Privacy Policy

Privacy Policy

1. Purpose
This Privacy Policy aims to inform people (hereinafter, users or interested parties) who visit our website (hereinafter, website, web page or the web), how we collect, process and protect the personal data that you decide to provide us by any means (forms, emails, telephone, contracts, etc.) and after reading it, you freely decide whether you want us to process them. Additionally, it will serve to expand the information that we have previously provided to interested parties, in the information clauses provided in the processes of collecting their personal data.

Furthermore, this policy aims to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and the free circulation of these data (hereinafter RGPD) and Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPDGDD).

2. Who is responsible for the processing of your personal data?

Identity – Entity: DTA THE SMART MOVE, S.A.
CIF/NIF: A28290856
Postal address: C/ Alcorcón, 11, 28850 Torrejón de Ardoz (Madrid)
Telephone: 91 30 76 063
Email: monica.fernandez@dta.es
Corporate purpose: Machinery manufacturing
Website: https://www.dta.es/
Registration details: Registered in the Madrid Mercantile Registry; Volume 12300, Folio 134, Section 8, Page 195067

3. What personal data will we process and how do we obtain it?
For the development of our business activity, it is essential to process personal data whose collection can be carried out by digital means, through paper documents or as a result of face-to-face or telephone conversations and in any of these cases the data will be treated in a fair, lawful and transparent manner.

The categories of data that our entity will process about the interested parties are:
• Identification data: name and surname, ID or equivalent document, image and signature.
• Contact data: telephone, email, postal address.
• Commercial data: budgets, purchase conditions, management and history of services and/or purchases, result of contacts (telephone, email, messaging and other communication channels).
• Accounting data: control of income and expenses, billing data.
• Banking data: bank accounts and cards.
• Transaction of goods and services: transfers and direct debits, amounts and concepts.
• Curricular data: academic data, professional experience, personal characteristics, etc.

Our entity will not collect special category data (e.g. health data, ethnic origin, political opinions or religious beliefs), but in the event that it is necessary to process them, it will inform you and request your prior and express consent.

Consequently, the data requested will be adequate, pertinent, limited to what is strictly essential and necessary, processed only by the personnel and/or collaborators authorized by our entity, who will have signed a confidentiality agreement and undertake to comply with the necessary security regulations that guarantee the confidentiality, integrity and availability of the data processed and other legally established requirements in the GDPR. Therefore, they will be processed within the law.

The data to be processed are provided by the interested party or by their legal representative, although there may be cases in which we delegate some functions to certain collaborators and they are in charge of collecting their data, but they will always be processed with their prior and express consent.

In the event that an interested party does not provide the data that we request or incomplete or incorrect data is provided, it will not be possible to comply with and maintain the relationship with them.

The categories of data that we can process about a person will depend on the relationship that they maintain with our entity, as shown below:

3.1. Customers:
Identification, contact, commercial, accounting, banking, goods and services transaction data will be processed, and may only be collected if the customer provides them to us at the time of purchasing goods or contracting services, whether in person, by telephone, email or through the forms available on our website.

3.2. Information requesters:
Whether the information requested is in person, by telephone or in writing (e.g. email or web forms), we will request and/or process identification, contact and commercial data.

3.3. Suppliers:
Identification, contact, commercial, accounting, banking, goods and services transaction and financial data will be processed. These data may be processed during all stages of the business relationship and only if the supplier

3.4. Job applicants:
For this category of interested parties, we will process curricular, identification, contact and other data related to their professional or personal characteristics, which will be provided by the applicant themselves when sending us their application by any means (e.g. in person, email, web forms). They can also be collected in staff selection interviews (in person or online). We may even receive the job application through a collaborator to whom we have delegated certain functions.

3.5. Claimants:
We will process identification, contact and personal information of their own or of third parties that the claimant sends us.

3.6. Complainants:
Using our internal complaints channel, complaints can be made anonymously, but you can also voluntarily provide us with identification and contact data, as well as other personal information of your own or of third parties related to the complaint, as provided for in Law 2/2023, of February 20, on the protection of persons who report regulatory violations and the fight against corruption.

3.7. Visitors:
Identification data, contact data, and the company for which you work if the visit is for commercial reasons will be processed, and these will be collected when provided by the visitor themselves when requesting access to our facilities or when their interlocutor in our entity provides them to allow them access to these.

3.8. Web users:
Our entity does not use cookies to collect information from users. Only our own session cookies are used for technical purposes (those that allow the user to navigate through the website and use the different options and services that exist on it).

Our entity may modify, without prior notice, the information contained on its website, as well as its configuration and presentation, so we recommend that you consult our Cookies Policy every time you visit our website

3.9. More information for interested parties:
The information legally established in the corresponding information clauses, included in the different means of data collection, will be made available to interested parties, so that the interested party can freely and expressly decide whether they want their personal data to be processed by our entity.

