Privacy policy

This English version is provided for information purposes only. In the event of any discrepancy, the Spanish version shall prevail.

In accordance with current data protection legislation, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter, LOPD-GDD), users are informed as set out in Article 13 GDPR and Article 11 LOPD-GDD:

I. Controller

Who is the controller of your data?

• Company name: BOSS CONTINENTAL SL

• Tax ID (CIF): B80909047

• Registered address: Calle Emilio Muñoz, 7, 1º B, 28037 Madrid (Spain)

• Email: adesantisteban@bosscontinental.com

• Website: www.bosscontinental.com

II. Purpose

For what purpose will we process your personal data?

BOSS CONTINENTAL SL processes your information in order to:

1. Maintain the business relationship and provide the contracted service.

2. Prepare a quotation tailored to your needs.

3. Manage email communications with interested parties.

4. Carry out the company’s recruitment processes.

5. Manage the company’s employees and human resources.

6. Send commercial information related to our sector: freight transport management

7. Monitor the security of the premises (video surveillance).

8. Manage training activities.

How long will we keep your data?

The personal data you provide will be kept for as long as the business relationship remains in force. However, in the interest of full transparency, the general periods we work with are:

• General identification data (email, first name, surname, phone number, etc.): for the duration of the business relationship or until consent is withdrawn. In any case, they will be deleted when they are no longer going to be used for the purpose for which they were collected.

• Spanish Law on Social Order Infringements and Penalties (obligations regarding registration, enrolment, termination, contributions, payment of salaries…); Arts. 66 et seq. of the General Tax Law (accounting books…): four (4) years.

• Personal actions without a special time limit (Article 1964 of the Civil Code): five (5) years

• Accounting, tax and employment (Article 30 of the Commercial Code – accounting books, invoices…): six (6) years.

• Employment: contracts, working-time records, payslips and contributions, identity documents, four (4) years; in the case of occupational risk prevention reports, records of illness or accidents, and contracts with prevention services, five (5) years.

• Data subject to the Law on the Prevention of Money Laundering and Terrorist Financing (Article 25): ten (10) years.

• Recruitment processes: two (2) years from submission of the curriculum vitae.

• Video surveillance: thirty (30) days, unless an infringement and/or offence is recorded.

• Likewise, since commercial information is sent, even if the relationship between the parties ends, the controller will continue to keep your information in order to send newsletters related to our products and services. You may always exercise the rights granted to you by current legislation by contacting us through whichever channel is most convenient for you.

• Aggregated and anonymised data: no time limit

Notwithstanding these general periods, we will periodically review our systems in order to delete any data that is no longer legally required.

III. Legal basis

What is the legal basis for processing your data?

Depending on the purposes for which the data are collected, the processing of your data is necessary for:

1. Managing the business relationship you have entered into with us.

   1. Performance of a contract (under Article 6.1.b GDPR)

   2. Consent of the data subject (under Article 6.1.a GDPR)

2. Prepare a quotation tailored to your needs.

   1. Performance of a contract and/or pre-contractual relationship (under Article 6.1.b GDPR)

3. Manage email communications with interested parties.

   1. Consent of the data subject (under Article 6.1.a GDPR)

   2. Legitimate interest (under Article 6.1.f GDPR)

4. Carry out the company’s recruitment processes.

   1. Consent of the data subject (under Article 6.1.a GDPR)

5. Management of the company’s internal employees and human resources

   1. Performance of a contract (under Article 6.1.b GDPR)

6. Sending commercial communications

   1. Consent of the data subject (under Article 6.1 GDPR)

   2. Consent of the data subject (under Article 20 LSSICE)

   3. Legitimate interest (under Article 6.1.f GDPR and Article 21.2 LSSICE)

7. Monitoring the security of the premises (video surveillance)

   1. Legitimate interest (under Article 6.1.f GDPR)

8. Managing training activities

   1. Performance of a contract (under Article 6.1.b GDPR)

   2. Consent of the data subject (under Article 6.1.a GDPR)

Furthermore, all data collected are necessary for the provision of the service. However, data marked with an asterisk (*) are mandatory. If mandatory data are not provided, the controller will not be able to provide the contracted service.

Finally, only persons over the age of 14 may provide personal data on this website. As required by the LOPD-GDD, for minors under 14, the consent of their parents or guardians is a mandatory condition for us to process their personal data.

In addition, only persons over the age of 18 may contract our services. For minors under 18, the consent of their parents or legal guardians is a mandatory condition for us to provide the services offered, unless the minor is emancipated.

IV. Rights of data subjects

What are my data protection rights?

In accordance with Article 13 GDPR and Article 11.2.c) LOPDGDD, you may exercise any of the following rights by writing to the postal address Calle Emilio Muñoz, 7, 1º B (28037 Madrid) or to the email address adesantisteban@bosscontinental.com. In any case, under current legislation you have the following rights, as set out in Articles 15 to 22 GDPR and 12 to 18 LOPDGDD:

• Right to request access to the personal data relating to the data subject.

