Home

Privacy Policy

PRIVACY POLICY. INFORMATION ABOUT DATA PROTECTION

Postal Address: C/ San Antolín, 10 - Pol. Industrial Goiain, 01170 Legutio (Álava) Spain

OTUA informs users of this website of its data protection policy in compliance with the European Regulation 2016/679 on Data Protection and the Spanish Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights. You can obtain detailed information about personal data management by clicking on the following contents.

The website may include hyperlinks to other sites not operated or controlled by Otua. Therefore, Otua does not guarantee or assume responsibility for the legality, reliability, usefulness, truthfulness, or timeliness of the content of these websites or their privacy practices. Before providing your personal information to websites not owned by Otua, please be aware that their data protection compliance may differ from ours.

Otua may modify its Privacy Policy in accordance with applicable laws at any given time.

Last update of the Privacy Policy: December 2021

• INFORMATIONAL POLICY FOR CLIENTS AND COMMERCIAL REQUESTS

• INFORMATIONAL POLICY FOR SUPPLIERS

• INFORMATIONAL POLICY FOR EXTERNAL RELATIONS

• INFORMATIONAL POLICY FOR WORKPLACE RISK PREVENTION

• INFORMATIONAL POLICY FOR JOB CANDIDATES

• INFORMATIONAL POLICY FOR EVENTS

• INFORMATIONAL POLICY FOR VIDEO SURVEILLANCE

• INFORMATIONAL POLICY FOR CONTACT

• INFORMATIONAL POLICY FOR R&D+I

• INFORMATIONAL POLICY FOR SECURITY BREACHES

• INFORMATIONAL POLICY FOR EXERCISING RIGHTS RELATED TO THE HANDLING OF PERSONAL DATA

• FORM FOR EXERCISING RIGHTS RELATED TO THE HANDLING OF PERSONAL DATA

INFORMATIONAL POLICY FOR CLIENTS AND COMMERCIAL REQUESTS

Controller	Who is the controller of your data? OTUA Postal address: C/ San Antolín, 10 - Pol. Industrial Goiain, 01170 Legutio (Álava) Spain Email address: RGPD@grupo-otua.com
Purpose	Why do we handle your data? Management of the hiring process, customer service, and commercial request processes. Maintenance of commercial relationships between companies in the sector.
Legal Basis	What is the legal basis for processing your data? Contractual or pre-contractual legal relationship with clients or potential clients, in application of article 6.1.b) of Regulation (EU) 679/2016, General Data Protection Regulation. Legitimate interest for maintaining a historical record of commercial proposals as a reference for future proposals, in application of article 6.1.f) of Regulation (EU) 679/2016, General Data Protection Regulation. Legitimate interest for maintaining commercial relationships between companies in the sector, in application of article 6.1.f) of Regulation (EU) 679/2016, General Data Protection Regulation.
Recipients	Who will your data be shared with? Directly related Otua companies. Those required for compliance with legal obligations.
International Transfers	When are they made? They are not made.
Conservation	How long will we keep your data? Personal data will be kept until the finalization of the commercial relationship with the client. After that, it will be blocked with restricted access, marked as inactive in the system, and will remain in that status during the applicable limitation periods for personal data management.
Rights	What are your rights when you provide personal data? Interested parties have the right to obtain confirmation on whether the organisation is handling their personal data, access it, correct inaccurate data, and delete it when it is no longer needed for its original purpose. They can also limit processing or object to it. Interested parties can exercise their rights by emailing RGPD@grupo-otua.com and file a complaint with the Data Protection Agency if their rights are not satisfied.
Security	Data will be handled confidentially and under appropriate technical and organizational security measures to avoid unauthorized access, alteration, or loss.

