Who is responsible for processing your personal data?
Data controller: TOLSA S.A.
Tax Identification Number: A28077709
Registered ADdress: Calle Nuñez de Balboa nº 51, 28001, Madrid (España)
Telephone: +34 91 322 01 00
Email: [email protected]
What personal data do we process?
TOLSA will process the following categories of User personal data:
- Identification data: first name and surname.
- Personal or professional contact data: postal address, email address, telephone number.
- Academic data: in the event that you participate in recruitment / selection processes.
- Other data: data provided directly by data subjects to foster commercial relations and mutual interest.
Why and for what purpose do we process your personal data?
Your personal data will be processed by TOLSA for the following purposes:
- Management of contact and information requests received by email and/or web form: The purpose of processing is to manage requests received through the website and/or contact email address. Lawful basis: Consent of the data subject (Art. 6(1)(a) GDPR).
- Visits to our facilities: The purpose of processing is to handle and authorize visit requests for access control and security reasons. Lawful basis: Task carried out in the public interest (Art. 6(1)(e) GDPR).
- Management of recruitment / selection processes: The purpose is to manage TOLSA’s selection processes in which you participate. Lawful basis: Taking steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest (Art. 6(1)(f) GDPR) in retaining your data for future selection processes that may match your profile.
- Management of relationships with our suppliers, partners, or collaborators: TOLSA will process the personal data of professional contacts belonging to corporate clients for the purpose of managing the commercial relationship binding the parties. Lawful basis: Legitimate interest (Art. 6(1)(f) GDPR) in conjunction with Article 19 of Organic Law 3/2018, of 5 December, on Personal Data Protection and Guarantee of Digital Rights. In the case of natural persons, the processing is lawful based on the performance of a contract to which the data subject is party (Art. 6(1)(b) GDPR).
- Commercial communications/Newsletter: TOLSA may process your data to inform you about its content, events, or products, upon your request or with your consent. Lawful basis: Express consent (Art. 6(1)(a) GDPR). Where a prior contractual relationship exists, the lawful basis will be our legitimate interest (Art. 6(1)(f) GDPR).
- Training: TOLSA may process data to manage the registration and participation of clients/distributors with whom a contractual relationship exists in training activities regarding its products. Lawful basis: Legitimate interest (Art. 6(1)(f) GDPR).
- Exercise of rights and privacy management: TOLSA may process your data to manage your requests to exercise data protection rights or for purposes necessary to comply with applicable regulations. Lawful basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR).
- Whistleblowing channel: The purpose of processing is to manage communications received through our whistleblowing channel when potential irregularities committed by TOLSA personnel are brought to our attention. Lawful basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR).
- Video surveillance: TOLSA operates video surveillance cameras at its facilities for the purpose of ensuring the safety and security of individuals, assets, and premises. Lawful basis: Task carried out in the public interest (Art. 6(1)(e) GDPR).
- Cookies: The use of cookies on our website involves the processing of your personal data. The purpose of this processing is, on the one hand, to enable you to browse our web pages without errors through the installation of technical cookies on your device and, on the other hand, to improve website functionalities using the information collected from analytical cookies installed on your device, provided that you grant your consent (Art. 6(1)(a) GDPR).
How long will we retain your personal data?
We retain your personal data for the periods strictly necessary for each processing activity, which vary depending on the purpose for which the data is processed:
- Management of contact and information requests received by email and/or web form: If you contact TOLSA to request information, your data will be retained for a period of two years from the date of the last communication made by the user. This period will be renewed with each new contact or interaction initiated by the user.
- Visits to our facilities: Personal data collected to manage visits will be retained for a period of one month.
- Dispatch of commercial communications: We will only send commercial communications with your consent. You may withdraw your consent at any time.
- Management of relationships with our partners, collaborators, and suppliers: Personal data will be retained for as long as the commercial relationship remains in force and, subsequently, duly blocked until the expiration of the statute of limitations for potential legal liabilities.
- Management of recruitment / selection processes: CV data and any other information provided to participate in our selection processes will be retained during the selection process and, in certain cases, for a period of two years following the completion of the selection process.
- Training: Personal data will be retained during training activities or until consent is withdrawn, and duly blocked until the expiration of the statute of limitations for potential legal liabilities.
- Exercise of rights and privacy management: In the event that you have exercised your data protection rights or where we need to process your data to comply with legal obligations established by data protection regulations, your data will be retained for the time necessary to fulfill our obligations and, subsequently, duly blocked until the expiration of the statute of limitations for potential legal actions, which as a general rule will be 3 years.
- Whistleblowing channel: Personal data contained in communications received through our whistleblowing channel will be processed for the time strictly necessary. Any unnecessary personal data contained in the communication will be deleted immediately. Personal data necessary to manage the relevant investigations will be retained during the investigation and, subsequently, duly blocked until the expiration of the potential legal actions.
- Video surveillance: Personal data captured by video surveillance cameras is retained for a period of one month from capture. However, it may be retained for longer periods if necessary to substantiate acts that threaten the integrity of individuals, assets, or facilities.
- Cookies: Retention periods depend on each specific cookie and vary according to your settings. You may withdraw your consent at any time. The maximum retention period for cookies will be 2 years. For more information, please consult our Cookie Policy.
Will international transfers of personal data take place?
In general, no international transfers of personal data are carried out; that is, no transfers of personal data from the EU to territories or international organizations located outside the European Economic Area (EEA).
However, the use of certain IT tools for data processing may involve international transfers.
Where this occurs, we ensure that at least one of the following conditions is met: (i) an Adequacy Decision exists certifying an adequate level of protection; (ii) standard contractual clauses have been executed in accordance with Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries; or (iii) where neither of the two preceding conditions is met, one of the derogations set forth in Article 49 of the GDPR is applicable.
How and where is information shared?
TOLSA S.A. only shares your personal data with:
- Third parties, public bodies, and institutions of the General State Administration, regional, and local administrations, including judicial bodies to which it is legally obligated to provide them.
- Other group companies, partner companies and/or collaborators so that they may manage the commercial relationship with you.
- Service providers contractually linked to TOLSA acting as data processors, who will process your data strictly following information privacy instructions and with the necessary safeguards for the specified processing purposes.
What security measures are implemented?
TOLSA S.A. attaches great importance to the security of all personal information. Therefore, we dedicate effort and resources to continuously improving our website every day to ensure that the features we make available to you are increasingly secure.
We implement technical and organizational security measures to prevent the loss, misuse, alteration, and unauthorized access to your personal data, in compliance with Article 32 of Regulation (EU) 2016/679 (General Data Protection Regulation) and based on the risk assessments conducted by TOLSA.
How can you exercise your rights?
You may exercise your rights of access, rectification, erasure, restriction of processing, objection, data portability, and the right not to be subject to automated decision-making, as well as withdraw any consent granted, at any time and completely free of charge, by sending an email to [email protected].
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) should you consider it necessary.
Mandatory or optional nature of the requested data
Mandatory fields on each form are identified as such. Refusal to provide this information will prevent communication with the user and, where applicable, make it impossible to provide the requested information and/or service.
User commitment
Users undertake to inform TOLSA S.A. of any modifications or updates to the data provided.