Privacy

DATA CONTROLLER

The Data Controller is EUROPE EDUCATION SPORTS PARTNERS SL, CALLE PINTOR CABRERA, 22 ESC. B – 1 D, 03003, ALICANTE (ALICANTE).

Privacy Principles

At EUROPE EDUCATION SPORTS PARTNERS SL, we are committed to continuously working to guarantee privacy in the processing of your personal data and to provide you at all times with the most complete and transparent information possible. We encourage you to read this section carefully before providing us with your personal data.

If you are under fourteen years of age, please do not provide us with your data without the consent of your parents or legal guardians.

In this section, we inform you about how we process the data of individuals who have a relationship with our organisation. We begin with our principles:

We do not request personal information unless it is necessary to provide you with the services you request from us.
We never share personal information with anyone except where required by law or where we have your express authorisation.
We will never use your personal data for purposes other than those set out in this Privacy Policy.
Your data will always be processed with a level of protection compliant with data protection legislation, and we will not subject your data to automated decision-making.

This Privacy Policy has been drafted in accordance with the requirements of the current data protection legislation:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons (GDPR).
Organic Law 3/2018, of 5 December, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
Royal Decree 1720/2007, of 21 December (RLOPD).

Due to changes in processing criteria, for the sake of clarity or to adapt this policy to current legislation, we may modify this Privacy Policy. We recommend that you review it regularly.

Processing Activities We Carry Out

Employee Data Processing

Legal Basis:
GDPR: Article 6(1)(b) – Processing necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
GDPR: Article 6(1)(c) – Processing necessary for compliance with a legal obligation to which the controller is subject.
Royal Legislative Decree 2/2015, of 23 October, approving the revised text of the Workers’ Statute Law.

Purposes of Processing:

Management of employed personnel.
Personnel records. Time tracking. Training. Pension plans. Occupational risk prevention.
Payroll management.
Trade union activity management.

Data Subjects: Employees

Categories of Data:

Name and surname, ID number/Tax ID/Identification document, personnel registration number, Social Security/Mutual Society number, address, signature and telephone number.
Special categories of data: health data (sick leave, workplace accidents and degree of disability, excluding diagnoses), trade union membership data solely for the payment of union fees (where applicable), trade union representative status (where applicable), attendance records of the data subject and third parties.
Personal characteristics data: gender, marital status, nationality, age, date and place of birth, and family data. Family circumstances data: employment commencement and termination dates, licences, permits and authorisations.
Academic and professional data: qualifications, training and professional experience.
Employment details and administrative career data. Incompatibilities.
Attendance monitoring data: date/time of entry and exit, reason for absence.
Financial and insurance data: payroll financial data, credits, loans, guarantees, tax deductions, salary deductions relating to previous employment positions (where applicable), court-ordered deductions (where applicable), other deductions (where applicable). Banking details.

Categories of Recipients:

Occupational risk prevention service providers.
General Treasury of the Social Security.
Trade unions.
Financial institutions.
Spanish Tax Agency.
Main contractors to whom we provide services as subcontractors.

International Transfers: No international data transfers are envisaged.

Retention Period: Data will be retained for the period necessary to fulfil the purposes for which they were collected and to determine any potential liabilities arising from such purposes and the processing of the data.
Financial data related to this processing activity will be retained in accordance with Law 58/2003, of 17 December, General Taxation Law.

Security Measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Contact Data Processing

Legal Basis: Consent of the data subject.

Purposes of Processing: To respond to your request, send you information and follow up on your request.

Data Subjects: Contact persons, clients, suppliers.

Categories of Data: Name and surname, telephone number, email address.

Categories of Recipients: No disclosure of data to third parties is envisaged.

International Transfers: No international data transfers are envisaged.

Retention Period: Contact data will be retained indefinitely or until the data subject requests its deletion.

Security Measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Data Subject Rights Requests (ARCO Rights)

Legal Basis:
GDPR: Article 6(1)(c) – Processing necessary for compliance with a legal obligation to which the controller is subject.
General Data Protection Regulation.

Purposes of Processing: To manage requests relating to the exercise of rights established under the General Data Protection Regulation: right of access, rectification, erasure, restriction of processing, data portability and objection to automated decision-making.

Data Subjects: Natural persons submitting requests (employees, clients, suppliers, contact persons).

Categories of Data: Name and surname, address, signature and telephone number.

Categories of Recipients: Personal data may be disclosed to the Supervisory Authority (Spanish Data Protection Agency) within the framework of investigations relating to the protection of rights initiated by the data subject.

International Transfers: No international data transfers are envisaged.

Retention Period: Data will be retained for a period of five years from the date of the request.

Security Measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Candidate Recruitment Process Data Processing (HR)

Purposes of Processing: Recruitment and staffing processes.

Data Subjects: Candidates applying for job vacancies.

Categories of Data:

Name and surname, ID number/Tax ID/Identification document, personnel registration number, address, signature and telephone number.
Personal characteristics data: gender, marital status, nationality, age, date and place of birth, and family data.
Academic and professional data: qualifications, training and professional experience.
Employment details data.

