1. Identification of the Data Controller and Contact Details
The controller of your personal data is OBRASCON HUARTE LAIN S.A. (hereinafter, “OHLA”), Tax ID No. A48010573, with registered office at Paseo de la Castellana 259-D, 28046 – Madrid.
Access to and/or use of the Website grants the status of user (hereinafter, the “User” or the “Users”) and implies acceptance, from such access and/or use, of this Privacy Policy.
We also inform you that OHLA has a Data Protection Officer, who may be contacted through the following email address: dpd@ohla-group.com
2. Purposes for Which OHLA Processes Your Personal Data
Your personal data collected by OHLA may be used for the following purposes:
- Managing enquiries submitted through contact email addresses.
- Managing users’ access to the website: OHLA stores users’ browsing data provided when accessing and using its websites, applications and any other digital platform or electronic medium for the purpose of properly managing their access to the company’s communication networks.
- Registration of blog users and newsletter delivery: For registration on the company blog and to receive newsletter mailings, users are asked to provide their email address. If this data is not provided, access to these services and communication with users through the company’s usual electronic means will not be possible.
- Registration of users on the company’s social networks: The email address and identifying data voluntarily provided when participating in communications, events or other activities carried out through the company’s social media profiles are collected.
- Management of candidates in recruitment processes: Candidates who submit an application to participate in recruitment processes must provide their contact details and CV information through registration on the website and communication by email.
If OHLA plans to further process the personal data provided through this Website for a purpose other than that for which it was collected, the User shall be provided, prior to such further processing, with information about that other purpose and any additional relevant information, in accordance with current legislation.
3. Legal Basis for Processing
OHLA processes Users’ personal data on the basis of the following legal bases, depending on the purpose pursued in each case:
- Managing enquiries submitted through email: processing is based on the data subject’s consent, which is understood to be given when they voluntarily submit their enquiry and the contact details necessary to address it (Article 6.1.a GDPR). When the enquiry is related to an existing contractual relationship or to a request for information prior to entering into such a relationship, the legal basis shall be the performance of the contract or the application of pre-contractual measures requested by the data subject (Article 6.1.b GDPR). Subsidiarily, OHLA may rely on its legitimate interest in handling and responding to those who contact the company (Article 6.1.f GDPR).
- Managing users’ access to the website: the processing of browsing data is based on OHLA’s legitimate interest in ensuring the security, integrity and proper functioning of its websites, applications, digital platforms and communication networks, as well as in preventing misuse or fraudulent use thereof (Article 6.1.f GDPR). In the case of the installation of cookies or similar technologies that are not strictly necessary for the provision of the service, the legal basis shall be the user’s consent, obtained through the cookie settings panel, in accordance with Article 6.1.a GDPR and Article 22.2 of Law 34/2002 on Information Society Services and Electronic Commerce. Likewise, certain processing may be based on compliance with legal obligations regarding information security (Article 6.1.c GDPR).
- Registration of blog users and newsletter delivery: the legal basis is the express consent of the data subject, given at the time of registration and subscription, in accordance with Article 6.1.a GDPR and Article 21 of the LSSI. This consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to its withdrawal, through the unsubscribe link provided in each communication or through the channels for exercising rights indicated in this policy.
- Registration of users on the company’s social networks: processing is based on the data subject’s consent, expressed by voluntarily providing their identifying and contact data when following corporate profiles or participating in communications, events or other activities promoted by OHLA through such channels (Article 6.1.a GDPR). OHLA may also process such data on the basis of its legitimate interest in managing its institutional presence on social networks and maintaining its relationship with users who interact with its profiles (Article 6.1.f GDPR).
- Management of candidates in recruitment processes: the processing of contact details and CV information provided by candidates is based on the application of pre-contractual measures taken at the request of the data subject, materialized through the submission of their application to a recruitment process (Article 6.1.b GDPR). The retention of the CV in the company’s candidate database for consideration in future recruitment processes shall be based on the data subject’s consent (Article 6.1.a GDPR). Where necessary, OHLA shall process candidates’ data to comply with its legal obligations in employment, occupational risk prevention and equality and integration of persons with disabilities (Articles 6.1.c and, where applicable, 9.2.b GDPR).