All categories and types of personal data processed will be duly identified in the corresponding processing activities owned by our entity.

4. What will your data be processed for?
In general, the processing of personal data carried out by our entity is intended to comply with and maintain the relationship with the different groups of people with whom we have contact.

Depending on said relationship, the processing of your data obeys different purposes and which, by way of example and not limitation, are detailed below:

4.1. Customers:
Your personal data will be processed to identify you, to comply with and maintain the pre-contractual and contractual relationship, including the sending of commercial communications by different means, to answer queries, to carry out quality controls and commercial statistics, for the sale and delivery of goods, for the provision of our services, for accounting and billing management, the transaction of goods and services, the management of collections, management of incidents, claims and exercise of rights, as well as for other purposes to which we are obliged to comply with said relationship, the laws to which we are subject or to attend to our legitimate interests.

4.2. Information requesters:
We will process your personal data to attend to requests for information of any kind that you wish to send us, to identify you, to send or deliver quotes and information on the goods and/or services of interest to you, including in our response (verbal or written) the commercial information related to your request. We will also make follow-up contacts, by different means, to find out about the decisions taken regarding the commercial proposals that we have sent you.

4.3. Job applicants:
Your data will be processed to include you in our selection processes and job bank, to identify you, as well as to contact you and inform you about vacancies, coordination of interviews and other matters related to your candidacy.

4.4. Suppliers:
Your personal data will be processed for the purpose of maintaining the pre-contractual and contractual relationship, fulfilling the commercial relationship either for the request for quotes, for the purchase of goods or contracting of services, to make inquiries and identify you, for the management of accounts

ble and the transaction of goods and services, as well as for other purposes necessary to comply with said relationship, with our legal obligations and legitimate interests.

4.5. Complainants:
The personal data will be processed to identify you, manage your complaint and contact you about the status of it, in addition to complying with our legal obligations and legitimate interests.

4.6. Complainants:
The personal data that you decide to provide us in your complaint will be processed to register, manage your complaint, as well as to identify you and contact you (except if the complaint is anonymous) to acknowledge receipt of your complaint and to keep you informed about the status of our investigations within the timeframes and terms established in Law 2/2023, of February 20. Likewise, we may process your data based on our legitimate interests and whenever it is necessary to comply with other legal obligations to which we are subject.

4.7. Visitors:
The data from visits to our facilities will be processed to identify you, to comply with our obligations regarding the prevention of occupational risks and for security and access control reasons.

4.8. Web users:
Our entity does not use cookies to collect information from users. Only our own session cookies are used for technical purposes (those that allow the user to navigate through the website and use the different options and services that exist therein).

Our entity may modify, without prior notice, the information contained on its website, as well as its configuration and presentation, so we recommend that you consult our Cookies Policy every time you visit our website.

4.9. More information for interested parties:
The information legally established in the corresponding information clauses included in the different means of data collection (e.g. forms, speeches, contracts, etc.) will be made available to interested parties so that you can freely and expressly decide whether you want the requested personal data to be processed by our entity. In this same sense, said information will be recalled in the different documents or communications that we share with interested parties (e.g. badges, invoices, legal notices, etc.).

If the interested party does not provide the data we request or incomplete or erroneous data is provided, we may not be able to respond to their request for information or interact with them.

The data will not be processed further or for purposes other than those accepted by the interested parties.

The purposes that motivate the processing of personal data will be duly identified in the corresponding processing activities owned by our entity.

5. Why do we process your data (legitimacy)? The processing of your personal data by our entity is carried out with one or more of the following legitimate bases:

a. When you give us your express, free, informed and unequivocal consent, after being informed at the time of collecting your data and more extensively with this privacy policy, that after reading it and agreeing, you can voluntarily authorize us to process your data for one or more purposes, by checking the boxes provided for this purpose in our web forms, by your verbal consent (a voice recording will be required) or by signing the information clauses that we provide you at any time when requesting your personal data.

b. For the execution of a contract in which you are a party or have requested pre-contractual measures from us.

c. When the processing is necessary for compliance with a legal obligation applicable to our entity.

a. When the processing is necessary for the satisfaction of legitimate interests pursued by our entity or by a third party, provided that the interests or fundamental rights and freedoms of the interested party do not prevail over said interests. In this regard, we inform you that our entity has carried out an analysis weighing our legitimate interests with the rights and freedoms of the interested party, always respecting their fundamental rights.

In the event that the user is under 14 years of age, it will be necessary to have the consent of the parents, guardians or legal representative to process their data. The user is solely responsible for the veracity of the data that they send us.

