PRIVACY POLICY

In application of the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 and in Organic Law 3/2018 of December 5, on the Protection of Personal Data and guarantee of digital rights , Grupo Aldesa, SA (hereinafter ALDESA or the Entity) informs the users of its website www.aldesa.com through this Privacy Policy about the treatment and protection of personal data of users that may be collected through their browsing or contracting of services that they carry out on this portal.

RESPONSIBLE OF PERSONAL DATA TRATAMENT

The responsible for the processing of personal data provided by the user when accessing and using the website, as owner, is ALDESA with CIF A-85289155, with registered address at Calle Bahía de Pollensa 13 and 17, 28042 – Madrid, Spain.

ALDESA has designated a Data Protection Officer (DPO) to whom you can address any questions regarding the processing of your personal data, at the following email address: DPD@aldesa.es

ALDESA adopts the necessary measures to guarantee the security, integrity and confidentiality of the data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and the free circulation of such data, and in that not provided for by this by Organic Law 3/2018 of December 5, on the Protection of Personal Data and guarantee of digital rights and Law 34/2002, of July 11, on Information Society Services and Electronic Commerce.

PERSONAL DATA WE PROCESS

The party responsible for the processing of personal data provided by the user when accessing and using the website, as owner, is ALDESA with CIF A-85289155, with registered address at Calle Bahía de Pollensa 13 and 17, 28042 – Madrid, Spain.

Furthermore, the user guarantees that the data provided is true, accurate, complete, and up-to-date.

PURPOSES AND LEGAL BASES FOR DATA PROCESSING

Personal data will be processed by ALDESA for the following purposes, depending on the interactions that the user has with ALDESA through the website and the type of data provided by the user:

PURPOSE 1 – Development of the Value for People Program

Description of the purpose: Personal data may be processed for the purpose of communicating and disseminating the experience of working at ALDESA, including the publication of content about the work environment, the benefits offered by the company, the impact of our activities on society, and the recognition obtained through certifications and collaborations with different entities.

Legal basis: Art. 6.1.a) GDPR – The data subject gives their express and explicit consent for the processing of their personal data in order to respond to their queries.

PURPOSE 2 - Management of your application for an open selection process:

Description of the purpose: The data provided will be processed for the purpose of managing the receipt of CVs sent to ALDESA, as well as for the purpose of analyzing the candidate's professional profile and, where appropriate, enabling participation in the personnel selection processes of ALDESA and, where appropriate, of companies in the Aldesa Group.

Legal basis: Art. 6.1.b) GDPR - Processing is necessary for the implementation of pre-contractual measures in accordance with your registration for the job offer.

PURPOSE 3 - Responding to queries

Description of the purpose: Users' personal data may be processed by ALDESA for the purpose of managing and responding to queries, requests, or communications made by the user.

Legal basis: Art. 6.1.a) GDPR - The data subject gives their express and explicit consent for the processing of their personal data for one or more specific purposes.

PURPOSE 4 - Improving the browsing experience

Description of the purpose: Personal data collected while browsing this website may be processed for the purpose of analyzing the user's usage and browsing habits, with the aim of optimizing the structure, content, and usability of the website, as well as improving the overall browsing experience.

Legal basis: Art. 6.1.f) of the GDPR – The legitimate interest of the controller in offering a high-quality website tailored to the needs of the user.

PURPOSE 5 - Management of cookies on the website:

Description of the purpose: If you accept our Cookies Policy, in particular our analytics, personalization, advertising, and social media cookies, your personal data may be processed by ALDESA for the purpose of (i) tracking and analyzing your behavior on the website (e.g., counting visits and traffic sources in order to evaluate and improve the website's performance), (ii) provide you with better website functionality and personalization (e.g., the user will be able to access a series of criteria on their device such as language, type of browser used to access the site, etc.), (iii) managing advertising, and (iv) managing the social media services we have added to allow them to share our content, as well as profiling their interests by monitoring their browsing on other websites, respectively. You can find more information about the cookies we use in our Cookie Policy.

Legal basis: Art. 6.1.a) GDPR – The data subject gives their express and explicit consent to the processing of their personal data for one or more specific purpose.

DATA COMMUNICATION

Generally, your personal data will not be shared with third parties, except for those service providers who support us in offering the aforementioned products and services, or in the event that communication is required by law. In this case, these third parties may include communications to public authorities, judges and courts, and interested parties in proceedings related to the claims filed, among others.

We inform you that, as a general rule, international transfers are not made outside the European Economic Area (EEA). In the event of a data transfer outside the EEA, ALDESA will have appropriate safeguards in place to carry out said transfer, in accordance with the requirements established by the General Data Protection Regulation.

DATA STORAGE DURATION

Your personal data will be retained for the time necessary to fulfill the purpose for which it was collected. If your data is used for multiple purposes that require us to retain it for different periods, we will apply the longest retention period. In any case, we limit access to your data to only those individuals who need to use it to perform their duties. Our data retention periods are based on business needs, so for personal data that is no longer required, access to it will be limited to compliance with strictly legal obligations or it will be securely destroyed.

RIGHTS OF INTERESTED PARTIES

ALDESA informs you that you have the right to obtain confirmation as to whether or not we are processing personal data that concerns you. Likewise, ALDESA informs you that you have the following rights over your personal data: Access your data: You have the right to access your data to know what personal data we are processing that concerns you. Request rectification of your data: In certain circumstances, you have the right to rectify any personal data that you consider inaccurate and that concerns you, and that is being processed by ALDESA. Request deletion of your data: In certain circumstances, you have the right to request the deletion of your data when, among other reasons, the data is no longer necessary for the purposes for which it was collected. Request restriction of the processing of your data: In certain circumstances, you will have the right to request us to restrict the processing of your data, in which case we inform you that we will only retain the data for which you have requested restriction of processing for the exercise or defense of legal claims. Data portability: In certain circumstances, you will have the right to receive the personal data that concerns you, and that you have provided to us, in a structured, commonly used and mechanical reading format, as well as to have them transmitted by ALDESA to another data controller. •Object to the processing of your data: In certain circumstances and for reasons related to your particular situation, you will have the right to object to the processing of your data, in which case we will stop processing them unless we must continue to do so for compelling legitimate reasons or for the exercise or defense of possible claims. You may also withdraw any of the consent you have given for the processing of your data, without affecting the lawfulness of the processing based on the consent prior to its withdrawal. ALDESA informs you that you may exercise your rights over your personal data through any of the following means: •By writing to ALDESA, SA, to the attention of the Data Protection Officer, at Calle Bahía de Pollensa 13 and 17, 28042 – Madrid, Spain. •By writing to ALDESA, SA at the email address: ARCOPOL@aldesa.es. ALDESA will provide the requested information within a maximum of one month from receipt of the request. This period may be extended by another two months if necessary, taking into account the complexity and number of requests. ALDESA informs you that you may file a complaint with the Spanish Data Protection Agency, especially if you have not received a satisfactory response in exercising your rights, by writing to the Spanish Data Protection Agency (www.aepd.es) or to Calle Jorge Juan, No. 6, 28001 Madrid.

CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be revised from time to time to reflect changes in current legislation, updated procedures for collecting and using personal information, the introduction of new services, or the exclusion of others. These changes will be effective upon publication on the website. Therefore, it is important that you regularly review this Privacy Policy to stay informed of any changes.