INFORMATIONAL POLICY FOR SUPPLIERS

Controller	Who is the controller of your data? OTUA Postal address: C/ San Antolín, 10 - Pol. Industrial Goiain, 01170 Legutio (Álava) Spain Email address: RGPD@grupo-otua.com
Purpose	Why do we handle your data? Management of suppliers, subcontractors, and outsourced companies. Maintenance of commercial relationships with companies in the sector.
Legal Basis	What is the legal basis for processing your data? Legal relationship regarding the provision of services, in application of article 6.1.b) of Regulation (EU) 679/2016, General Data Protection Regulation. Legitimate interest to maintain a history of commercial activities used as a reference for future activities, in application of article 6.1.f) of Regulation (EU) 679/2016, General Data Protection Regulation. Legitimate interest for maintaining commercial relationships with companies in the sector, in application of article 6.1.f) of Regulation (EU) 679/2016, General Data Protection Regulation.
Recipients	Who will your data be shared with? Directly related Otua companies. Those required for compliance with legal obligations.
International Transfers	When are they made? They are not made.
Conservation	How long will we keep your data? Personal data will be kept until the finalization of the commercial relationship with the client. After that relationship, the data will be blocked with restricted access, and will be marked as an inactive client in the system, remaining in that situation for the limitation periods required by the applicable specific regulations.
Rights	What are your rights when you provide personal data? Interested parties have the right to obtain confirmation on whether the organisation is handling their personal data, access it, correct inaccurate data, and delete it when it is no longer needed for its original purpose. They can also limit processing or object to it. Interested parties can exercise their rights by emailing RGPD@grupo-otua.com and file a complaint with the Data Protection Agency if their rights are not satisfied.
Security	Data will be handled confidentially and under appropriate technical and organizational security measures to avoid unauthorized access, alteration, or loss.

INFORMATIONAL POLICY FOR EXTERNAL RELATIONS

Controller	Who is the controller of your data? OTUA Postal address: C/ San Antolín, 10 - Pol. Industrial Goiain, 01170 Legutio (Álava) Spain Email address: RGPD@grupo-otua.com
Purpose	Why do we handle your data? To manage communications with people of interest to the organization involved with the public and private sector.
Legal Basis	What is the legal basis for processing your data? The organization’s legitimate interest, in application of article 6.1.f) of Regulation (EU) 679/2016, General Data Protection Regulation.
Recipients	Who will your data be shared with? Directly related Otua companies. Those required for compliance with legal obligations.
International Transfers	When are they made? They are not made.
Conservation	How long will we keep your data? Personal data will be kept until the interested party expresses their opposition or consent for handling is withdrawn, and in case of knowledge of a change in the public office or representation of public or private organizations or related or reference organizations.
Rights	What are your rights when you provide personal data? Interested parties have the right to obtain confirmation on whether the organisation is handling their personal data, access it, correct inaccurate data, and delete it when it is no longer needed for its original purpose. They can also limit processing or object to it. Interested parties can exercise their rights by emailing RGPD@grupo-otua.com and file a complaint with the Data Protection Agency if their rights are not satisfied.
Security	Data will be handled confidentially and under appropriate technical and organizational security measures to avoid unauthorized access, alteration, or loss.

INFORMATIONAL POLICY FOR PREVENTING WORKPLACE RISK

Controller	Who is the controller of your data? OTUA Postal address: C/ San Antolín, 10 - Pol. Industrial Goiain, 01170 Legutio (Álava) Spain Email address: RGPD@grupo-otua.com
Purpose	Why do we handle your data? To protect health and safety from risks derived from working conditions of our own employees, subcontractors, or outsourced workers, and to research workplace accidents.
Legal Basis	What is the legal basis for processing your data? Execution of an employment contract or internship and compliance with legal obligations arising from the contractual legal relationship, in application of articles 6.1.b) and 6.1.c) of Regulation (EU) 679/2016, General Data Protection Regulation. Execution of the legal relationship with subcontractors and their staff, and compliance with legal obligations, in application of articles 6.1.b) and 6.1.c) of Regulation (EU) 679/2016, General Data Protection Regulation.
Recipients	Who will your data be shared with? Directly related Otua companies, in application of article 6.1.f) of Regulation (EU) 679/2016, General Data Protection Regulation. Entities required for compliance with legal obligations, in application of article 6.1.c) of Regulation (EU) 679/2016, General Data Protection Regulation.
International Transfers	When are they made? They are not made.
Conservation	How long will we keep your data? Personal data will be kept for a maximum period of five years from the time it is saved on the subcontractor management platform, with the company managing the platform being responsible for conserving and deleting the data. Personal data about our own employees will be kept for the periods established by workplace risk prevention regulations, and will be blocked with restricted access once the work is finished.
Rights	What are your rights when you provide personal data? Interested parties have the right to obtain confirmation on whether the organisation is handling their personal data, access it, correct inaccurate data, and delete it when it is no longer needed for its original purpose. They can also limit processing or object to it. Interested parties can exercise their rights by emailing RGPD@grupo-otua.com and file a complaint with the Data Protection Agency if their rights are not satisfied.
Security	Data will be handled confidentially and under appropriate technical and organizational security measures to avoid unauthorized access, alteration, or loss.