Privacy policy – Nabrawind

1. Privacy policy

The personal data that you provide us with by any of the means provided for this purpose will be processed in accordance with the following privacy policy.
In relation to the collection of data, we inform you that, in the event that it is not necessary to provide all the data requested, those fields that must be completed will be identified with an asterisk, the rest being completely voluntary.

1.1 Identity and the contact details

Controller: NABRAWIND TECHNOLOGIES, S.L.
Address: Avda. Carlos III 11 2º Izda. 31002 – Pamplona (Navarra)
Tax Identification number: B71260673
Phone number: + (34) 948 98 57 57
E-mail: info@nabrawind.com

1.2.- Personal data processing

Below, we inform you about the data processing included in this privacy policy, indicating both the legal basis of the General Data Protection Regulation (hereinafter, GDPR) and the specific retention period of the data, to which must be added the time necessary to comply with legal obligations and meet the possible liabilities that may arise for the Data Controller in relation to compliance with the purpose for which the data were collected:

CONCERNING OUR RELATIONSHIP WITH YOU
Purposes of the processing	Legal basis (GDPR)	Retention period
Requests for information or queries: We will use your data to deal with requests for information, queries or complaints that you might send us, with the scope that they require. As well as for the drafting of proposals for services and/or collaboration.	6.1.a) GDPR. The data subject has given consent to the processing 6.1.b) GDPR. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract	For as long as it takes to deal with the request and/or complaint.
Service provision: We will use your data to manage and process orders for products or services you have ordered from us.	6.1.b) GDPR. Processing is necessary for the performance of a contract to which the data subject is party.	As long as the contractual relationship remains in force and the Controller is entitled to the processing.
Newsletter and commercial communications: In the event that you have a previous contractual relationship with us, unless you object, we will process the personal data you provided us with to send you commercial communications related to the products or services previously purchased by you. Also, when you request us or consent to receive our newsletter or commercial communications, we will use your data to send you communications related to our products or services.	Art. 6.1.f) GDPR. Processing is necessary for the purposes of the legitimate interests pursued by the Controller based on article 21.1 of Law 34/2002. 6.1.a) GDPR. The data subject has given consent to the processing	As long as you do not object and the Controller is entitled to the data processing. As long as you do not withdraw your consent and object to the processing.
Individuals acting on behalf of legal entities: We will use your data to manage and attend to such representation situation.	Art. 6.1.f) GDPR. Processing is necessary for the purposes of the legitimate interests pursued by the Controller based on Article 19 of Organic Law 3/2018.	As long as the contractual relationship with the legal entity represented remains in force and the Controller is entitled to process the data.
Manage your participation in events and / or training: In the event that you register as a participant in any of the actions (courses, events…) we will process your data to manage your participation in them, and register you as a participant, your participation being subject to the legal conditions of the specific action.	6.1.b) GDPR. Processing is necessary for the performance of a contract to which the data subject is party (T&C).	As long as the contractual relationship remains in force and the Controller is entitled to the processing.
In the case of events with public access, capture and use of your image to illustrate news or reviews about the event.	6.1.a) GDPR. The data subject has given consent to the processing	As long as you do not object and the Controller is entitled to the data processing.
Human resources: Job bank and selection processes We manage a job bank and, in this sense, when you send us your CV, the Controller will add your data to our job bank to cover possible vacancies, collaborations, internships or scholarships. When you apply for a specific application, your application will be analysed in relation to it and, where appropriate, if you fit the profile, we will contact you, if not, and only if you give us express consent we will add your personal data to our job bank.	6.1.a) GDPR. The data subject has given consent to the processing 6.1.b) GDPR. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract	Two years
REGULATORY COMPLIANCE-RELATED
Purposes of the processing	Legal basis (GDPR)	Retention period
Processing of the exercise of the rights of the data subject: In the event that, as a data subject, you exercise any of your rights in relation to your personal data, we will use the information you provide to evaluate your request and respond to it.	Art. 6.1.c) GDPR. Processing is necessary for compliance with a legal obligation to which the controller is subject based on Articles 15 to 22 of the GDPR and 12 to 18 of Organic Law 3/2018.	As long as it is necessary to comply with the legal obligations to which the controller is subject.
Compliance with legal obligations related to the products and/or services offered to the data subjects. We will use your data to comply with the legal requirements applicable to the relationship that binds us to you.	Art. 6.1.c) GDPR. Processing is necessary for compliance with a legal obligation to which the controller is subject.	As long as it is necessary to comply with the legal obligations to which the controller is subject.
COOKIES
If you have agreed to receive cookies when you visit this website, the cookie policy of the website, accessible via the following link, will apply to you.

In the event that you are requested at any time to consent the processing of your data for a purpose that requires your consent, your failure to grant your consent (or its subsequent withdrawal) will not have any consequences for you in any case. Nor will your opposition to the processing of your data for purposes based on legitimate interest have any kind of consequence (e.g., the use of your data for the sending of commercial communications related to the products or services already bought by you).

