CONSTRUCCIONES GRÁVALOS S.A. (hereinafter “CONSTRUCCIONES GRÁVALOS” or “the company”) declares to respect the Spanish and European legislation in force regarding personal data protection, specifically, the Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 and the Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights.

Your privacy and trust are important to us, so this Privacy Policy provides you with important information about how we treat your personal information. We recommend that you read the following carefully and, if you have any questions after doing so, you can contact us through the means we make available to you.

Responsible for the treatment

The Responsible for the processing of your personal data and owner of this website is the company CONSTRUCCIONES GRÁVALOS S.A., a company registered in the Commercial Register of Zaragoza, Folio 79, Volume 352, sect. 3ª, sheet 6902, with tax identification number A-50109909 and with registered address at Carretera de Castellón Km 15,500, Polígono Industrial “La Noria”, Sector Industrial I-7, parcela 2.5; 50730 El Burgo de Ebro.

In addition to the address above, if you wish to contact us you can do so through our:

• Telephone: 976 104 808
• E-mail: lopd@gravalos-sa.com
• Contact details of our Data Protection Officer: lopd@gravalos-sa.com

Typology, purpose and legitimate basis for the processing of personal data

We collect personal data from:

• Workers’ data: the purpose of this data is to manage the labor relationship, prepare their pay slips, control the working day and other obligations derived from the same. The data collected are identification data, biometric data (fingerprint), special categories (health/disability), personal characteristics data, academic data and professions, employment detail data and economic data. The basis of legitimacy for data processing is the relationship between the parties, the legal obligation to collect this type of data and the consent of the interested parties. The data retention period is set at five years from the end of the employment relationship, except for payrolls, TC1 and TC2, which must be kept for ten years.
• Data of job seekers: this data is used for the management of selection processes. The data collected are identification data, personal characteristics data, academic data and professions and employment detail data. The basis of legitimacy for data processing is the pre-contractual relationship between the parties and the consent of the data subjects. The period of conservation of the data is set at twelve months from the end of the selection process.
• Data of potential customers: the purpose of data processing is the commercial management of potential customers, preparation of budgets. The data collected are identification data and health data. The basis of legitimacy is the execution of a pre-contract and the legitimate interest of the data controller. The retention period of the data is five years from the end of the contact with the potential customer.

• Customer data: the purpose of data processing is the execution of a commercial contract or pre-contract and the supply of the requested products. For this purpose, identification data, professional data and economic data are requested. The legitimate basis for data processing is the legitimate interest of the data controller and the performance of a contract. The data will be deleted within five years from the end of the business relationship.

• Suppliers’ data: the purpose of this data is to manage commercial contracts for which identification data and economic data are collected. It is the execution of the contract itself that legitimates us to process your data, which will be cancelled within five years from the end of the commercial relationship.

• Members’ data: the purpose of the members is to manage the entity internally. The processing of your data is legitimized in the business relationship between the parties and they are kept indefinitely.
• Video surveillance data: the purpose of this data is to ensure the security of our facilities. The data collected are identification data (image). The processing of these data is legitimized in the public interest pursued and the storage period is set at 30 days.

• Data relating to the exercise of rights: the purpose of the processing is to attend to the exercise of data protection rights. The basis of legitimacy is compliance with current data protection regulations. This data will be kept to a minimum and will be retained at all times in compliance with the provisions of current data protection regulations.

• The use of Cookies: CONSTRUCCIONES GRÁVALOS will be able to treat the personal data collected through the cookies informed in the Cookies Policy. These data will be processed for the purposes that have also been detailed in our Cookies Policy, along with the period of conservation of each of them. The legitimate basis in this case is your consent.
• Data obtained through the Information Channel: the purpose of the processing is to process complaints received through the Information Channel, which may include sensitive data or data relating to criminal or administrative sanctions, identified data or employment detail data. The basis that legitimizes the processing of this data is the fulfillment of a legal obligation under Law 2/2023, of February 20, 23, regulating the Protection of Persons Reporting Regulatory Violations and the Fight against Corruption. These data will be cancelled within 3 months unless it is necessary to keep them in order to prove the correct functioning of the channel, in which case they will be anonymized.

Conservation periods

The personal data provided will be kept for as long as the relationship that may bind us, during the legal periods of conservation, or until the interested party requests its deletion or opposition. In general, a retention period of five years from the end of the relationship between the parties is established. At the end of this period, they will be cancelled or destroyed confidentially.

How do we share information with third parties?

We share personal information with third parties for the purpose of providing services on the terms described in this Privacy Policy or when we believe it is permitted or required by law. When we share personal information, we do so in accordance with privacy and data security requirements.