Categories of Recipients: No disclosure of data to third parties is envisaged.

International Transfers: No international data transfers are envisaged.

Security Measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Supplier Data Processing

Purposes of Processing:

Procurement of products and/or services necessary for the development of our activity.
Monitoring subcontractors where applicable.

Data Subjects:

Suppliers.
Individuals working for our suppliers.

Categories of Data:

Name and surname, ID number/Tax ID/Identification document, address, signature and telephone number.
Employment details data: job position. Occupational health and safety training.
Financial and insurance data: banking details.

Categories of Recipients:

Financial institutions (invoice payments).
Spanish Tax Agency.

International Transfers: No international data transfers are envisaged.

Retention Period: Data will be retained for the period necessary to fulfil the purposes for which they were collected and to determine any potential liabilities arising from such purposes and the processing of the data, in accordance with Law 58/2003, of 17 December, General Taxation Law.

Security Measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Client Data Processing

Legal Basis:
GDPR: Article 6(1)(a) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
GDPR: Article 6(1)(b) – Processing necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
GDPR: Article 6(1)(c) – Processing necessary for compliance with a legal obligation to which the controller is subject.
GDPR: Article 6(1)(f) – Processing necessary for the purposes of the legitimate interests pursued by the controller.

Royal Legislative Decree 2/2015, of 23 October, approving the revised text of the Workers’ Statute Law.
Law 58/2003, of 17 December, General Taxation Law.

Purposes of Processing: Sports representation agency and sports scholarship management.

Data Subjects: Clients.

Categories of Data:

Name and surname, ID number/Tax ID/Identification document, address, signature and telephone number.
Financial and insurance data: banking details.

Categories of Recipients:

Financial institutions.
Spanish Tax Agency.

International Transfers: No international data transfers are envisaged.

Retention Period: Data will be retained for the period necessary to fulfil the purposes for which they were collected and to determine any potential liabilities arising from such purposes and the processing of the data, in accordance with Law 58/2003, of 17 December, General Taxation Law.

Security Measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Security Breach Notification Processing

Legal Basis:
GDPR: Article 6(1)(c) – Processing necessary for compliance with a legal obligation to which the controller is subject.
General Data Protection Regulation, Articles 33 and 34.

Purposes of Processing: Management and assessment of security breaches occurring within our organisation.

Data Subjects: Variable: Employees, Clients, Suppliers, Contact Persons (depending on the security breach).

Categories of Data: Variable (depending on the security breach).

Categories of Recipients:

Spanish Data Protection Agency.
State Security Forces and Bodies.

International Transfers: No international data transfers are envisaged.

Retention Period: Data will be retained for the period necessary to fulfil the purposes for which they were collected and to determine any potential liabilities arising from such purposes and the processing of the data. Archiving and documentation regulations shall apply.

Security Measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Targeted Advertising Processing

Legal Basis:
GDPR: Article 6(1)(a) – The data subject has given consent to the processing of their personal data for one or more specific purposes.

Purposes of Processing: Displaying targeted advertising on third-party advertising platforms.

Data Subjects: Clients and users.

Categories of Data: Email address.

Categories of Recipients: Third-party advertising platforms (Google, Facebook or others).

International Transfers: Companies owning the platform: Google / Facebook.

Retention Period: Data will be processed for as long as we have the data subject’s consent.

Security Measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

YOUR RIGHTS

You have the right to request a copy of your personal data, to rectify inaccurate data or complete incomplete data, and, where appropriate, to request the erasure of your data when it is no longer necessary for the purposes for which it was collected.

You also have the right to restrict the processing of your personal data and to obtain your personal data in a structured and readable format.

You may object to the processing of your personal data in certain circumstances (in particular, where we do not need to process it to comply with a contractual or legal requirement, or where the processing is carried out for direct marketing purposes).

Where you have given us your consent, you may withdraw it at any time. At that point, we will stop processing your data or, where applicable, cease processing it for that specific purpose. If you decide to withdraw your consent, this will not affect any processing carried out while your consent was valid.

These rights may be limited; for example, if complying with your request would require us to disclose data relating to another person, or if you request the deletion of records that we are legally obliged to retain or that we must retain for legitimate interests, such as the exercise of defence against legal claims. They may also be limited where the right to freedom of expression and information must prevail.

You may contact us through any of the means indicated in the Data Controller section of this Privacy Policy, providing a copy of a document proving your identity (normally your national identity document). The most convenient way to exercise your rights is by accessing our RIGHTS PORTAL: https://clientes.protecciondatos.online/portalderechos/dpf-group.

You also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

In the event of any breach of your rights, for example if we have not responded to your request, you have the right to lodge a complaint with the competent Data Protection Supervisory Authority. This may be the authority in your country (if you live outside Spain) or the Spanish Data Protection Agency (if you live in Spain).

Additional Information

Links to Third-Party Websites

Our website may occasionally contain links to other websites. It is your responsibility to ensure that you read the data protection policy and legal terms applicable to each website.

Third-Party Data

If you provide us with data relating to third parties, you assume responsibility for informing them in advance in accordance with Article 14 of the GDPR.