4. Data Retention
OHLA shall retain personal data for the time necessary to fulfill the purpose for which it was collected and, where applicable, for as long as the relationship with the data subject is maintained or until the data subject withdraws their consent or requests erasure.
In particular, data provided for the management of enquiries shall be retained for the time required to address them; browsing and website access data, for the time necessary to ensure the security and proper functioning of the platforms, with the specific periods provided for in the Cookie Policy applying to cookies; data relating to blog and newsletter subscribers, as well as users of corporate social networks, for as long as the subscription or connection with the company’s profiles is maintained; and candidates’ data, during the recruitment process and thereafter for a maximum period of one year, for the purpose of considering their application in future processes, after which it shall be deleted unless the data subject updates it or expresses their wish to remain in the candidate database.
Once the indicated purposes have been fulfilled, the data shall remain duly blocked for the limitation period of any legal obligations and actions that may arise from the processing, being made available exclusively to judges and courts, the Public Prosecutor’s Office and the competent Public Administrations. Once this period has elapsed, the data shall be securely deleted.
5. Recipients
OHLA may disclose the personal data of data subjects, exclusively for the purposes indicated in the preceding sections and where necessary to achieve them, to other companies belonging to the OHLA Group (hereinafter, the “Group”), as well as to its subsidiaries and investee companies. Such disclosures shall be made on the basis of the Group’s legitimate interest in the centralized management of certain processes and services, particularly in the field of recruitment, and shall in all cases be limited to strictly necessary data.
Likewise, the data may be processed, in whole or in part, by service providers contracted by OHLA acting as processors, such as providers of hosting, maintenance and security services for digital platforms, email and electronic communications delivery services, or recruitment process management tools. All of them access the data solely for the provision of the entrusted service, pursuant to the corresponding data processing agreements entered into in accordance with Article 28 GDPR.
In the case of OHLA’s corporate profiles on social networks, the data that users provide or generate through such platforms shall also be processed by the owners of those platforms, in accordance with their own privacy policies and terms of use, over which OHLA has no control.
As a general rule, data may be disclosed to judges and courts, the Public Prosecutor’s Office, law enforcement authorities and competent Public Administrations when required by a legal obligation.
OHLA does not plan to carry out international transfers of personal data to third countries or international organizations, except those that may arise from the use of electronic communication and hosting services provided by providers not established in the European Union. In such cases, these transfers shall be carried out under one of the safeguards provided for in Chapter V of the GDPR, in particular adequacy decisions of the European Commission or standard contractual clauses, ensuring at all times the confidentiality of the data and the application of appropriate technical and organizational measures to ensure compliance with current personal data protection regulations.
We inform you that you may request further detailed information regarding the recipients of your data by sending an email to the address dpd@ohla-group.com
6. Accuracy of the Data Provided by the User
The User guarantees that the personal data provided is accurate and undertakes to notify OHLA of any changes to it. The User shall be liable, in any case, for the accuracy of the data provided, and OHLA reserves the right to exclude from the registered Services any User who has provided false data, without prejudice to any other legal actions that may apply.
7. Rights in Relation to Your Data
The User has the right to request access to their personal data, request the rectification of inaccurate data, request erasure, request restriction of processing, object to processing, request data portability and not be subject to automated individual decision-making.
The User may exercise these rights by sending an electronic communication to the following email address dpd@ohla-group.com, indicating the reason for their request and duly proving their identity. The User may also send their request by ordinary mail addressed to the following address:
OBRASCON HUARTE LAIN S.A. (OHLA)
Paseo de la Castellana 259-D,
28046 – Madrid.
If you consider that the company has not processed your personal data in accordance with the applicable regulations or that your rights have not been satisfactorily addressed, you may contact the Data Protection Officer at dpd@ohla-group.com, and you may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Data Security
OHLA has adopted the security levels required by the applicable regulations, appropriate to the nature of the data being processed at any given time, and has implemented all technical means available to it to prevent the loss, misuse, alteration, unauthorized access and theft of the data that the User provides through the Website, without prejudice to informing you that security measures on the Internet are not impregnable.
OHLA undertakes to comply with the duty of secrecy and confidentiality regarding personal data in accordance with the applicable legislation.
9. Review of the Privacy Policy
OHLA reserves the right to review its Privacy Policy whenever it deems appropriate. For this reason, we ask you to check this Privacy Policy regularly in order to read the most recent version.