6. Data retention
The personal data provided will be kept as long as we maintain the relationship with the interested party and for the time necessary to fulfill the purpose for which their data have been collected.

Once said relationship has ended, we will keep them blocked in those cases in which it is necessary to keep them until the prescription of and responsibilities for the exclusive purposes of claims or legal actions, as well as to comply with our legal obligations, for example:

Interested parties Sector scope Legal basis Conservation period
• Clients
• Suppliers Accounting Art. 30.1 R.D. Commercial Code • 6 years from the last entry
• Clients
• Suppliers Tax Art. 66 General Tax Law 58/2003 • General term: 4 years
• In case of losses during the year: 10 years
• Invoices: 5 years
• Workers Labor Art. 21 of Royal Legislative Decree 5/2000 – Social Order • 4 years:
• Job seekers Labor AEPD labor relations guide • 1 year
• Workers Prevention of occupational risks Art. 4.3 of Royal Decree 5/2000 – Social Order • 5 years
• Visitors Access control to facilities AEPD Instruction 1/1996 • 1 month
• Web users Use of cookies AEPD guide on the use of cookies • 24 months maximum
• Information seekers Commercial
Legal Art. 20.1 a and d) Spanish Constitution • The shortest time possible or as indicated in the laws.
• Clients
• Suppliers
• Visitors
• Job applicants
• Workers Video surveillance Art. 22.3 LOPDGDD – protection of personal data • 1 month
• Complainants
• Affected parties Complaints from the Internal Complaints Channel • Art. 26.2 Law 2/2023 (internal information systems)

• Art. 32.3 Law 2/2023 (internal information systems)

Art. 32.4 Law 2/2023 (internal information systems) • In the event that the reported facts have been investigated, the retention period will not exceed 10 years.

• For the time necessary to decide whether to initiate an investigation into the reported facts. If it is proven that the information provided or part of it is not true, it must be immediately deleted, unless such lack of truthfulness may constitute a criminal offence, in which case the information will be kept for the time necessary for the judicial procedure to be processed.

• If after 3 months from receipt of the complaint the investigation has not been initiated, it must be deleted.

7. Profiling
We do not create profiles nor will automated decisions be made using your personal data, but if we do, you will be informed and will be asked for prior authorisation to do so.

Likewise, you have the right to object to this type of processing at any time by writing to our entity at monica.fernandez@dta.es

8. Transfer of data
As a general rule, our entity does not transfer personal data to third parties without prior consent, however, it will be necessary to transfer data in the following cases:

In the case of our clients or suppliers, your personal data may be transferred to third parties due to legal obligation (e.g. Tax Agency), or in those cases and entities necessary to provide our services or pay invoices (e.g. Banking entities) or in the case of delivery of goods, your data may be transferred to transport companies collaborating with our entity.

Likewise, the personal data of clients or suppliers may be processed by third parties to whom we delegate some of our obligations (e.g. accounting advisors) and all of them have committed themselves through a data processing manager contract to comply with the same security measures implemented by our entity, as well as to submit to the duty of secrecy and confidentiality regarding the personal data processed, among other obligations regarding personal data protection.

In the case of job applicants, their data will not be transferred to third parties, unless we are legally obliged to do so.

Regarding information applicants or users of our website, their data will not be transferred to third parties, except in the cases set out above and informed at each moment of its collection and only with their express consent, unless our legitimate interest prevails or we are legally obliged to do so, in which case their consent will not be necessary.

In the case of whistleblowers, their data may be lawfully processed by persons other than those responsible for the internal information system, and may also be communicated to third parties when necessary for the adoption of corrective measures in our entity or the processing of sanctioning or criminal procedures that may be appropriate (art. 32.2 Law 2/2023).

In general terms, we may transfer your personal data to Judges, Courts, Public Prosecutor's Office and/or competent Public Administrations in the event of possible claims when we are obliged to do so.

9. International transfer of data
In the event of transfers to third-party entities located in countries outside the European Economic Area, we will inform and request the prior and express consent of the interested parties.

10. Security Measures
Our entity has implemented all the technical and organizational measures necessary to protect the personal data processed, avoiding its loss, theft or unauthorized use.

These measures have been created based on the type of data processed and the purposes that motivate said processing. These are periodically verified in our internal controls of compliance with the personal data protection regulations and through external audits.

11. Your Rights
You, as the owner of your personal data and acting on your own behalf or through your legal representative (e.g. persons under 14 years of age) can contact our entity at any time and ask us to exercise your rights in terms of personal data protection.

