TREATMENT MANAGER

Co-managers CTLpack Vitoria-Gasteiz. S.A.U./ CTLpack Group, S.L.U.

Postal address: C/Hermanos Lumiere 1, Parque Tecnológico de Álava, C.P. 01510 Miñano (Álava)

Email: lopd@ctlpack.com  Tel. 945 29 62 00

 

HOW DID WE OBTAIN YOUR DATA?

Obtaining of the interested party itself:  If you are already a customer, you have either facilitated them to us off or online on ordering our services in order to maintain the contractual relationship with you or, for example, if you have come to our offices or plant, you may have facilitated them to us when you accessed our facilities as a visitor. Similarly, your data may have been communicated to us by our sales network, following your providing of your data to any of our salespeople. The data categories we process are: identification data, postal or electronic mailing addresses, commercial information and financial data. We do not process specially protected data.

When you facilitate your personal data to us, you are guaranteeing that you are authorised to do so and that it is true, accurate and up-to-date, that it is not confidential and that it does not breach any contractual restriction or third-party rights and you commit yourself to refrain from impersonating other Users.

Automatically obtained on visiting our website: If you have provided us with the data through this website, you must be aware that we collect information, for example, when you access the site, when you register as a user, fill in any form with personal data or when you communicate with us directly by email.

When you visit our website data are sent from your browser to our server in order to optimise our services and improve your user experience, for example when you access the site or when you start using our Services through the services of third parties such as social networks or Google.  These data can be automatically gathered and stored by us or by third parties on our behalf. These data may include:

• the user’s IP address
• the time and date of the visit
• the URL of the site the user is coming from
• the pages visited on our website
• information about the browser used (browser type and version, operating system, etc.).

We may process and record these uses, sessions and related information either individually, with the help of third-party services or even by using cookies and other tracking technologies such as flash cookies and web analytics.

Our website has connectors to social networks, when you choose to interact with us through a social network, we cannot take responsibility for the privacy settings chosen by the user, the social network being able to report your IP address or which page you are visiting on our website and a cookie may be set to allow them to operate properly or for example when you name is included in the Likes that you give or in the comments you make in our page on the social network. If you do now want your personal data to be associated to these Likes or comments set your privacy settings to prevent it, giving a pseudonym to your data by, for example, setting yourself a nickname or alias that does not reveal your name and surname.

If you start the session on one of these social networks during your visit to our website, the social network can add this information to your profile and this information will be transferred to the social network. If you do not want this data transfer to be made, exit your social network session before you enter our websites or mobile apps, as it is not in our hands to influence this data collection and transfer through the social connectors.

If the user, through our official website on a social network, decides to publish and/or share texts, photos, videos and other kinds of information and/or contents, the former shall be the sole party responsible that such contents comply with the applicable legal framework. We remind you that you must respect the data of third parties, you must their privacy having special care in communicating or publishing their data of a personal nature. Only the rightful owner can authorise the processing of their personal data. The user may only publish on this page or on our official page on social networks, personal data, photographs and information or other content of which they are the owner and where the property belongs to them or with regards to which they have been granted the authorisation of third parties. If you facilitate or publish third party data, it is your responsibility to have their prior and express consent to use them, for communicating and publishing them it is your responsibility to inform them of the treatment of their data by us or their publication by you. The publication of third party data may infringe, in addition to the legislation on data protection, that relating to the right to honour, to intimacy or to the own image of the said third parties.

In any event, we may from both this website as well as from our pages on social networks, any content published by the user when we detect that the user has breached current legislation and that described in this privacy policy.

The Social Networks are no directly lodged in our Services. Your interactions with them are governed by their policies and not by ours. Read the privacy policies of these social networks for detailed information on the collection and transfer of personal data, your rights and on the settings of your privacy.

 

Communication by a third party of the data of the interested party: In the event where it is not the interested party concerned but a third party who provides us with the data on the former, your data may have been communicated, as applicable, by our sales or distributor network prior to the providing of your data to any of them.

 

THIRD PARTY DATA

You must respect the privacy of third parties, especially with respect to disclosure of their data of a personal nature. Please remember that as a user you can only provide and consent to processing of your own personal data and not those of third parties. If you provide us with third-person data you are assigning their information and it is your responsibility to obtain the prior and express consent of the third parties involved to use and provide said data. You are also responsible for informing them that their data has been added to our files.

The provision of third-party data without consent, in addition to infringing the data protection regulations, may also breach the right to honour, privacy and self-image of said third parties. These rights are protected under Organic Law 1/1982 5 of May on civil protection of the right to honour, personal and family privacy and one’s own image.

 

WHAT DO WE PROCESS YOUR DATA FOR AND WHAT IS OUR LEGAL BASIS FOR DOING SO?

The data you provide us, as well as all the data generated during the development of the relationship we have with you, we can process them for different purposes and with different legitimate bases.

Purpose 1. To maintain contact and communication, manage the contractual or pre-contractual relationship and after-sales and warranty services.

Purpose 2. In the case of providing us with your curricular data or sending us your curriculum, to contact you and manage the selection processes that we carry out.

Legal basis: Contractual relationship or application of pre-contractual measures at the request of the data subject (art. 6.1. b RGPD).

Purpose 3. To send potential customers, through electronic communications, information about our activities, products and/or services similar to those requested.

Purpose 4. Installation of non-technical cookies.

Purpose 5. To participate in events, activities, promotions or contests that we organize.

Legal basis: Consent.

Purpose 6. Transfers derived from tax regulations.

Purpose 7. Management of the internal information system, if any. In the event that the complaint is not anonymous, the identification of the complainant will not be provided to the respondent.

