Privacy Policy

This Privacy Policy has been developed taking account of the provisions of current regulations in the matter of data protection: Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: the GDPR), and Organic Law 3/2018 of 5 December on protecting personal data and guaranteeing digital rights (Ley de Protección de Datos Personales y Garantía de los Derechos Digitales – hereinafter: LOPDGDD).

The aim of this Privacy Policy is to provide the data subjects on whom information is being collected with information on specific aspects relating to their data being processed, inter alia, the purposes of processing, contact details for exercising the rights that they enjoy, the period of information storage, and security measures, amongst other matters.

Data Controller

Company name:	EBROACERO, S.A
Address:	Calle Argualas 20 50012 Zaragoza
Tax Identification Code:	A50009844
Telephone:	+34 976 564 625
E-mail address:	info@ebroacero.com

Data-processing

Where appropriate, the personal details that are requested shall consist only of those details that are strictly needed to identify and to respond to the request made by the subject of those data, hereinafter the data subject. That information shall be processed fairly, lawfully, and transparently in relation to the data subject. Furthermore, personal data shall be collected for specific, explicit, and legitimate purposes, and shall not be subsequently processed in a manner that is incompatible with those purposes.

The data collected on each data subject shall be adequate, relevant, and not excessive in relation to the related purposes for each case, and shall always be updated when necessary.

Before the data are collected, the data subject shall be informed of the general points regulated by this policy, so that she / he can give express, accurate, and unequivocal consent to the processing of her / his data, if that is necessary and in accordance with the following aspects.

Purposes of processing

The explicit purposes for which each case of processing is carried out are set out in the information clauses incorporated into each of the data-collection channels (web forms, paper forms, contracts, posters, etc.).
However, in general, the purpose of data collection and processing is as follows:

- Maintaining the contractual relationship established between the data subject and EBROACERO.
- Executing, maintaining, and managing any relationships that may be maintained by EBROACERO and the data subject: commercial, administrative, accounting, employment, marketing, and any other provision of service that the data subject may request of EBROACERO.
- Responding to information and / or contact requests
- Sending advertising and promotional information on EBROACERO’s own products, provided that the data subject has given her / his consent for that purpose, or if there is a prior commercial / contractual relationship and reference is made to sending commercial communications that refer to products and services that are similar to those that were initially the subject of a contract with the customer (article 21.2 of Law 34/2002 of 11 July on services of the information society and electronic commerce).

Under no circumstances shall the data be used for purposes other than those for which they were collected.

Legitimation

As a general rule, before processing personal data, EBROACERO obtains the data subject’s unequivocal consent by incorporating informed-consent clauses into the various information-collection systems.
However, if the data subject’s consent is not required, the legitimising basis for processing used by EBROACERO is executing the contractual relationship established and our legitimate interest in carrying out the business, in the case of commercial promotion and prospection or fulfilling a law that authorises or requires the data subject’s data to be processed.
If your consent has been requested for any of the processing that we shall carry out (such as sending information on products and services), we hereby inform you that you can withdraw your consent at any time.

Recipients

As a general rule, EBROACERO shall not pass personal data on to a third party, except if the Data Subject has granted her / his consent for that purpose, or if the transfer is authorised by a Law, or in the case of entities with which we maintain a relationship, and by virtue of data-processor contracts that are entered into with those entities.

International data transfers

There is no plan to carry out international data transfers.

Periods of storage

The information collected on the data subject shall be stored for the period needed to comply with the purpose for which the personal data were collected, such that the data shall be deleted once the purpose has been fulfilled. That deletion shall give rise to the data being blocked, and being stored solely to make them available to the Public Administrations, Judges, and Courts, and to deal with possible liabilities arising from processing during the statute of limitations of the latter; once the said statute has expired, the information shall be destroyed.
For the purposes of information, set out below are the legal periods of storage relating to various matters:

DOCUMENT	PERIOD	LEGAL REFERENCE
Accounting and tax documentation for business purposes	6 years	Article 30 of the Business Code
Accounting and tax documentation for tax purposes	4 years	Articles 66 and 70 of the General Law on Taxation
The details of people who have contacted us	For as long as the data subject does not request their deletion	Not applicable

Browsing data

In relation to the browsing data that may be processed over the website, if data subject to the regulations are collected, it is recommended that you check the Policy on Cookies published on our website Cookies Policy.

Data subjects’ rights

Any person is entitled to obtain confirmation of whether or not EBROACERO is processing personal data concerning her / him.

Data subjects are entitled to access their personal data and to request the rectification of inaccurate data, or, where appropriate, request their deletion, when, amongst other reasons, the data are no longer needed for the purposes for which they were collected.

In specific circumstances, data subjects can request limitation on processing their data, in which case we shall only store the data for making complaints or for mounting a defence against them.

In specific circumstances and for reasons relating to their particular situation, data subjects can object to their data being processed. In that case, EBROACERO shall stop processing the data, except for compelling, legitimate reasons or for mounting a defence against possible complaints.

Data subjects can exercise the rights indicated by contacting EBROACERO, by post to the following address: Calle Argualas 20, 50012 Zaragoza, or at the following e-mail address: info@ebroacero.com, attaching, in all cases, a photocopy of the DNI (Documento Nacional de Identidad – National Identity Document) or equivalent document that is valid in law and that enables the applicant’s identity to be ascertained.

They also have the option to make a complaint to the Agencia Española de Protección de Datos (Spanish Data-Protection Agency) (aepd.es) if they feel that their data are not being processed properly.