Privacy Policy – EHER Green Chemical

Effective as of December 13, 2022

This Privacy Policy (hereinafter, the “PRIVACY POLICY”) generally governs the collection and processing by ELECTROQUÍMICA DE HERNANI, S.A. (hereinafter, “EHERSA”) of (i) the personal data you provide to us as a user of the website accessible via the domain name www.ehersa.com/es (hereinafter, the “WEBSITE”), including the services available at any given time through the WEBSITE, and (ii) other data collected through other data collection systems duly identified below. All of the foregoing is without prejudice to the specific provisions set forth in certain sections, forms, or services available on the WEBSITE for the purpose of providing you with relevant information and, where applicable, obtaining your consent.

EHERSA reserves the right to modify the PRIVACY POLICY to adapt it to new legislative, jurisprudential, and/or administrative developments, as well as to the practices it implements at any given time through the WEBSITE, always taking your rights and interests into account.

In any case, EHERSA will provide you with the appropriate technical resources so that you can access the PRIVACY POLICY in order to duly comply with the information obligations we are required to observe in accordance with applicable data protection regulations.

1. Who is responsible for processing your data?

The Data Controller for your data is ELECTROQUÍMICA DE HERNANI, S.A., a company with its registered office in Hernani (Gipuzkoa), Barrio Epele, No. 29, registered in the Gipuzkoa Commercial Registry in volume 1,094, folio 26, page SS-2,025, and with Tax ID No. A-20025672. For any questions regarding the PRIVACY POLICY and/or the processing of your personal data, you may contact us at the postal address indicated above and/or via the email address rgpd@ehersa.com.

2. How did we obtain your data?

The data we process at EHERSA has been obtained directly from you through (i) the various forms you fill out while browsing the WEBSITE; (ii) by sending an email inquiry; or (iii) through other duly identified data collection systems, such as the video surveillance system installed at our facilities and/or the visitor log available in the annex to these.

In the event that the personal data provided belongs to a third party, you guarantee that you have informed said third party of the PRIVACY POLICY and have obtained their authorization to provide their data to EHERSA for the purposes outlined below. Additionally, we inform you of the possible processing of your social media data through the corporate profiles that EHERSA maintains on each social media platform where it is present, all in accordance with the terms and conditions established by each platform.

3. What type of data do we process?

The data we process at EHERSA consists of the information you have provided while browsing the WEBSITE, through the appropriate forms we use to formalize our contact with you and/or via email, as well as any other data we may obtain through EHERSA’s corporate profiles on the social media platforms where we are active. Specifically, at EHERSA we process the following categories of data: Identification and contact information (first name, last name, ID number, vehicle registration number, mailing and email addresses, phone number, etc.). Professional data (company where you work, job title and responsibilities, professional mailing and email addresses, and work phone number) to the extent that (i) you provide them through the relevant forms; and (ii) they are necessary for your business contact and/or for maintaining our business relationship with you or EHERSA. Identification codes and passwords as a registered user of the WEBSITE and/or the applications accessible through it. Internet browsing data (e.g., IP address, website visits, Wi-Fi connections, etc.). Data regarding personal characteristics, education, employment, etc. (in the case of job applications/offers and/or EHERSA recruitment processes in which you voluntarily participate). Images captured by the video surveillance system installed at the entrances and inside our facilities.

4. For what purpose do we process your data and on what legal basis?

The processing of your personal data serves the following purposes: To manage and process your registration as a user of the WEBSITE, where possible, based on your request for pre-contractual measures or the contractual relationship established with you in this regard. To manage your access to and use of the content and services that EHERSA makes available to you through the WEBSITE, including blog services, social media, or any other features that may be accessible from the WEBSITE at any given time, based on your request for pre-contractual measures or the contractual relationship established with you in this regard. Process and manage requests for information, suggestions, complaints, or claims you submit via the WEBSITE or email, based on your request for pre-contractual measures or the contractual relationship established with you. Manage your job application or your registration for a job opening and your participation in the corresponding selection process, based on your request for pre-contractual measures. To manage and monitor visits to EHERSA’s facilities by personnel from outside the organization, based on EHERSA’s legitimate interest (security). To ensure the safety and security of people and property by capturing images through the video surveillance system installed at the entrances and inside our facilities, based on EHERSA’s legitimate interest (security). To process and manage suggestions submitted through the suggestion box, based on EHERSA’s legitimate interest (quality). We remind you that, in cases where processing is based on your consent, you may freely revoke it at no cost at any time, under the terms indicated in Section 7 below.

5. To whom do we disclose your data?

Except in cases where EHERSA is legally required to do so (e.g., tax authorities, the judiciary, or other public administrations), your data will not be disclosed to third parties. No international transfers of your data are planned.

6. How long will we retain your data?

Generally speaking, personal data will be retained as long as you do not revoke your consent to processing or request its deletion, as well as for the time necessary to comply with the legal obligations that EHERSA must observe. In any case, we inform you that EHERSA has established internal data purging policies designed to control the retention periods for the personal data in its possession; therefore, such data may be deleted when it is no longer necessary and/or appropriate for the purpose for which it was collected. In particular, the following is hereby stated: With regard to the video surveillance system installed at our facilities, it is hereby stated that the captured images will be deleted within a maximum period of one month. With regard to the visitor log, it is hereby stated that the data will be deleted within a maximum period of one month. With regard to the ADR transport log, it is hereby stated that the data will be deleted within a maximum period of one year. With regard to the management of job applications, it is hereby stated that identifying and contact information, personal characteristics, academic and professional data, job details, and images will be deleted within a maximum period of one year.

7. What are your rights?

Applicable data protection regulations grant you a series of rights regarding your personal data that you may exercise during the processing thereof. These rights are as follows: Access to your data: you have the right to access your data to find out what personal data concerning you we are processing. Requesting the rectification or erasure of your data: under certain circumstances, you have the right to request the rectification of any inaccurate personal data concerning you that we are processing, or even to request its erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected. Requesting the restriction of the processing of your data: under certain circumstances, you have the right to request that we restrict the processing of your data; in such cases, we inform you that we will retain it solely for the exercise or defense of legal claims, as provided by applicable data protection regulations. Data portability: Under certain circumstances, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and to transmit it to another data controller. Object to the processing of your data: under certain circumstances and for reasons related to your particular situation, you have the right to object to the processing of your data; in such cases, we will cease processing them unless, for compelling legitimate reasons, or for the exercise or defense of potential claims, they must be retained. Likewise, in cases where processing is based on your consent, you have the right to withdraw your consent at any time, without this affecting the lawfulness of the processing based on consent prior to its withdrawal. You may exercise these rights by sending a written request to EHERSA at the postal address indicated in Section 1 or by sending an email to rgpd@ehersa.com. Finally, please note that you may file a complaint with the competent Supervisory Authority (in Spain, the Spanish Data Protection Agency), particularly if you have not received a satisfactory response regarding the exercise of your rights. You may contact this Authority through its website: www.aepd.es.

8. Security Measures

EHERSA will treat your data at all times with absolute confidentiality and will uphold the mandatory duty of secrecy regarding such data, in accordance with the provisions of applicable data protection regulations, adopting for this purpose the necessary technical and organizational measures to ensure the security of your data and prevent its alteration, loss, unauthorized processing, or access, taking into account the state of technology, the nature of the stored data, and the risks to which they are exposed.

9. Cookie Policy

Additionally, please note that EHERSA has established a Cookie Policy, which is accessible via the following link.