PRIVACY POLICY

INDUSTRIAL CARROCERA ARBUCIENSE, S.A. (hereinafter INDCAR) works to offer you the best possible experience through its products and services. In some cases, it is necessary to collect information to achieve this. We care about your privacy and we believe we should be transparent about it.

For this reason, and in compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, “RGPD”) regarding the protection of natural persons concerning the processing of personal data and the free circulation of these data, and LAW 34/2002, of July 11, on Services of the Information Society and Electronic Commerce (hereinafter, “LSSI”), INDCAR informs the user that, as data controller, will incorporate the personal data provided by users in an automated file.

Our commitment begins by explaining the following:

• Your data is collected so that the user experience improves, according to your interests and needs.

• We are transparent regarding the data we collect about you and why we collect it.

• Our intention is to offer you the best possible experience. Therefore, when we are going to use your personal information, we will always do it in compliance with the regulations, and when necessary, we will request your consent.

• We understand that your data belongs to you. Therefore, if you decide not to authorize us to process it, you can ask us to stop processing it.

• Our priority is to guarantee your security and treat your data in accordance with European regulations.

If you wish to obtain more information about the processing of your data, consult the different sections of the privacy policy below.:

Who is responsible for the processing of your personal data?

Company name: INDUSTRIAL CARROCERA ARBUCIENSE, S.A.

Trade name: INDCAR

Registered office: Pol.Ind.Torres Pujals, 4 – 17401 – Arbúcies (Girona)

TIN: A17227935

e-mail: protecciondedatos@indcar.es

INDCAR has designated an internal contact person as adaptation coordinator within its organization. If you wish to make a query regarding the processing of your personal data, you can contact him/her at protecciondedatos@indcar.es

What personal data we collect?

The personal data that the user may provide:

• Name, address and date of birth.

• Telephone number and email address.

• Location.

• Information regarding payments and returns.

• IP address, date and time you accessed our services, internet browser you use and data about the device’s operating system.

• Curriculum Vitae (CV) data of job candidates.

• Any other information or data you choose to share with us.

In some cases, it is mandatory to fill in the registration form to access and enjoy certain services offered on the web; Likewise, not providing the requested personal data or not accepting this data protection policy means that it is impossible to subscribe, register or participate in any of the promotions where personal data is requested.

Why and for what purpose do we process your data?

At INDCAR we process the information provided by interested persons for the following purposes:

• Manage the contracting of any of our services.

• Manage the sending of information requested from us.

• Manage the data provided by job candidates through their Curriculum Vitae (CV) with the sole purpose of completing the personnel selection process.

• Develop commercial actions and carry out the maintenance and management of the relationship with the user, as well as the management of the services offered through the website and the information tasks, being able to carry out automatic evaluations, obtaining profiles and segmentation tasks of the clients in order to personalize the treatment according to their characteristics and needs and improve the client’s online experience. Develop and manage contests, raffles or other promotional activities that may be organized.

• In some cases, it will be necessary to provide information to the Authorities or third-party companies for audit purposes, as well as to handle personal data from invoices, contracts and documents to respond to claims from clients or Public Administrations.

We inform you that the personal data obtained as a result of your registration as a user will form part of the Registry of Treatment Activities and Operations (RAT), which will be updated periodically in accordance with the provisions of the GDPR.

What is the legitimacy for the processing of your data?

The processing of your data can be based on the following legal bases:

• Consent of the interested party for contact forms, requests for information or registration to newsletters.

• Execution of a contract for services and products or personnel in the labour field.

• Legitimate interest for the treatment of our clients’ data in direct marketing actions and express consent of the interested party for everything related to automatic evaluations and profiling.

• Compliance with legal obligations for fraud prevention, communication with public Authorities and third-party claims.

How long do we keep your data?

The processing of the data for the purposes described will be maintained for the time necessary to fulfil the purpose of its collection, for the duration of the commercial relationship, as well as for compliance with the legal obligations arising from the processing of the data.

The time of conservation of the CVs of the candidates for personnel selection processes, not selected, will be one year from the receipt of the same.

To which recipients are your data communicated?

In some cases, only when necessary, INDCAR will provide user data to third parties. However, the data will never be sold to third parties. The external service providers (for example, payment providers or delivery companies) with which INDCAR works may use the data to provide the corresponding services, however, they will not use said information for their own purposes or for assignment to third parties.

INDCAR seeks to guarantee the security of personal data when it is sent outside the company and ensures that third-party service providers respect confidentiality and have adequate measures in place to protect personal data. Said third parties have the obligation to guarantee that the information is treated in accordance with the data privacy regulations.

In some cases, the law may require personal data to be disclosed to public bodies or other parties and only what is strictly necessary to comply with such legal obligations will be disclosed.