Legal basis: Compliance with a legal regulation or obligation (tax and internal information system regulations).

Purpose 8. Manage access and control of visits to our facilities.

Purpose 9. To send to current clients, by means of electronic communications, information about our activities, products and/or services similar to those requested.

Purpose 10. Installation of technical cookies.

Purpose 11. Conducting opinion/satisfaction surveys.

Purpose 12. In the case of users of our website, or sender or recipient of an email: to manage those made online, and contact you.

Purpose 13. To communicate data to any of the companies that make up the CTLpack Group (currently, CTLpack Group, S.L.U.; CTLpack Vitoria-Gasteiz. S.A.U.; CTLpack Vichy SAS): for internal administrative purposes, including the processing of personal data of customers, suppliers or staff.

Legal basis: Legitimate interest

When the legitimacy is based on consent you may withdraw that consent at any time by sending us an e-mail to that effect to lopd@ctlpack.com. Such withdrawal does not condition the processing of your data for the other purposes described above.

If it is based on our legitimate interest the indicated treatment of your data we consider that it is proportionate and involves a minimal impact on your privacy, but always prevail over our legitimate interest, your interests, rights or freedoms, so if you do not want us to treat your data for these purposes please send us an e-mail to that effect to lopd@ctlpack.com and we will do so.

Specific information regarding legitimate interest as a legal basis, both for data communications within the CTLpack Group (currently, CTLpack Group, S.L.U.; CTLpack Vitoria-Gasteiz. S.A.U.; CTLpack Vichy SAS) for internal administrative purposes, as well as for sending, to clients of the companies of the group, information through electronic communications about activities, products and/or services of such companies.

We understand that this legitimate interest is foreseeable for the data subject, as it is expressly recognized in the RGPD and is aware that the aforementioned companies form a business group for the purposes of data protection, being the impact on data subjects very limited. We have a procedure for sending commercial communications, in accordance with data protection regulations, and a weighting analysis on this legitimate interest, of which you can request an extract. Therefore, we consider that the aforementioned data communications within the group are proportionate and have a minimal impact on privacy. In any case, your interests, rights or freedoms will always prevail over our interests, so if you do not want us to process your data for these purposes, please send us an e-mail to lopd@ctlpack.com.

The provision of the requested data is mandatory because it is essential to formalize and / or maintain the contractual or pre-contractual relationship and meet the legal obligations arising therefrom; if you do not provide them, we can not provide the service derived from that relationship.

 

RETENTION PERIOD

We shall retain the personal information that you provide insofar as you do not request its deletion. Even after this has been requested, we shall keep them for the necessary time and limiting their processing, solely to complying with the legal/contractual obligations we are subject to and/or during the legal periods set for the expiry of any liability on our part and/or for the exercising or defence of claims derived from the relationship maintained with the interested party.

 

TARGET

We inform you that the data you provide may be communicated to third parties for the fulfillment of purposes directly related to legitimate functions of transferor and transferee as:

1. To transport companies in charge of the logistics of shipping and delivery of our goods.
2. To any of the companies that make up the CTLpack Group (currently, CTLpack Group, S.L.U.; CTLpack Vitoria-Gasteiz. S.A.U.; CTLpack Vichy SAS) for internal administrative purposes and to manage the contact and personnel selection processes carried out within the business group, in case you have provided us with your CV.
3. To banking entities for the management of collections and payments.
4. To entities or organizations to which there is a legal obligation to communicate data (Tax Administration, …).

 

 

International transfers

In the event that we use US suppliers who may have access to personal data, for the purpose of providing us with ancillary services to our business activity (accommodation, housing, software as a service, remote backup, computer support or maintenance services, email managers, the sending of emails and marketing emails, file transfers etc. …) these companies may differ or vary over time but in any event we will choose companies that adhere to the Privacy Shield agreement between the USA and the EU or that belong to countries that have been declared as having an adequate level of protection, which means that they oblige themselves to fulfil requirements equivalent to the Europeans ones in data protection matters. In any event, by the acceptance of this data protection policy you expressly and unequivocally authorise the communication of the data to said companies, thus being aware that this involves an international data transfer to a country not belonging to the European Economic Area and giving your unequivocal consent to said transfer.

 

RIGHTS

You may, when appropriate, exercise your rights of access, rectification, deletion, limitation and challenging their processing, as well as to not be the object of decisions based solely on the automated processing of your data, on the postal or email address indicated at the beginning of this privacy policy. In both cases by means of a written and signed request, attaching a copy of the National ID Document or passport or any other valid document to identify yourself. If you want to amend your data you must do so to the same address, the company hereby declining all responsibility in the event of not having done so.

Right of access: You can ask us what personal data we are processing and request us to send you a copy of them.

Right to rectification: You can request rectification of any inaccurate data of a personal nature or the completion of incomplete date, including by means of an additional declaration.

Right to suppression (right to be forgotten): You may request the suppression of your data of a personal nature when: they are no longer required for the purposes for which they were collected, you withdraw your consent, they have been improperly processed and for compliance with a legal obligation.

Right to restriction of processing: You may request the restriction of the processing of your data, in which case we will only store them for the exercising or defence of legal claims

Right to challenge: You may challenge the processing of your data if said processing is based on the legitimate interest of the file manager or it is for advertising purposes.

Once any of the above requests have been received we will respond to you within the legally established time limits. You may file a complaint to the Spanish Data Protection Agency. For information on your rights you can visit the website of the Spanish Data Protection Agency at www.aepd.es to obtain further information on the exercising of your rights and to request the forms required to do so.

 

DATA CATEGORY

The data categories we process are: identifying data; professional data; economic data, financial data; transactions of assets and of services.