1.- Object and scope of application.

Ibáñez Industrial, S.A. (hereinafter IBINSA), in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), hereby presents this Policy regarding the processing of personal data.

This Policy applies to:

• Users who visit the IBINSA website (http://www.ibinsa.com/).
• Those who voluntarily contact IBINSA through email, chat, or by completing one of the data collection forms published on the IBINSA website.
• Individuals requesting information about IBINSA's services or expressing interest in participating in its commercial activities.
• Individuals contracting IBINSA's services and formalizing the corresponding contractual relationship.
• Users of any other service available on the website http://www.ibinsa.com/ that involves the communication of personal data to IBINSA or access to data by IBINSA to provide its services.
• Any other individuals who provide explicit consent, directly or indirectly, for IBINSA to process their data for any of the purposes indicated in this Policy.

The user and/or client is responsible for the accuracy of the data provided, committing to ensuring that it is true and up-to-date. They may not use another person's identity or disclose their personal data unless they have legally valid authorization to do so. In this regard, the user and/or client shall be solely responsible for any direct and/or indirect damage caused to third parties or to IBINSA by the use of personal data of another data subject without their prior consent, or by using their own personal data if such data is false, inaccurate, outdated, or inadequate. The user and/or client who communicates the personal data of a third party shall be responsible for obtaining the consent of the data subject concerned, as well as for the consequences otherwise.

The user and/or client who communicates personal data to IBINSA confirms that they are of legal age under Spanish law and should not provide data to IBINSA otherwise. Any data provided by a minor will require the prior consent or authorization of their parents, guardians, or legal representatives, who shall be responsible for the personal data provided by minors under their care.

This Policy shall apply subsidiarily in relation to other conditions on the collection or processing of personal data that may be established on a special basis and communicated through registration forms or specific service contracts, complementing those conditions where they are not expressly provided herein.

The use of IBINSA's services requires the express acceptance of this data protection policy.

2- Purposes of data collection and processing by IBINSA.

IBINSA has various files where it collects and stores personal data communicated to it as the data controller. The purposes of the collection and processing of personal data by IBINSA are as follows:

• Regarding "cookies" used by IBINSA during navigation of its website http://www.ibinsa.com/ and stored on the user's equipment (computer or mobile device), they collect information about these visits. The purpose is to improve the usability of the website, facilitate navigation, understand the browsing habits and needs of users to adapt to them, and obtain information for statistical purposes. For users who are IBINSA clients, the information collected through cookies also serves to identify them when accessing the tools IBINSA provides for managing contracted services. Users can configure their browser to be notified when receiving "cookies" or to prevent their reception. If the user decides to withdraw consent for receiving cookies after granting it, they must delete all those stored on their equipment and configure the options in the different browsers accordingly. Navigation of the IBINSA website is possible after disabling cookie collection, although the use of some services may be limited. Interested parties can find more information in IBINSA's Cookie Policy, published at https://www.ibinsa.com/cookies.
• In the event that individuals complete any of IBINSA's forms to participate in its commercial activities, the purpose will be participation in these activities and the sending of advertising information about IBINSA's services unless the individual expressly opposes when their data is collected. In any case, the individual may change their option regarding the receipt of commercial information at any time through the means available on IBINSA.
• The purpose of collecting and processing data in cases where an email is sent to IBINSA or personal data is communicated through any other means (such as a contact form published on http://www.ibinsa.com) is to respond to inquiries, doubts, and requests for information about IBINSA and its services.
• Regarding the contracting of IBINSA's services, the data collected will be limited to the personal data necessary to establish the contractual relationship with the client and enable the provision of services. The purposes for which such data will be collected and processed are as follows:
  • Maintenance of the contractual relationship according to the nature of the contracted services, which is the main purpose, allowing IBINSA to contact the client via email, telephone, or any other means indicated by the client.
  • To enable the sending of documentation and information related to the contracted services and for the sending of commercial communications whose object is said services or similar ones, via email, postal mail, telephone, SMS, or any other means indicated by the client, unless the client expressly opposes during the contracting process. Regardless of the option chosen by the client during the contracting process, the client may modify their decision at any time by contacting IBINSA.
  • Maintenance of historical records of IBINSA's commercial relationships for the legally established periods.
  • In cases where IBINSA accesses or processes personal data for which the client is responsible or processor, IBINSA will act as a processor as provided for in Art. 28 of the GDPR. The section "IBINSA as data processor" in this Policy provides further information in this regard.

3- Recipients of the data.

The recipients of the personal data collected by IBINSA will be:

• Those IBINSA suppliers who participate in the provision of services, if necessary to enable them.
• The State Security Forces and Bodies, as well as judicial or administrative bodies, if IBINSA's collaboration is required to provide information related to its clients or services, in accordance with the Law.
• Any others necessary to enable the provision of each specific service, with the necessary information provided in IBINSA's service contracts, which are expressly accepted by clients.

4.- Data retention period.

IBINSA will retain personal data for as long as strictly necessary to fulfill the purposes set out in this Policy, keeping such data duly blocked during the period in which liabilities may arise from its relationship with clients.

Regarding data subject to retention in accordance with Law 25/2007, of October 18, on the retention of data related to electronic communications and public communication networks, the retention period will be as detailed in that regulation.

5.- Rights of users.

