PRIVACY POLICY

Legal regulations and ownership

CELULOSA FABRIL, SA (hereinafter, “CEFA”), with Tax ID Number A-50.043.298, will process your data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter GDPR) of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and Organic Law 3/2018 of December 5, 2018, on the Protection of Personal Data and Guarantee of Digital Rights.

Basic information about data protection

Website	https://cefa.es/
Website owner	CELULOSA FABRIL, SA
Data controller	CELULOSA FABRIL, SA
Data to be processed	Identifying, contact, academic, and professional information; image.
Purpose	1. Management of candidates for job positions within the organization. 2. Management of inquiries made by interested parties and providing them with answers. 3. Management of suppliers and the necessary invoicing. 4. Sending commercial communications. 5. Video surveillance for the purpose of ensuring physical security.
Legitimacy	Art. 6.1 a) GDPR Express consent Art. 6.1 b) GDPR Contractual relationship Art. 6.1 e) GDPR Public interest Art. 6.1 f) GDPR Legitimate interest
Recipients	Your data may be transferred to third parties, always within the scope of the purposes described above, or due to legal obligations.
Rights	Access, rectification, opposition, deletion, limitation of processing, portability, not to be subject to automated decisions.

Responsible for the processing of your personal data – Data controller

• Trade name: CELULOSA FABRIL, SA
• Tax ID number: A-50.043.298
• Address: Pol. Industrial Malpica, Calle E, Parcela 5, 50016, Zaragoza, (Zaragoza)
• Email: info@cefa.es
• Phone: +34 976 465 465

Data processed

In order to specify as much as possible the information on each data processing operation, it will be divided into different blocks according to the different personal data processing activities. The purposes of such processing can be seen in detail in the following section.

The following information is collected and will be processed in accordance with the GDPR and the LOPDGDD:

• 1. For the purpose of managing candidates for jobs within the organization, the following types of data are processed, which may be collected in paper format or via email:

• Identifying data.
• Contact information.
• Academic data.
• Employment information.

• 2. In order to respond to queries from interested parties, the following types of data are processed, which are collected via the form on the website:

• Identifying data.
• Contact information.

• 3. For the management of suppliers and their invoicing, the following types of data are processed, which are collected through direct communication with the interested party:

• Identifying data.
• Contact information.
• Bank details.

• 4. For the purpose of sending commercial communications, the following data is processed, which is collected through various sources:

• Identifying data.
• Contact information.

• 5. For the purpose of managing recordings obtained through video surveillance systems, the following data is processed, which is collected through video surveillance camera channels:

• Images of the data subjects.

Purpose for which data is processed

At CEFA, we use your personal data in accordance with the law for the following purposes:

1. Management of candidates for job positions within the organization.
2. Management of inquiries made by interested parties and responding to them.
3. Management of suppliers and necessary invoicing.
4. Sending commercial communications.
5. Video surveillance for the purpose of ensuring physical security.

The data collected through the website will not be used to make automated decisions.

Legitimacy for data processing

The legal basis for the processing of your data is as follows, also separated by the processing activities shown in the previous section:

1. The data processed to manage candidates for jobs in the organization is based on the execution of a potential contract with the data subject/consent of the data subject for automated data processing to be carried out.
2. The legal basis for the data processed to respond to queries made by data subjects is the legitimate interest of the data subject.
3. The data processed for the purpose of managing suppliers and invoicing them is based on the contractual relationship between the two companies.
4. The data processed for the purpose of sending commercial communications will be processed on the basis of the consent of the data subject.
5. The legal basis for the data processed for video surveillance is the public interest, in order to ensure the safety of people, property, and facilities.

Temporary limitation of the processing of your data

Your personal data will be kept for as short a time as possible to fulfill the purpose of the processing, in accordance with the data retention policy of the General Data Protection Regulation 2016/679 and Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights, in order to comply with the legal obligations required.

The data you have provided will be kept for as long as necessary for the purposes indicated above, or will also be stored for the time required by various applicable laws.

If you wish to limit the period of time for which your personal data is processed, you must exercise your rights as indicated below.

Recipients to whom your data is transferred

Unless legally required, your data will not be transferred to other organizations for any purpose other than that which you have been informed of. It may only be transferred to organizations related to CEFA for certain essential procedures for the proper completion of projects carried out through CEFA or for the administrative management of contracts and invoices.

No international transfers of your data are planned. Should this occur in the future, you will be informed of this fact.

Data confidentiality and security

CEFA undertakes to use and process users' personal data, respecting their confidentiality and using them in accordance with their purpose, as well as to comply with its obligation to store them and take all measures to prevent their alteration, loss, unauthorized processing or access, in accordance with the provisions of current data protection regulations.

CEFA has adopted the necessary technical and organizational measures to guarantee the security and integrity of the data, but CEFA cannot guarantee the absolute security against the violation of data through fraudulent access to it by third parties.

Rights regarding the processing of your data

You have the right to obtain confirmation as to whether or not CEFA is processing personal data concerning you.

As the data subject, you have the right to access your personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

We remind you that you have the right to withdraw your consent at any time, which entails the removal of the data that the company holds about you. To do so, you must send an email to info@cefa.es  providing your ID number, or send it by post to the above address.

In certain circumstances, you may request the limitation of the processing of your data, in which case we will only keep it for the exercise or defense of claims.

We inform you that you may object to the processing of your data at any time. In this case, we will stop processing the data, except for compelling legitimate reasons, or the exercise or defense of possible claims.

You have the right to portability, i.e., the personal data you have provided may be transmitted directly to another controller in a structured, commonly used, and machine-readable format, where technically feasible.

To exercise the above rights or make any complaint about how we have processed your personal data, please send an email to info@cefa.es  

If you still consider that your personal data has not been processed appropriately in accordance with the law, you may lodge a complaint with the relevant data protection authority, which in the case of Spanish territory is the Spanish Data Protection Agency, located at C/ Jorge Juan, 6. 28001 – Madrid.

Acceptance and consent

You declare that you have been informed of the conditions regarding the protection of personal data, accepting and consenting to the processing thereof by https://cefa.es/ in the manner and for the purposes indicated in this privacy policy, based on the processing in which you are taking part.

CEFA reserves the right to modify this policy to adapt it to new legislation or case law, as well as to industry practices. In such cases, CEFA will announce the changes on this page reasonably in advance of their implementation.