1.3.- Categories of personal data we may collect about you

Through the various means of contact (email, telephone…) enabled on our website, identification and contact data will be collected, such as name, surname, email address, telephone number, etc. In a specific form, you can send us additional information (e.g., reason for the inquiry, additional information, cv…).

Finally, depending on your preferences with cookies, the configuration of your device when accessing the page or the communications that we send you, we may record your browsing on our website obtaining information about your behaviour and interests and we may also know the opening of commercial communications.

2 Purpose

2.1 What will the Data Controller use my data for?

The data you provide us with may be used by the Data Controller for one or more of the purposes indicated below, which will be determined by factors such as your relationship with us (e.g. customer) or by the means used to send the data (e.g. contact form).

Below you will find an explanation of the data processing referred to in this privacy policy, notwithstanding any other type of processing which may occur and for which you may be notified or your authorization may be requested:

Commercial communications:

To send you commercial communications related to the services and activities offered by the Data Controller and that fall within your reasonable expectation with regards the services or products previously contracted. This processing may cease if you object to it.

Requests for information:

When you contact us, for example, using the contact form on our website, by telephone, fax, e-mail, messenger services, social networks, telephone or even in person, to request information or query anything, to make a suggestion, complaint or claim, we will process your data in order to respond to the request for information and/or query you have put forward, with the appropriate management and scope and in order to keep you informed of any relevant new developments. This operation may include the use of the data received for producing proposals for services and/or collaboration, in the event that the request is related to such issues.

Job candidates:

The controller holds job candidates’ applications on file for future vacancies if the applicant so wishes. If you ask to be considered for future vacancies by, for example, requesting so on the form on the website, your data will be processed so that it is retained on file to cover possible future vacancies, placements or internships in and/or collaborations with the company, which implies the evaluation of your application according to the characteristics of the profile or post which may arise and contacting you in order to manage and process the selection procedure. If a selection process commences as a result of the above, the data supplied may be processed to prepare a job contract.

Cookies:

If, at the beginning of your visit to this website, you agreed to receive cookies, the website’s cookie policy will apply to you. We recommend you read the aforementioned policy in which you can find out, among other things, about the cookies used, their purpose and the settings options you can apply to your website display devices in order to delete them for example.

Representative:

If you were the representative of a company, your data will be processed in order to maintain the relationship or meet the request of the legal entity.

2.2 How long will you keep my data?

The amount of time we will keep your data for is closely linked to the type of processing it will undergo.

In this respect, we would like to inform you that in general terms we will process the data for as long as we have a legal relationship with you or until you object to such processing.
Once the period indicated above has expired, we will keep your data to one side, unless otherwise obliged by regulations, until the complete time period for any possible actions that may arise has expired. These terms may be determined, among other issues, by the law applicable to the relationship between the parties.

Therefore, in order to calculate the time we need to retain the data for, we need to take the period indicated in section 2.2.2 as a starting point relating to the specific data processing and add to this the period of time that could apply in terms of the statute of regulations and the statute of limitations for actions.

Time periods related to the specific processing:

Processing relating to the provision of services and maintenance of the business relationship: For as long as the relationship between the parties is maintained.

Processing relating to requests for information. We will process your data for the time necessary to respond and manage your request for information or query.

Cookies: according to the type of cookies, as stated in the corresponding policy.

Time periods imposed by the regulations and the statute of limitations for actions:

Civil Code (article 1964): 5 years.

Law 28 of Law 1/1973, of 1 March, 3 or 10 years in general. Similarly, the relationship between the parties may be subject to Law 39 of Law 1/1973, of 1 March, and the term of 30 years stated therein.

Code of Commerce: 6 years of mandatory documentation retention imposed by article 30.

3 Legitimisation of processing

3.1 Why can the Data Controller process my data? Why is this legitimate?

Depending on the relationship that is established and, therefore, the purpose of the processing, the legal basis may vary. Below is a list of the different situations that may arise and the legal basis that may apply to you depending on the processing:

SENDING COMMERCIAL COMMUNICATIONS:

Sending commercial communications: Pursuant to the current legislation in force and having considered our interests and your rights, we hereby inform you that we have a legitimate interest in processing your data in order to send you commercial communications related to the services you have contracted with us (notwithstanding the fact that you may oppose this processing at any time).

ATTENDING TO REQUESTS FOR INFORMATION:

Attending to requests for information: This processing is allowed by means of your consent given either when sending your request for information and/or assistance, or when giving your data to our company personnel by any means used for this purpose (business cards, in person…).

JOB CANDIDATES

Your CV will be held on file and we will process your application on the basis of the consent given when you provided the information. You may withdraw your consent at any time, but the withdrawal of consent will mean that you will no longer be included in selection processes and your application will be removed from our files.

COOKIES:

We are entitled to process your data under the terms of your consent given when you start to browse our website.