Users' rights regarding the collection and processing of data by IBINSA are as follows, recognized by the GDPR:

• Right of access: Users have the right to request and obtain information from IBINSA about their personal data, to access it, and to obtain information about its processing.
• Right to obtain a copy of their personal data.
• Right to erasure: Users can request the deletion of data when it is no longer necessary for the purpose for which it was provided or if other circumstances under the GDPR apply.
• Right to rectification: If their data is incorrect or incomplete, users have the right to request its correction.
• Right to restriction of processing: In cases provided for in Article 18 of the GDPR, users have the right to request that the processing of their personal data be restricted, so that processing operations are not applied to them.
• Right to data portability: Users have the right to receive their personal data that concerns them in a structured, commonly used, and machine-readable format, provided that such data was provided by them to IBINSA and is necessary exclusively for them.

For the exercise of their rights, both non-client users and clients of IBINSA have at their disposal the email address ibinsa@ibinsa.com, where they can send an email to exercise their rights. They can also do so by submitting a request accompanied by their ID card or valid document proving their identity, addressed to the Commercial Department of IBISNA, C/A, 6, Polígono Industrial La Baileta, 08348 Cabrils (Barcelona) Spain, specifying the right they wish to exercise.

IBINSA reserves the right to charge a fee for administrative costs arising from manifestly unfounded or excessive requests due to their repetitive nature, as well as the right to refuse to act on such requests, in accordance with Article 12.5 of the GDPR.

6.- International transfers.

In the case of IBINSA services that require international transfers to enable their provision, this circumstance will be indicated in the contract corresponding to the specific service contracted by the client and expressly accepted by them prior to its execution.

7.- Supervisory authority.

If users consider that the processing of their personal data has not been carried out in accordance with current legislation, they may communicate this to the supervisory authority corresponding in each case. In Spain, the supervisory authority is the Spanish Data Protection Agency, whose contact details are published at http://www.agpd.es/portalwebAGPD/CanalDelCiudadano/contacteciudadano/index-ides-idphp.php

8.- IBINSA as data processor.

Regarding personal data for which the client acts as controller or processor, IBINSA will process such data in accordance with Article 28 of the GDPR and related regulations, when necessary for the provision of contracted services. In such cases, IBINSA will act as a data processor, under the conditions specified below:

• IBINSA will process such data according to the instructions of the client acting as data controller or processor, not using it for any purpose other than that set forth in this Policy and/or the applicable contractual conditions.
• Once the provision of services involving the processing of personal data is completed, they will be destroyed, as well as any media or documents containing personal data or any information generated during, for, or by the provision of services. However, IBINSA may keep such data duly blocked during the period in which liabilities could arise from its relationship with the client.
• Under Article 28 of the GDPR, IBINSA will maintain due professional secrecy regarding personal data to which it has access and/or processes in order to comply in each case with the purpose of the service contract applicable to it, both during and after its termination, committing to use such information only for the purpose intended in each case and requiring the same level of commitment from any person within its organization involved in any phase of the processing of personal data for which the client is responsible.
• In the event that IBINSA uses the data for another purpose, or communicates or uses it in violation of this Policy or its corresponding contractual conditions, it will be considered the data controller.
• Without prejudice to specific legal or regulatory provisions applicable in each case or measures adopted by IBINSA on its own initiative, access to and processing of personal data by IBINSA will be subject to the necessary security measures to:
• Ensure the permanent confidentiality, integrity, availability, and resilience of processing systems and services.
• Restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
• Regularly verify, assess, and evaluate the effectiveness of the technical and organizational measures implemented to ensure the security of processing.
• Pseudonymize and encrypt personal data, as appropriate.
• The client authorizes IBINSA, acting as data processor, to subcontract with third parties on behalf and for the account of the client, for storage services, custody of data backup copies, and security services, as well as those necessary to enable the provision of contracted services, always respecting the obligations imposed by the GDPR. The client may contact IBINSA at any time to know the identity of the subcontracted entities for the provision of such services, which will act in accordance with the terms set forth in this document and after formalizing with IBINSA a data processing agreement in accordance with Article 28.4 of the GDPR.
• The client authorizes IBINSA to perform the following actions, to the extent necessary for the execution of the provision of services, with such authorization limited to the action(s) necessary to provide the service and for a duration linked to the applicable contractual conditions:
• To process personal data on portable devices only by users or user profiles assigned to the provision of services.
• To process data outside the premises of the client or IBINSA, only by users or user profiles assigned to the provision of services.
• To handle the entry and exit of media and documents containing personal data, including those forming part of or attached to an email, outside the premises under the control of the client responsible for processing.
• To execute data recovery procedures that IBINSA is obliged to perform.
• IBINSA is not responsible for breaches of GDPR obligations or relevant data protection regulations by the user and/or client to the extent related to the execution of the contract or commercial relationships linking them to IBINSA. Each party shall bear the responsibilities arising from its own breach of contractual obligations and applicable regulations.

9.- Data of the data controller.

Company name: IBAÑEZ INDUSTRIAL, S.A.

VAT number: A58135013

Registered address: C/A, 6 - Pol.Ind. La Baileta - 08348 Cabrils - Spain

ibinsa@ibinsa.com

10.- Contact details of the Data Protection Officer:

ibinsa@ibinsa.com