CONSTRUCCIONES GRÁVALOS informs the interested party that some of our suppliers may process their personal data as data processors, for example, in the case of:

• Third-party service providers, when necessary for the provision of services, coordination of activities, internal management, supplier approval, software, systems and platform support, cloud hosting services and electronic communications. In such cases, access to your data by a third party will only be carried out when CONSTRUCCIONES GRAVALOS maintains a contractual relationship with the data processor that guarantees confidentiality, the non-use of the personal information of the users that we make available for purposes other than those previously indicated, as well as compliance with our internal privacy and information security regulations.
• When such transfer of data is covered by a legal obligation or was required by the competent authorities to respond to legal requirements, criminal investigation of a possible illegal activity or claims that a content infringes the rights of third parties or to protect the rights, property or security of third parties, in the case of merger, sale, restructuring, acquisition, joint venture, assignment, transfer or other disposal, in whole or in part, of our business, assets or shares (e.g., assignments to the AEAT, TGSS…).

International transfers

In some cases CONSTRUCCIONES GRÁVALOS uses third party tools and services for the management of services. Some of these services may be owned by third parties resident outside the European Economic Area.

CONSTRUCCIONES GRÁVALOS tries to use safe tools whose servers are preferably located in Spain, or failing that, in a member state of the European Union, or that comply with the European legality according to the guidelines and recommendations of the Spanish Data Protection Agency, the European Commission and the Community reference agreements on international data transfer.

In the event that the international transfer of data is required, acceptance of this Privacy Policy means that as a User you expressly consent to such transfer.

Exercise of rights and claims before the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

At any time the User can withdraw his consent and/or exercise his rights of access, rectification, suppression, limitation, opposition and portability foreseen in the European regulations of personal data protection, by sending a mail to lopd@gravalos-sa.com or by sending a letter to CONSTRUCCIONES GRÁVALOS S.A., Carretera de Castellón Km 15,500, Pol. Industrial “La Noria”, Industrial Sector I-7, plot 2.5; 50730 El Burgo de Ebro (Zaragoza).

In such a case, the User must indicate the right he/she wishes to exercise and attach a copy of his/her ID card or any other valid identification documentation that legitimizes him/her to do so, including the one that allows his/her electronic identification.

If your rights are not effectively addressed, you may file a complaint with the Spanish Data Protection Agency.

Your commitment, the veracity of the data you provide us with

The User declares that the personal data provided to CONSTRUCCIONES GRÁVALOS are true. As User you must know that you are the only responsible for any damage or harm, direct or indirect, that could be caused to CONSTRUCCIONES GRÁVALOS as responsible of this web site or to a third party if you send us false data or data of third parties without your previous consent causing deceit, damage or harm.

In order for us to keep your data accurate and up to date, we ask the User to inform us of any changes that may occur in the data provided.

Consent of minors

It is forbidden by CONTRUCCIONES GRAVALOS the sending of personal data through this web site or the means indicated therein by users under 14 years old. In the event that this entity detects users who may be under the indicated age, it will not process their data and therefore will not respond to requests.

CONSTRUCCIONES GRÁVALOS reserves the right to request a copy of the User’s ID card or equivalent document that proves its legitimacy in case of having well-founded suspicions about the User’s minority.

MeApplicable Safety Measures

In order to protect the personal data of users, CONSTRUCCIONES GRÁVALOS ensures itself and controls its data processors, in the implementation of technical and organizational measures appropriate to the state of the art to protect personal data, taking into account the scope, context and purposes of processing, as well as the risks of varying likelihood and severity to the rights and freedoms of data subjects, seeking to be able to ensure the confidentiality, integrity, availability and resilience of systems and processing services.

Our information security policies and procedures are regularly reviewed and updated to meet the needs of our business, technological changes and regulatory requirements.

Applicable law and jurisdiction

CONSTRUCCIONES GRAVALOS is based in Spain, so the content of this Privacy Policy has been drafted in accordance with Spanish legislation and applicable European Union regulations.

By accepting this Privacy Policy, you agree that claims or complaints against this entity arising from or related to the use of this website and more specifically the processing of your personal data will be resolved by the court of competent jurisdiction located in Zaragoza. If CONSTRUCCIONES GRÁVALOS has to make any kind of claim, it shall do so before the competent court of the User’s domicile or at the company’s domicile (Zaragoza) in the case of legal entities or non-consumer professionals.

If the User accesses this site from a location outside of Spain, the User is responsible for complying with all applicable local and international laws.

Privacy Policy last updated on November 28, 2023.