The personal data obtained may also be shared with other current or future INDCAR companies.

Where is your data stored?

In general, the data is stored within the EU. As regards the data that is sent to third parties that do not belong to the EU, we will ensure that they offer a sufficient level of protection, either because they have Binding Corporate Regulations (BCR) or because they have adhered to the “Privacy Shield” or to the agreement that is in force at any time.

What rights do you have and how can you exercise them?

You can direct your communications and exercise your rights through a request to the following email protecciondedatos@indcar.es

By virtue of what is established in the GDPR, you can request:

• Right of access: you can request information about the personal data that we have about you.

• Right of rectification: you can communicate any change in your personal data.

• Right of deletion and to be forgotten: you can request the deletion after blocking the personal data.

• Right to limit processing: implies the restriction of the processing of personal data.

• Right of opposition: you can withdraw your consent to data processing, opposing the further processing.

• Right to portability: in some cases, you can request a copy of the personal data in a structured, commonly used and machine-readable format for transmission to another controller.

• Right not to be subject to individualized decisions: you can request not be made decisions that are based solely on automated processing, including profiling, that produce legal effects or significantly affect the interested party.

In some cases, the request may be rejected if you request the deletion of data necessary to comply with legal obligations.

Likewise, if you have any complaints about the processing of your data, you can file a claim with the data protection authority.

Who is responsible for the accuracy and veracity of the data provided?

The user is solely responsible for the veracity and correctness of the data included, exonerating INDCAR from any responsibility in this regard. Users guarantee and are responsible, in any case, for the accuracy, validity and authenticity of the personal data provided, and undertake to keep it duly updated. The user agrees to provide complete and correct information in the registration or subscription form. INDCAR reserves the right to terminate the services contracted by the users, in the event that the data provided is false, incomplete, inaccurate or out of date.

INDCAR is not responsible for the veracity of the information that is not drafted by the company and for the data where another source is indicated, reason why it does not assume any responsibility regarding hypothetical damages that could be caused by the use of said information.

INDCAR reserves the right to update, modify or eliminate the information contained in its web pages and may even limit or deny access to said information. INDCAR is exonerated from responsibility for any damage or harm that the user may suffer as a result of errors, defects or omissions, in the information provided by INDCAR provided that it comes from sources unrelated to it.

Likewise, the users certify that they are over 14 years of age and that they have the necessary legal capacity to provide consent regarding the processing of their personal data.

How do we treat the personal data of minors?

In principle, our products or services are not for minors. However, in the event that any of them is addressed to minors under fourteen years of age, in accordance with article 8 of the GDPR and article 7 of LO 3/2018, of December 5 (LOPDGDD), INDCAR will require the valid, free, unequivocal, specific and informed consent of their legal guardians to process the personal data of minors. In this case, the ID card or another form of identification of the person providing the consent will be required.

In the case of persons over fourteen years of age, the data may be processed with the consent of the user, except for those cases in which the Law requires the assistance of the holders of parental authority or guardianship.

What security measures do we apply to protect your personal data?

INDCAR has adopted the security levels for the protection of Personal Data legally required, and seeks to install other means and additional technical measures at its disposal to prevent the loss, misuse, alteration, unauthorized access and theft of Personal Data provided to INDCAR.

INDCAR is not responsible for hypothetical damages or losses that could be derived from interferences, omissions, interruptions, computer viruses, telephone breakdowns or disconnections in the operation of this electronic system, due to causes beyond INDCAR’s control; of delays or blockages in the use of this electronic system caused by deficiencies or overloads of telephone lines or overloads in the Data Processing Center, in the Internet system or in other electronic systems, as well as damages that may be caused by third parties through illegitimate interference beyond INDCAR’s control. However, the user must be aware that Internet security measures are not impregnable.

Links to other websites

On the website https://indcar.es/ there may be links to other web pages. By clicking on one of these links and accessing an external website, the visit will be subject to the privacy policy of said website, exonerating INDCAR of any type of responsibility regarding its privacy policy.

How do we use cookies?

The INDCAR website and RRSS use cookies for the purpose of optimizing and personalizing your browsing through it. Cookies are physical information files that are stored in the user’s own terminal, the information collected through cookies serves to facilitate the user’s browsing through the portal and optimize the browsing experience. The data collected through cookies can be shared with their creators, but in no case will the information obtained by them be associated with personal data or data that can identify the user.

However, if the users do not want cookies to be installed on their hard drive, they have the possibility of configuring the browser in such a way that it prevents the installation of these files. For more information see our Cookies Policy https://indcar.es/politica-cookies/

Can the privacy policy be modified?

This privacy policy can be modified. We recommend that you review the privacy policy periodically.