Privacy Policy

PRIVACY POLICY

In accordance with the provisions of current data protection legislation, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the GDPR), as well as Organic Law 3/2018 of 5 December on Data Protection and the Guarantee of Digital Rights (hereinafter, LOPD-GDD), the user is hereby informed in accordance with the provisions of Article 13 of the GDPR and Article 11 of the LOPD-GDD:

I. MANAGER

Who is the data controller for your personal data?

– Company name:: ASC GRUPO ERSI SLU

– CIF: B83364570

– Address: AVD. DE CASTILLA, 2 KUDOS, EDF. HUNGRÍA, PL. 2, ESC. B – 28830, SAN FERNANDO DE HENARES, MADRID

– Email: GDPR@ERSIGROUP.COM

– Website: WWW.ERSIGROUP.COM

II. PURPOSE

For what purpose will we process your personal data?

ASC GRUPO ERSI SLU processes your data for the following purposes:

– Mantenimiento de la relación mercantil y prestación del servicio contratado

– Realización de un presupuesto ajustado a sus necesidades

– Gestionar comunicaciones por correo electrónico con interesados

– Llevar a cabo los procesos de selección de la sociedad

– Gestión de los empleados y recursos humanos de la sociedad

– Envío de información comercial vinculada con nuestro sector

How long will we keep your data?

The personal data you provide to us will be retained for as long as the business relationship remains in force. However, to ensure maximum transparency with you, we would like to point out that the general timeframes we work with are:

– General identification data (email address, first name, surname, telephone number, etc.): for the duration of the business relationship or until consent is withdrawn. In any event, such data will be deleted when it is no longer to be used for the purpose for which it was collected

– Law on Offences and Penalties in the Social Security System (obligations relating to registration, enrolment, deregistration, contributions, payment of wages, etc.); Articles 66 et seq. of the General Tax Law (accounting records, etc.): four (4) years

– Personal actions with no specific limitation period (Article 1964 of the Civil Code): five (5) years

– Accounting, tax and employment matters (Article 30 of the Commercial Code – accounting records, invoices, etc.): six (6) years

– Employment: contracts, records of working hours, payslips and social security contributions, identification documents – four (4) years; in the case of occupational health and safety reports, records of illness or accidents, and contracts with occupational health and safety service providers – five (5) years

– Data subject to the Law on the Prevention of Money Laundering and Terrorist Financing (Article 25): ten (10) years

– Recruitment processes: two (2) years from the date of submission of the CV

– Furthermore, as regards the sending of commercial information, even if the relationship between the parties comes to an end, the data controller will continue to retain your information for the purpose of sending newsletters relating to our products and services[1]. You may always exercise the rights granted to you under current legislation by contacting us via the method that is most convenient for you

– Disaggregated and anonymised data: no deadline

Notwithstanding these general time limits, we would like to inform you that we will periodically review our systems in order to delete any data that is not legally required

III. LEGITIMACY

What is the legal basis for the processing of your data?

Depending on the purposes for which your data is collected, the processing of your data is necessary:

– To manage the commercial relationship you have entered into and agreed with us
Performance of a contract (pursuant to Article 6(1)(b) of the GDPR)
Consent of the data subject (pursuant to Article 6(1)(a) of the GDPR)

– Preparation of a quotation tailored to your needs.
Performance of a contract and/or pre-contractual relationship (pursuant to Article 6(1)(b) of the GDPR)

– Managing email communications with data subjects
Consent of the data subject (pursuant to Article 6(1)(a) of the GDPR)
Legitimate interest (pursuant to Article 6(1)(f) of the GDPR)

– To carry out the company’s recruitment processes.
Consent of the data subject (as provided for in Article 6(1)(a) of the GDPR)

– Management of the company’s employees and internal human resources
Performance of a contract (pursuant to Article 6(1)(b) of the GDPR)

– Sending commercial communications
Consent of the data subject (pursuant to Article 6(1) of the GDPR)
Consent of the data subject (pursuant to Article 20 of the LSSICE)
Legitimate interest (pursuant to Article 6(1)(f) of the GDPR and Article 21(2) of the LSSICE)

Furthermore, all the data collected is necessary for the provision of the service. However, any data marked with an asterisk (*) is mandatory. Should the mandatory data not be provided, the data controller will be unable to provide the contracted service

Finally, please note that only persons aged 14 or over may provide personal data on this website. In accordance with the LOPD and GDD, in the case of children under the age of 14, the consent of their parents or guardians is required before we can process their personal data

Furthermore, only persons aged 18 or over may contract our services. In the case of persons under the age of 18, the consent of their parents or legal guardians is a mandatory requirement for us to be able to provide the services on offer, unless the minor has been emancipated

IV. RIGHTS OF DATA SUBJECTS

What rights do I have regarding data protection?

In accordance with the provisions of Article 13 of the GDPR and Article 11.2.c) of the LOPDGDD, you may exercise any of the following rights by writing to us at the postal address AVD. DE CASTILLA, 2 KUDOS, EDF. HUNGRÍA, PL. 2, ESC. B – 28830, SAN FERNANDO DE HENARES, MADRID or by email to GDPR@ERSIGROUP.COM. In any event, in accordance with current legislation, you are entitled to the following rights as set out in Articles 15 to 22 of the GDPR and Articles 12 to 18 of the LOPDGDD:

– Right to request access to personal data relating to the data subject

– Right to request the rectification or erasure of your personal data

– Right to request restriction of processing

– Right to object to processing

– Right to data portability

You may request the forms required to exercise your rights from the Data Controller via the email address provided in the Data Controller’s contact details. In addition, you may lodge a complaint with the Spanish Data Protection Agency (AEPD). Further information can be found in Section VII of this document

V. TARGET AUDIENCE

To whom will your data be disclosed?

