Privacy Policy

The Privacy Policy forms part of the General Terms and Conditions governing this Website.

Who is responsible for the processing of your data?

GRUPO HAFESA SUMINISTROS ENERGÉTICOS, S.L.

Tax ID: B95840583

Address: Calle Orense 34, Edificio Norte, Planta 1ª izquierda, 28020 Madrid, Spain.

Telephone: +34 917 839 410.

Data Protection Officer: rgpd@grupohafesa.com

We reserve the right to modify or update this Privacy Policy at any time. We recommend reviewing it periodically in order to stay informed.

If you belong to any of the following categories, please consult the relevant information below:

 

WEBSITE OR EMAIL CONTACTS

What data do we collect through the Website?

If you provide us with information via the contact form, we will process your identification and contact details, as well as any other information you may share with us through the form. Additionally, we may process your IP address, the operating system or browser you use, and the duration of your visit, in a pseudonymized manner.

For what purposes will we process your personal data?

  • To manage the requested service, respond to your inquiry, or process your request.

  • To send commercial or event-related information by electronic means.

  • To conduct analysis and improvements on the Website.

What is the legal basis for processing your data?

The user’s consent or the existence of a contractual relationship between the parties.

How long will we retain your personal data?

For as long as you remain associated with us or until you exercise a right that requires the deletion of your data.

NEWSLETTER CONTACTS

What data do we collect through the Newsletter?

Identification data (first and last name) and contact information (email address).

For what purposes will we process your personal data?

To periodically send news, promotions, and other relevant information.

What is the legal basis for processing your data?

Your consent.

How long will we retain your personal data?

Until the consent granted is withdrawn, which may be done at any time with no retroactive effect.

JOB APPLICANTS

What personal data do we process?

We will process the data you share with us during the recruitment process or as part of a spontaneous application. Typically, we will process your identification and contact details, as well as information regarding your professional and/or academic background.

For what purposes will we process your personal data?

  • To organize recruitment processes for employee hiring.

  • To schedule job interviews and assess your application.

What is the legal basis for processing your data?

The legal basis for processing is the necessity of such processing for the execution of an employment contract, with the recruitment process constituting a pre-contractual measure.

How long will we retain your personal data?

Until the conclusion of the recruitment process and, in any case, for a maximum period of one (1) year.

WHISTLEBLOWER CHANNEL

What data will we process?

If you choose to identify yourself, we may process the following data: your first name, last name, email address, telephone number, and any personal data of third parties that you provide in your report.

For what purposes will we process your personal data?

  • To manage the communications received.

  • To adopt the appropriate corrective measures.

  • To inform you of the outcome of the procedure, if necessary.

What is the legal basis for processing your data?

The legal basis is compliance with a legal obligation or, where applicable, the performance of a task carried out in the public interest.

How long will we retain your personal data?

Data will be retained only for the time strictly necessary to clarify the facts reported. In any case, after six (6) months the data provided will be anonymized, unless the matter is subject to investigation within a different legal framework.

ADDITIONAL INFORMATION ON THE PROCESSING OF YOUR DATA

Do we process personal data of third parties?

As a general rule, we only process data provided directly by the data subjects. If you provide us with data relating to third parties, you must inform them beforehand and obtain their consent. Otherwise, you shall be solely responsible for any failure to comply with this requirement.

Do we process data of minors?

We do not process data of individuals under the age of 14. Therefore, please refrain from providing such data if you are under this age, or from submitting data relating to third parties who do not meet this age requirement. HAFESA assumes no liability for failure to comply with this provision.

What security measures do we apply?

Rest assured: We have implemented an optimal level of protection for the personal data we handle and have put in place all technical and organizational measures available to us, in accordance with the state of the art, to prevent loss, misuse, alteration, unauthorized access, and theft.

To whom will your data be disclosed?

Your data will not be disclosed to third parties, except where there is a legal obligation to do so. Notwithstanding the foregoing, your data may be communicated to the Spanish Tax Agency (Agencia Estatal de la Administración Tributaria) and to banks and financial institutions for the collection of payment for the services rendered or products purchased, as well as to data processors required for the execution of the agreement. In such cases, we will enter into the corresponding data processing agreements in accordance with Article 28 of the GDPR.

What are your rights?

  • To access your personal data.

  • To request the rectification of your data if it is inaccurate.

  • To request the erasure of your data.

  • To withdraw any previously granted consents.

  • To request the restriction of the processing of your data.

  • Not to be subject to automated decision-making.

  • To data portability, meaning you have the right to receive your data in a structured, commonly used, and machine-readable format.

  • To lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at www.aepd.es.

If any of your personal data changes, we kindly ask that you notify us so we can keep it up to date.

How can you exercise your rights?

We have forms available to exercise your rights; you can request them by email or, if you prefer, use the forms provided by the Spanish Data Protection Agency or third parties.
The forms can be submitted in person, sent by mail, or by email to rgpd@grupohafesa.com, which is available at the beginning of this document.
If there is reasonable doubt regarding your identity, we will be obliged to request identification in order to process your request.

How long does it take to respond to the exercise of rights?

We will respond within one (1) month from receipt of the request, extendable by an additional two (2) months if the request is complex. In such cases, we will notify you within the initial one-month period.

Do we process cookies?

If we use cookies other than those strictly necessary, you may consult our Cookies Policy via the corresponding link available on the homepage of our website.