PRIVACY POLICY - SERVICE PROVIDERS

1. DATA CONTROLLER:

GRUPO ANTOLÍN IRAUSA, S.A., domiciled in Burgos, at Carretera Madrid-Irún, Km. 244,8 (SPAIN), registered at Burgos Commercial Registry in volume 182, book 102 of Companies Section 3, sheet 133, page 1960, with employer identification number A09092305 (“Antolín” or the “Company”) is the controller of the personal data that are processed through the Antolín service provider management tool. This clause provides information on the use that the Company will make of your personal data and your rights under the General Data Protection Regulation (“GDPR”). Should you have any doubts regarding the processing of your data, please write to Grupo Antolín Irausa, S.A. at (Ctra. Madrid-Irún Km. 244,8 09007 Burgos) or via the Company’s website, at: https://www.antolin.com/en/contact-us?contact=privacy. Should you wish to use the whistle-blowing channel made available by Antolín, you may do so by accessing the following link: https://extranet.grupoAntolin.com/Web/GA.CanalTransparencia.Web.

2. PURPOSES OF THE PROCESSING, LEGAL GROUNDS AND DATA DISCLOSURES:

In the following table you can consult the purposes of the processing of your data, the legal grounds that entitle the Company to process your data for those purposes, the possible disclosure of your data to third parties and the existence of potential international data transfers. You will receive information on the storage periods of your data on the Company’s systems, notwithstanding the obligations to block data set forth in applicable legislation. You may request a list of recipients of your data by writing to https://www.antolin.com/en/contact-us?contact=privacy, indicating the specific recipients in relation to which you require information.

Purpose of the processing	Legal ground	Recipients	International transfers	Storage period
Management of your data as a contact in a service provider of Antolín, for the maintenance of the relationship with said service provider.	Legitimate interest of Antolín: Compliance, maintenance and control of the relationship that the company for which you work, a service provider of Antolín, has established with Antolín	Your data may be disclosed to companies in the Antolín Group (the “Group”), on the same legal ground of the legitimate interest of Antolín, for the purpose of carrying out the harmonized and centralized monitoring of the service providers with which the Group has a commercial relationship. The categories of service providers of Antolín that may have access to your data as data processors, given the services they provide to the Group, are: • Technology services and systems maintenance companies of Antolín.	Your data may be transferred to Group companies, for the purposes indicated in the “Recipients” column in relation to Group companies, and to technology services and systems maintenance companies of Antolín located outside of the European Union (“EU”). If you would like to know where these companies are located, please write to the following address https://www.antolin.com/en/contact-us?contact=privacy and you will be provided with an updated list. These transfers shall be carried out on the basis of the signature by these companies located outside the EU of standard data protection clauses adopted by the European Commission for international transfers, pursuant to article 46.2 GDPR. Should you require a copy of these contractual clauses please write to Antolín at: https://www.antolin.com/en/contact-us?contact=privacy.	Your data will be processed by the Company for the duration of the contractual relationship between the service provider and Antolín, notwithstanding the possible blocking of the data imposed by applicable legislation.
Sending of communications with a view to inviting you to events, sending you news relating to Antolín and the sector.	Legitimate interest of Antolín: Maintenance of the commercial relationship with your company.	Your personal data shall not be disclosed on the basis of this processing. The categories of service providers of Antolín that may have access to your data as data processors, given the services they provide to the Group, are: • Technology services and systems maintenance companies of Antolín.	Your data may be transferred to technology services and systems maintenance companies of Antolín located outside the European Union. If you would like to know where these companies are located, please write to the following address https://www.antolin.com/en/contact-us?contact=privacy and you will be provided with an updated list. These transfers shall be carried out on the basis of the signature by these companies located outside the EU of standard data protection clauses adopted by the European Commission for international transfers, pursuant to article 46.2 GDPR. Should you require a copy of these contractual clauses please write to Antolín at: https://www.antolin.com/en/contact-us?contact=privacy.	Your data will be processed by the Company for the duration of the contractual relationship between the service provider and Antolín. From this date onwards, your data may be used to send you these communications for a period of three years from your last interaction with Antolín (where interaction is understood to refer to the opening of an email, for example), notwithstanding the possible blocking of the data imposed by applicable legislation.

Purpose of the processing

Legal ground

Recipients

International transfers

Storage period

Management of your data as a contact in a service provider of Antolín, for the maintenance of the relationship with said service provider.

Legitimate interest of Antolín: Compliance, maintenance and control of the relationship that the company for which you work, a service provider of Antolín, has established with Antolín

Your data may be disclosed to companies in the Antolín Group (the “Group”), on the same legal ground of the legitimate interest of Antolín, for the purpose of carrying out the harmonized and centralized monitoring of the service providers with which the Group has a commercial relationship.

The categories of service providers of Antolín that may have access to your data as data processors, given the services they provide to the Group, are:

• Technology services and systems maintenance companies of Antolín.