• Right to request rectification or erasure.

• Right to request restriction of processing.

• Right to object to processing.

• Right to data portability.

You may request from the Controller the forms to exercise your rights at the email address given in the controller’s details. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD). More information in Section VII of this document.

V. Recipients

To which recipients will your data be disclosed?

You will always be informed and, where appropriate, your express consent will be requested before your personal data are disclosed or transferred internationally in accordance with current legislation (Arts. 13.1.e) and 44 GDPR, and Arts. 11.1 and 40 LOPDGDD 3/2018). Accordingly, we inform you that the third parties the Controller works with have their servers located within the EU, the EEA or Switzerland, with appropriate security measures to ensure proper and confidential data processing.

Apart from the cases mentioned above and except where legally required, your data will not be disclosed or communicated to any third party, except in cases provided for by law or where strictly necessary for the provision of a service. In general terms, data may be disclosed to:

• Technology service providers.

• Payment service providers.

• Courier and parcel companies.

• Third parties or intermediaries acting as service providers on our behalf (agencies, advisors, freelance collaborators…).

• Third-party processors, collaborators or parties with a close business relationship with the controller, solely for the purpose of providing our services.

Data disclosures will take place under the strictest confidentiality, using the necessary measures, such as the signing of confidentiality agreements or adherence to the privacy policies set out on their respective websites. Users may object to the disclosure of their data to Processors by written request through any of the means referred to above. The controller will not disclose or communicate your data to any third party, except in cases provided for by law or when the provision of a service requires a contractual relationship with a Processor. Accordingly, Users agree that some of the personal data collected may be provided to these Processors (payment platforms, agencies, intermediaries, etc.) when necessary for the effective provision of a contracted service or purchased product. Users also agree that, where services are provided, they may be subcontracted in whole or in part to other persons or companies, who will be considered Processors and with whom the corresponding confidentiality agreement has been concluded, or whose privacy policies, set out on their respective websites, have been adhered to. Users may object to the disclosure of their data to Processors by written request through any of the means referred to above.

VI. Source of your data

How did we obtain your data?

The personal data used by BOSS CONTINENTAL SL come from the data subject, in compliance with Articles 13 GDPR and 11 LOPDGDD mentioned above, or from group or partner companies, about which you can obtain more information by writing to adesantisteban@bosscontinental.com or at the Controller’s office at the postal address given in this document.

What categories of data do we handle?

The categories of personal data processed are:

Identification data

First name

Surname

National ID / Foreigner ID / Passport or equivalent document

Postal addresses

Email addresses

Sex

Date of birth

Place of birth

Contact telephone (mobile / landline)

Commercial information: own and third-party

Financial data

Bank account number

Credit card number

Curriculum vitae

Academic data

Qualifications

Hobbies

Membership of associations or clubs

Video surveillance

Image

Sensitive data will be processed in accordance with Article 9 GDPR and Article 9 LOPDGDD, informing the data subject in all cases of which data will be used by the controller.

VII. Additional information

• Security measures: Users of the controller’s website are informed that the technical and organisational security measures within our reach have been adopted to prevent the loss, misuse, alteration, unauthorised access and theft of data, thus guaranteeing the confidentiality, integrity and quality of the information they contain, in accordance with current data protection legislation. The personal data collected through the forms are processed solely by the controller’s staff or by the designated Processors. The Website also uses SSL encryption, which allows Users to send their personal data securely through the website’s contact or registration forms.

• Social media: the controller has profiles on some of the main social networks (Facebook, Instagram), and in all cases acts as Controller of the data of its followers, fans, subscribers, commenters and other User profiles (hereinafter, followers) published by the controller.

Where not prohibited by law, the purpose of the controller’s processing of data will be to inform its followers about its activities and offers through any means allowed by the social network, and to provide personalised customer service. The legal basis for this processing will be the consent of the data subject, which may be withdrawn at any time.

Under no circumstances will the controller extract data from social networks unless the User’s consent has been specifically and expressly obtained for that purpose (for example, to run a competition).

• Confidentiality: The information provided by the User will in all cases be considered confidential and may not be used for purposes other than those described here. The controller undertakes not to disclose or reveal information about the User’s claims, the reasons for the advice requested or the duration of its relationship with the User.

• Accuracy of data: The User declares that all data provided are true and correct and undertakes to keep them up to date. The User will be responsible for the accuracy of their data and will be solely liable for any conflicts or disputes that may arise from false data. To allow us to keep personal data up to date, it is important that the User informs the controller whenever there has been any change.

• Documentation prepared by LegalDPO (legaldpo.es), based on information provided by the Data Controller. The content complies with the legislation in force in February 2023 and may vary in line with legislative changes or case law, the owner being obliged to verify that it remains current at all times.

VIII. Supervisory authority

We make every effort to comply with data protection legislation, as it is our most valuable asset. However, if you consider that your rights have been infringed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid. More information about the AEPD: www.aepd.es. Documentation prepared by LegalDPO. legaldpo.es