You will always be informed and, where applicable, your express consent will be sought before your personal data is disclosed or transferred internationally, in accordance with current legislation (Articles 13(1)(e) and 44 of the GDPR, as well as Articles 11(1) and 40 of Law 3/2018 on the Protection of Personal Data and Children’s Rights). We therefore inform you that the third parties with whom the Data Controller works have their servers located within the EU, the EEA or Switzerland, and have adequate security measures in place to ensure that data is processed appropriately and confidentially

Apart from the cases mentioned above and unless required by law, your data will not be transferred or disclosed to any third party, except in cases provided for by law or where it is strictly necessary for the provision of a service. In general, data may be transferred to:

– Technology service providers

– Payment service providers

– Third parties or intermediaries, acting as service providers, who operate on our behalf (administrative agencies, consultancy firms, self-employed contractors, etc.)

– Third-party data processors, partners or parties with a close commercial relationship with the data controller, for the sole purpose of providing our services

– Where necessary for the provision of our services, subject to prior notification and consent, your data may be processed by our overseas branches

Any transfer of data will be carried out in strict confidence, using the necessary measures, such as the signing of confidentiality agreements or adherence to the privacy policies set out on their respective websites. The User (a term defined to refer to the natural or legal person who uses or browses the website published under the domain name WWW.ERSIGROUP.COM) may object to the transfer of their data to Data Processors by means of a written request, using any of the methods referred to above. The data controller shall not transfer or disclose your data to any third party, except in cases provided for by law or where the provision of a service requires a contractual relationship with a data processor. Accordingly, the User accepts that some of the personal data collected may be provided to these Data Processors (payment platforms, accountancy firms, intermediaries, etc.), where necessary for the effective provision of a contracted service or purchased product. The User also accepts that, in the case of the provision of services, these may be, in whole or in part, subcontracted to other individuals or companies, who shall be regarded as Data Processors, with whom the relevant confidentiality agreement has been entered into, or who have adhered to their privacy policies, as set out on their respective websites. The User may object to the transfer of their data to Data Processors by submitting a written request via any of the means referred to above

VI. SOURCE OF YOUR DATA

How did we obtain your data?

The personal data processed by ASC GRUPO ERSI SLU is provided by the data subject themselves, thereby complying with the provisions of Articles 13 of the GDPR and 11 of the LOPDGDD, as mentioned above, or is obtained from group companies or partners; further information regarding these can be obtained by writing to the email address GDPR@ERSIGROUP.COM or by contacting the Data Controller’s office at the postal address indicated in this document

What categories of data do we process?

The categories of personal data processed:

Identification details

-Name

-Surnames

-DNI / NIE / Passport or equivalent document

-Postal addresses

-Email addresses

-Sexo

-Date of birth

-Place of birth

-Contact telephone number (mobile / landline)

Información comercial: propia y de terceros
Datos económicos

-Número de cuenta bancaria

Curriculum vitae

– Datos académicos

– Titulaciones

– Aficiones

– Pertenencia a asociaciones o clubes

Videovigilancia

– Imagen

The processing of sensitive data shall be carried out in accordance with the provisions of Articles 9 of the GDPR and 9 of the LOPDGDD, and the data subject shall in all cases be informed of which data will be used by the data controller

VII. FURTHER INFORMATION

Security measures: Users of the data controller’s website are hereby informed that we have adopted all the security, technical and organisational measures within our power to prevent the loss, misuse, alteration, unauthorised access and theft of data, thereby guaranteeing the confidentiality, integrity and quality of the information contained therein, in accordance with the provisions of current data protection legislation. The personal data collected via the forms is processed solely by the data controller’s staff or by the designated data processors. The website also utilises SSL encryption, which enables users to securely submit their personal data via the website’s contact or registration forms.

Confidentiality: Any information provided by the User shall, in all circumstances, be treated as confidential and may not be used for any purposes other than those described herein. The data controller undertakes not to disclose or reveal any information regarding the User’s claims, the reasons for the advice sought or the duration of its relationship with the User

Accuracy of data: The User declares that all the data provided by them is true and correct and undertakes to keep it up to date. The User shall be liable for the accuracy of their data and shall be solely responsible for any disputes or litigation that may arise as a result of any inaccuracies therein. It is important that, to enable us to keep personal data up to date, the User informs the data controller whenever there has been any change to such data

Documentation prepared by LegalDPO (https://legaldpo.es/), based on information provided by the data controller. The content complies with the legislation in force in February 2025, but may vary in line with legislative changes or case-law criteria; it is the data controller’s responsibility to verify the current legal provisions at all times

VIII. SUPERVISORY AUTHORITY

We make every effort to comply with data protection regulations, as your data is our most valuable asset. However, we would like to inform you that should you feel that your rights have been infringed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), located at C/ Jorge Juan, 6, 28001 – Madrid. Further information on the AEPD: http://www.agpd.es/. Documentation prepared by LegalDPO: https://legaldpo.es/