Your data may be transferred to Group companies, for the purposes indicated in the “Recipients” column in relation to Group companies, and to technology services and systems maintenance companies of Antolín located outside of the European Union (“EU”). If you would like to know where these companies are located, please write to the following address https://www.antolin.com/en/contact-us?contact=privacy and you will be provided with an updated list.

These transfers shall be carried out on the basis of the signature by these companies located outside the EU of standard data protection clauses adopted by the European Commission for international transfers, pursuant to article 46.2 GDPR. Should you require a copy of these contractual clauses please write to Antolín at: https://www.antolin.com/en/contact-us?contact=privacy.

Your data will be processed by the Company for the duration of the contractual relationship between the service provider and Antolín, notwithstanding the possible blocking of the data imposed by applicable legislation.

Sending of communications with a view to inviting you to events, sending you news relating to Antolín and the sector.

Legitimate interest of Antolín: Maintenance of the commercial relationship with your company.

Your personal data shall not be disclosed on the basis of this processing.

The categories of service providers of Antolín that may have access to your data as data processors, given the services they provide to the Group, are:

• Technology services and systems maintenance companies of Antolín.

Your data may be transferred to technology services and systems maintenance companies of Antolín located outside the European Union. If you would like to know where these companies are located, please write to the following address https://www.antolin.com/en/contact-us?contact=privacy and you will be provided with an updated list.

Your data will be processed by the Company for the duration of the contractual relationship between the service provider and Antolín. From this date onwards, your data may be used to send you these communications for a period of three years from your last interaction with Antolín (where interaction is understood to refer to the opening of an email, for example), notwithstanding the possible blocking of the data imposed by applicable legislation.

Necessary, up-to-date information

Completion of all the fields marked with an asterisk (*) in the forms you may be given is compulsory. Failure to complete any of these fields could lead to your being denied access to the functionalities of this tool.

In order to ensure that the information provided is constantly up to date and does not contain errors, you should inform Antolín as soon as possible of any amendments to or changes in your personal data.

By clicking on the “Access” button (or similar) on such forms, the User states that the information and data provided are accurate and true.

3. DATA SUBJECTS’ RIGHTS:

You may exercise the following rights:
(i)   right of access to your personal data to know which data are being processed and the processing operations that are being performed with that data;
(ii)   right to rectification of any inaccurate data;
(iii)   right to erasure of the personal data, where possible;
(iv)   right to request the restriction of the processing of your personal data where the accuracy, legality or need to process the data is doubtful and in the other cases envisaged in the GDPR;
(v)   right to object, at any time, for reasons related to your specific situation. The Company shall stop processing your data unless it has a compelling legitimate interest for the processing, or for the establishment, exercise or defense of legal claims.

In order to exercise these rights, you should send a written request by letter to Grupo Antolín Irausa, S.A. (Ctra. Madrid-Irún Km. 244,8 09007 Burgos) or via the Company’s website: https://www.antolin.com/en/contact-us?contact=privacy. You must sign the request, include your full name and address, and indicate which rights you wish to exercise.

You may also lodge a complaint with the AEPD if you consider that data protection legislation has been breached in the processing of your personal data.

4. CONFIDENTIALITY AND SECURITY

The Company shall make all reasonable efforts to maintain the confidentiality of the personal information in question through this tool. Antolín has implemented and maintains strict levels of security in order to protect the personal data it processes from accidental loss and unauthorized access, processing or disclosure, having regard to the state of the art, the nature of the stored data and the risks to which they are exposed. This notwithstanding, the transmission of information via the Internet is not totally secure; accordingly, and despite the fact that the Company shall make its best efforts to protect your personal data, it cannot guarantee the security of such data during transit to the tool or systems of Antolín. All information provided by you shall be sent at your own risk. Once your personal data have been received, the Company shall use rigorous security functions and procedures to prevent any unauthorized access.

5. REGISTRATION OF USER NAME AND PASSWORD

The Company also informs you that by registering on this tool, you will be assigned a user name and password to enable you to sign in, at any time, as a “Registered User” and access the functionalities of the tool. You may change the password, although in this case you may not choose expressions or combinations of words and symbols that are rude, offensive, coincide with brands, trade names, store signs, corporate names, advertising slogans, names or pseudonyms of public figures or celebrities the use of which is not authorized and, in general, any that are contrary to the law or to good morals and generally accepted standards of decency.

It is essential that you ensure the confidentiality of your password at all times. You (or, failing that, your employer) will be the sole party responsible for the use of your account, authorized or otherwise, and, in this connection, you undertake to make diligent use of such information, not to make it available to third parties, and to notify its loss or theft.

6. THIRD-PARTY SITES

The tool may include links to sites controlled by third parties. You should remember that by accessing third-party websites using the tool, this privacy policy will no longer apply, since it does not reflect the privacy practices of third-party websites. The Company rejects any liability with respect to the privacy and processing of data by such third parties. Browsing and interaction on any other website, including those linked to this tool, is subject to the rules and policies of said website. Antolín recommends that Users read the data processing and privacy policies of the third-party websites.