REPRESENTATIVE:

In this case, considering the balance between our interests and your rights, we inform you that we hold a legitimate interest in the processing of your personal data for the purpose established in point 2.

3.2 Consequences of withdrawing your consent or opposing the processing of your data. Mandatory and optional fields.

In the event that you are asked at any time to give your authorization for the processing of a purpose for which your consent is required, failure to give your consent (or the subsequent withdrawal of consent) will not affect you in any way. Neither will your opposition to the processing of your data for purposes based on legitimate interest (for example, the use of your data as a customer for sending commercial communications).

On some data collection forms, you will clearly see that some fields are marked as mandatory (with an asterisk) while the rest are absolutely optional. Therefore, there will be no repercussions if you leave the optional fields blank, although you may fill them in if you so wish.

4 Recipients

4.1 Will my data be passed on to third parties?

In general, your data will not be passed on to any third party without your explicit and affirmative consent, unless we are legally obliged to do so.

4.2 Providers of services related to the website and the e-mail service.

Hosting: the website of the Data Controller is hosted by the provider Arsys Internet S.L.U.

5 Rights

5.1 What are my data protection rights? General information.

With regards the personal data collected for processing you are entitled to exercise your rights of access, rectification, deletion and portability. We also inform you that in certain circumstances you will have the right to request a limitation or to oppose the processing of your data in which case the Data Controller will stop processing and will only retain the data if legally required to do so or until the statute of limitations for any actions that may arise has expired.

If you would like more information about the aforementioned rights please continue reading or consult the infographic produced by the Spanish Data Protection Agency that can be accessed via the following link.

5.2 What are these rights?

Right of access: This right allows the data subject to obtain confirmation from the Data Controller as to whether or personal data concerning him is being processed and, if so, the right of access to the personal data as well as to the following additional information:

The processing purposes
The categories of personal data concerned
The recipients or categories of recipients
The expected period of retention, or the criteria used to determine this time period
The existence of the right to request the Data Controller to rectify or delete the personal data or to request that the processing of personal data related to the data subject be limited, or to object to such processing.
The right to file a complaint with a supervisory authority.
Information available on the source of the data.
The existence of automated decisions.

Right of rectification: This right entitled the data subject to request the Data Controller to rectify or supplement inaccurate personal data without delay. It is important that the data held in the databases is up to date and in this regard, we are ready and willing to rectify any errors or inaccuracies that may exist in the data.

Right to deletion: You are entitled, at any time, to ask us to delete your personal data. We will comply with such a request without delay unless any of the circumstances set out in the General Data Protection Regulations apply, including the fact that we must retain your data in order to comply with a legal obligation or so we are able to defend ourselves against a claim.

Right of portability: In the case of automated data based on your consent, you may request that we, in a structed, commonly used and machine-readable format, forward the personal data you have provided to another data controller.

Right of objection: This right entitles the data subject to object to the processing of his data by the data controller. This right is not absolute, which means that the data controller may continue to process the data provided that he can prove legitimate reasons that prevail over his interests, the rights of the data subject or for the submission, exercise and defense of claims.

Right to limit processing: This right entitles the data subject to request the data controller to limit the processing of his personal data under certain circumstances, as indicated below. If this right is exercised, the data controller may only process the data with the consent of the data subject. The circumstances under which this right may be exercised are those listed below:

If the data subject contests the accuracy of the personal data, for a period of time allowing the data controller to verify the accuracy of the data.

If the processing carried out by the data controller is unlawful and the data subject objects to the deletion of the personal data and instead requests that the use of the data be limited.
If the data controller no longer needs the personal data for processing purposes, but the data subject needs the data for the submission, exercise or defense of claims.
If the data subject has objected to the processing, while it is being verified whether the data controller’s legitimate reasons prevail over those of the data subject.

5.3 How and where can I exercise these rights?

We will be happy to answer any questions or complaints you may have regarding data protection. Similarly, you may submit your complaint or exercise your rights through any of the contact channels indicated at the beginning of this data protection policy.

You may also contact the supervisory authority which you consider appropriate to file your complaint (for example, in the country where you have your usual residence or place of work or where you consider the alleged infringement to have occurred). To this effect, we hereby inform you that in the Spain the Controlling Authority is the Spanish Data Protection Agency, and you may exercise your rights via the forms authorized by this entity for this purpose, and which are available on its online site.

5.4 How long may it take to process my request to exercise my rights?

The reference period is one month from the receipt of your request. However, this period may be extended by a further two months if necessary, taking into account the complexity and number of requests. The Data Controller will inform the data subject of any such extension within one month of receipt of the request, stating the reasons for the delay.

5.5 Will it cost me anything to exercise these rights?

It will not cost you anything to exercise your rights, except in the case of manifestly unfounded or excessive requests, in particular repetitive requests, the Data Controller may charge a fee to compensate for the administrative costs of dealing with the request or refusing to act (the fee must not imply extra revenue for the data controller, but must correspond effectively to the true cost of processing the request).

Version 1.0 – Updated to October 2018