/contact-us?contact=privacy, indicating the specific processing in relation to which you require information.

Purpose of the processing	Legal ground	Recipients	International transfers	Storage period
Management of your data as contact person at a current or potential client, provider or investor of Antolín, or at a media outlet or public agency, for answering your messages and/or maintenance of the relationship established between your employer (or you, if you are a self-employed worker) and Antolín.	Legitimate interest of Antolín: Compliance, maintenance and control of the relationship that the company for which you work (or you, if you are a self-employed worker) has established with Antolín.	The categories of service providers of Antolín that may have access to your data as data processors, given the services they provide to the Antolín Group (the “Group”), are: • Technology services and systems maintenance companies of Antolín. Only if you are a contact person at a client or service provider, your data may be disclosed to Group companies, on the same legal ground of the legitimate interest of Antolín, for the purpose of carrying out the harmonized and centralized monitoring of the service providers and clients with which the Group has a commercial relationship.	Your data may be transferred to technology services and systems maintenance companies of Antolín and, only if you are a contact person at a client or service provider, to Group companies for the purposes indicated in the “Recipients” column in relation to Group companies, located outside the European Union (“EU”). If you would like to know where these companies are located, please write to the following address https://www.antolin.com/en/contact-us?contact=privacy and you will be provided with an updated list. These transfers shall be carried out on the basis of the signature by these companies located outside the EU of standard data protection clauses adopted by the European Commission for international transfers, pursuant to article 46.2 GDPR. Should you require a copy of these contractual clauses please write to Antolín at: https://www.antolin.com/en/contact-us?contact=privacy.	Your data will be processed by the Company for the duration of the contractual and/or institutional relationship between your employer (or you, if you are a self-employed worker) and Antolín, notwithstanding the possible obligation to block the data imposed by applicable legislation. If you are a freelance journalist or employee of a media outlet, or employee in a potential client, provider or investor of Antolín, your data will be processed by the Company for a period of three years following your last interaction with Antolín (where interaction is understood to refer to the opening of an email from Antolín, for example), notwithstanding the possible blocking of the data imposed by applicable legislation.
Sending of communications with a view to inviting you to events, sending you news relating to Antolín and the sector, based on your request or the contractual relationship between your employer (or you, if you are a self-employed worker) and Antolín.	Legitimate interest of Antolín: To maintain the commercial and/or institutional relationship with your employer (or you, if you are a self-employed worker).	Your personal data will not be disclosed on the basis of this processing. The categories of service providers of Antolín that may have access to your data as data processors, given the services they provide to the Group, are: • Technology services and systems maintenance companies of Antolín.	Your data may be transferred to technology services and systems maintenance companies of Antolín located outside the European Union. If you would like to know where these companies are located, please write to the following address https://www.antolin.com/en/contact-us?contact=privacy and you will be provided with an updated list. These transfers shall be carried out on the basis of the signature by these companies located outside the EU of standard data protection clauses adopted by the European Commission for international transfers, pursuant to article 46.2 GDPR. Should you require a copy of these contractual clauses please write to Antolín at: https://www.antolin.com/en/contact-us?contact=privacy.	If you are a contact person at a potential client or service provider of Antolín or at a public agency, your data will be processed by the Company for a period of three years following your last interaction with Antolín (where interaction is understood to refer to the opening of an email, for example), notwithstanding the possible blocking of the data imposed by applicable legislation. If you are a contact person at a current client or service provider of Antolín, your data will be processed by the Company for the duration of the contractual relationship between the client or service provider and Antolín. From this date onwards, your data may be used to send you this information for a period of three years from your last interaction with Antolín (where interaction is understood to refer to the opening of an email, for example), notwithstanding the possible blocking of the data imposed by applicable legislation.

Purpose of the processing

Legal ground

Recipients

International transfers

Storage period

Management of your data as contact person at a current or potential client, provider or investor of Antolín, or at a media outlet or public agency, for answering your messages and/or maintenance of the relationship established between your employer (or you, if you are a self-employed worker) and Antolín.

Legitimate interest of Antolín: Compliance, maintenance and control of the relationship that the company for which you work (or you, if you are a self-employed worker) has established with Antolín.

The categories of service providers of Antolín that may have access to your data as data processors, given the services they provide to the Antolín Group (the “Group”), are:

• Technology services and systems maintenance companies of Antolín.