We explain what these rights are:

11.1. Right of Access:
You have the right to know and ask us at any time to know the following information:
• Whether or not we are processing your personal data.
• The purposes of the processing, as well as the categories of personal data being processed.
• The origin of your data, in the event that you did not provide it to us.
• The recipients or categories of recipients to whom my personal data has been communicated, or will be communicated, including, where appropriate, recipients in third parties or international organisations.
• Information on the appropriate guarantees relating to the transfer of my data to a third country or an international organisation, where appropriate.
• The expected retention period, or if this is not possible, the criteria for determining this period.
• If automated decisions exist, including profiling, significant information on the logic applied, as well as the importance and expected consequences of such processing.
• A copy of your personal data that is being processed.

11.2. Right to Rectification:
You may request that we rectify your personal data when it is inaccurate, as well as complete it when it is incomplete.

11.3. Right to Objection:
You may object to us processing your data when it is incorrect or its processing is no longer necessary.

In the event that you act as a defendant or person affected by a complaint under Law 2/2023, you will not be able to exercise your right to object, since it is presumed (upon proof to the contrary) that there are reasons that legitimize the processing of your personal data, in accordance with the provisions of article 31.4 of the Law.

11.4. Right to Deletion:
Request that your data be deleted, for any of these reasons:
• Your data is no longer necessary for the purposes for which it was collected or processed.
• You have not given consent for the processing of your data.
• When you have exercised the right to object.
• When the data has been processed unlawfully.
• When the data must be deleted to comply with a legal obligation.

11.5. Right to Restriction of Processing:
You may ask us to exercise this right when one or more of these situations occur:
• When you contest the accuracy of your data, for a period that allows the controller to verify the accuracy of the data.
• When the processing is unlawful and you oppose the deletion of your data and request instead the limitation of its use.
• When the data is no longer needed for the purposes of the processing, but the interested party needs it for the formulation, exercise or defence of claims.
• When you have opposed the processing under Article 21, paragraph 1, while verifying whether the legitimate reasons of the controller prevail over those of the interested party.

11.6. Right to Portability:
This refers to the right to obtain data relating to you, in a structured, commonly used and machine-readable format, as well as to transmit it to another controller for further processing.

11.7. Right not to be subject to automated decisions:
Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or significantly affects you in a similar way.

To exercise any of your rights, you must write to DTA THE SMART MOVE, S.A., either by post to the address: C/ Alcorcón, 11, 28850 Torrejón de Ardoz (Madrid) or by email: monica.fernandez@dta.es stating the rights you wish to exercise, accompanied by a copy of your ID or equivalent document so that we know about whom we should provide the requested information and your contact details so that we can send you our reply. If you act on behalf of another person, you must prove your representation.

If you wish to make any suggestions or queries about the processing of your personal data, you can contact our data protection consultants:
BUSINESS ADAPTER, S.L.
Ronda Guglielmo Marconi, 11, 2

6, (Parque Tecnológico) 46980 Paterna (Valencia).
Form for interested party assistance

We inform you that you have the right to make a claim to the Spanish Data Protection Agency at: C/ Jorge Juan, 6, 28001 Madrid or at www.aepd.es.

12. Commitment to the Protection of personal data

Scope of application
Our commitment to the protection of personal data will be binding on all departments and employees of our entity, as well as those third parties that act on our behalf.

Purpose
We have established action protocols for the processing of your personal data, in accordance with the provisions of European and Spanish data protection regulations.

Principles
We will process your data with legality, loyalty, transparency, data minimization, accuracy, limitation of the conservation period, integrity, confidentiality and active responsibility.

Special category of data
Our entity prohibits the processing of personal data that reveal ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, the processing of genetic or biometric data, data relating to health or data relating to sexual orientation, except in the exceptions authorized by law and with the prior consent of the interested party.

Rights of interested parties
Our entity will attend to and respond as quickly and diligently as possible to your requests to exercise your rights.

Activity Record, Impact Assessment and Security Measures
Our entity will keep a record of the processing activities and will analyze the purposes of the processing, categories of interested parties and data, recipients, international transfers, retention periods, etc., to evaluate the risks of the processing and implement the necessary security measures to guarantee the confidentiality, integrity and availability of personal data.

Likewise, in each processing activity, the need to prepare an Impact Assessment has been analyzed and to determine whether there is an obligation to appoint a Data Protection Officer, establishing, if necessary, that the person appointed to this position has sufficient knowledge and experience in accordance with the provisions of current regulations.

Control
We have external help that advises us on this matter, monitoring all publications made by the competent control bodies and other European and Spanish entities related to data protection regulations, in order to comply with these regulations at all times.

13. Updating this Policy
Our entity reserves the right to modify this Policy without prior notice. For this reason, we recommend that you consult it every time you visit our website.

Text updated on July 23, 2024