Only if you are a contact person at a client or service provider, your data may be disclosed to Group companies, on the same legal ground of the legitimate interest of Antolín, for the purpose of carrying out the harmonized and centralized monitoring of the service providers and clients with which the Group has a commercial relationship.

Your data may be transferred to technology services and systems maintenance companies of Antolín and, only if you are a contact person at a client or service provider, to Group companies for the purposes indicated in the “Recipients” column in relation to Group companies, located outside the European Union (“EU”). If you would like to know where these companies are located, please write to the following address https://www.antolin.com/en/contact-us?contact=privacy and you will be provided with an updated list.

These transfers shall be carried out on the basis of the signature by these companies located outside the EU of standard data protection clauses adopted by the European Commission for international transfers, pursuant to article 46.2 GDPR. Should you require a copy of these contractual clauses please write to Antolín at: https://www.antolin.com/en/contact-us?contact=privacy.

Your data will be processed by the Company for the duration of the contractual and/or institutional relationship between your employer (or you, if you are a self-employed worker) and Antolín, notwithstanding the possible obligation to block the data imposed by applicable legislation.

If you are a freelance journalist or employee of a media outlet, or employee in a potential client, provider or investor of Antolín, your data will be processed by the Company for a period of three years following your last interaction with Antolín (where interaction is understood to refer to the opening of an email from Antolín, for example), notwithstanding the possible blocking of the data imposed by applicable legislation.

Sending of communications with a view to inviting you to events, sending you news relating to Antolín and the sector, based on your request or the contractual relationship between your employer (or you, if you are a self-employed worker) and Antolín.

Legitimate interest of Antolín: To maintain the commercial and/or institutional relationship with your employer (or you, if you are a self-employed worker).

Your personal data will not be disclosed on the basis of this processing.

The categories of service providers of Antolín that may have access to your data as data processors, given the services they provide to the Group, are:

• Technology services and systems maintenance companies of Antolín.

Your data may be transferred to technology services and systems maintenance companies of Antolín located outside the European Union. If you would like to know where these companies are located, please write to the following address https://www.antolin.com/en/contact-us?contact=privacy and you will be provided with an updated list.

If you are a contact person at a potential client or service provider of Antolín or at a public agency, your data will be processed by the Company for a period of three years following your last interaction with Antolín (where interaction is understood to refer to the opening of an email, for example), notwithstanding the possible blocking of the data imposed by applicable legislation.

If you are a contact person at a current client or service provider of Antolín, your data will be processed by the Company for the duration of the contractual relationship between the client or service provider and Antolín. From this date onwards, your data may be used to send you this information for a period of three years from your last interaction with Antolín (where interaction is understood to refer to the opening of an email, for example), notwithstanding the possible blocking of the data imposed by applicable legislation.

Updated information

Completion of all the fields marked with an asterisk (*) in the form is compulsory. Failure to complete any of these fields could lead to your being denied access to the functionalities of this form. By clicking on the “Access” button (or similar) on such form, you state that the information and data provided are accurate and true.

In order to ensure that your personal data are constantly up to date and do not contain errors, you should notify Antolín as soon as possible of any amendments or changes to your personal data.

3. DATA SUBJECTS’ RIGHTS:

You may exercise the following rights:
(i)   right of access to your personal data to know which data are being processed and the processing operations that are being performed with that data;
(ii)   right to rectification of any inaccurate data;
(iii)   right to erasure of the personal data, where possible;
(iv)   right to request the restriction of the processing of your personal data where the accuracy, legality or need to process the data is doubtful and in the other cases envisaged in the GDPR;
(v)   right to object, at any time, on grounds relating to your particular situation. The Company shall stop processing your data unless it has a compelling legitimate interest or for the establishment, exercise or defense of legal claims.

In order to exercise these rights please write to Grupo Antolín Irausa, S.A. at (Ctra. Madrid-Irún Km. 244,8 09007 Burgos) or via the Company’s website, at: https://www.antolin.com/en/contact-us?contact=privacy. You must sign the request, include your full name and address, and indicate which rights you wish to exercise.

You may also lodge a complaint with the AEPD if you consider that data protection legislation has been breached in the processing of your personal data.