Privacy Policy

Data protection policy of the Foundation for Promoting Innovation, Research and Technological Development in the Automotive Industry in Galicia (CTAG)

In compliance with data protection legislation, Regulation (EU) 2016/679 of the European Parliament and the Council, of 27 April 2016 (GDPR), Basic law on the protection of personal data and the guarantee of digital rights (LOPDGDD; Law 3/2018 of December 5), we inform you of our Personal Data protection policy, with regard to the processing of personal data of Contacts, employment Candidates, Clients, Suppliers, Participants in courses, Teachers and Participants in tests, which is as follows:

Personal data handler

The data handler is the legal person that determines the purposes and means used for processing the personal data. In other words, the data handler will decide how and for what purpose personal data will be processed. For the purposes of this Data Protection Policy, the personal data handler is:
  • Business name: Fundación para la Promoción de la Innovación, la Investigación y el Desarrollo Tecnológico de la Industria de la Automoción de Galicia (CTAG) (Foundation for Promoting Innovation, Research and Technological Development in the Automotive Industry in Galicia)
  • NIF (Fiscal ID No.): G-36. 871.424
  • Registered office: Polígono de A Granxa, calle A,parcela 249-250. 36400 Porriño (Pontevedra, Spain).
  • Email: rgpd@ctag.com
  • Telephone: 986900300
  • Activity: Technological Research and Development.

What personal data do we process and how do we protect them?

Personal data are all information about an identified or identifiable natural person. For the purposes of this privacy policy, the data handler collects and processes the personal data explained in each type of processing and which will depend on the different services requested or the contractual relationship maintained with our company. Our organisation is committed to maintain total confidentiality and apply adequate physical, technical and organisational security measures to protect your personal data. You must guarantee and respond for the truthfulness, exactitude, validity and authenticity of the personal data submitted and undertake to keep them duly updated.

Data processing: “Clients”

1. What type of personal data do we process? Identification data: Name, ID card No. (DNI), address, telephone no., email address. Academic and professional data: Profession, position. Data referring to transactions: Products and services supplied.
2. What is the purpose of processing your personal data? We process personal data you submit to manage the data of company clients, to maintain a commercial relationship, accounting, administrative and billing management, as well as tax obligations. Purposes such as publicity and commercial prospecting are also contemplated, for which the express consent of the interested party is required. The personal data submitted will be kept for as long as the commercial relation is maintained. If you decide to cancel your personal data, they may be preserved in our databases for the periods of time established by law, to comply with tax and accounting obligations, and will be deleted when the applicable legal periods expire.
3. What legitimacy do we have for processing your data? The legal basis for processing your data is the execution of a contract, as well as compliance with legal obligations of the data handler. Communication of offers and promotions that could be of your interest is based on your express consent, which is requested.
4. Who will your data be communicated to? Your personal data will not be sent to any third party except those required by public authorities for legal obligations. International transfers of personal data are not contemplated either.

Data processing: “Contacts and potential clients”

1. What type of personal data do we process? Identification data: Name, address, telephone no., email address. Academic and professional data: Profession, position.
2. What is the purpose of processing your personal data? We process the personal data submitted in the contact form for the management of commercial contacts and potential clients. Purposes such as publicity and commercial prospecting are also contemplated, for which the express consent of the interested party is required. The personal data provided will be kept for as long as the commercial relation is maintained. If you decide to cancel the personal data, they will be deleted from our contact database.
3. What legitimacy do we have for processing your data? The legal basis for processing your data is the express consent you are requested to give.
4. Who will your data be communicated to? Your personal data will not be transferred to any other entity. International transfers of personal data are not contemplated either.

Data processing: “Suppliers”

1. What type of personal data do we process?
  • Identification data: Name, ID card No. (DNI), address, telephone no., email address.
  • Financial data: Bank account.
  • Academic and professional data: Profession, position, qualifications.
  • Data referring to transactions: Products and services delivered.
2. What is the purpose of processing your personal data? We process the personal data you submit to manage the data of company suppliers, to maintain a commercial relationship, accounting, administrative and payment procedures, as well as tax obligations. The personal data provided will be kept for as long as the commercial relation is maintained. If you decide to cancel your personal data, this may be preserved in our databases for the periods of time established by law, to comply with tax and accounting obligations, and will be deleted when the applicable legal periods expire.
3. What legitimacy do we have for processing your data? The legal basis for processing your data is the execution of a contract, as well as compliance with legal obligations of the data handler.
4. Who will your data be communicated to? Your personal data will not be sent to any third party, except those required by public authorities for legal obligations. International transfers of personal data are not contemplated either.

Data processing: “Employment candidates”

1. What type of personal data do we process?
  • Identification data: Name, ID card No. (DNI), date of birth, address, telephone no., email address, image.
  • Personal characteristics: Sex, marital status, nationality, age, date and place of birth.
  • Academic and professional data: Profession, position, experience, qualifications.
2. What is the purpose of processing your personal data? All the personal data you submit are processed to manage company recruitment processes. The personal data submitted will be kept while the interested party has not withdrawn consent to continue storing his/her cv for future recruitment processes. If you decide to cancel your personal data, they will be deleted from our employment candidate database.
3. What legitimacy do we have for processing your data? The legal basis for processing your data is the express consent you are requested to give.
4. Who will your data be communicated to? There will be no transfers of data. International transfers of personal data are not contemplated.

Data processing: “Participants in training”

1. What type of personal data do we process?
  • Identification data: Name, ID card No. (DNI), address, telephone no., email address.
  • Academic and professional data: Profession, position, qualifications.
2. What is the purpose of processing your personal data? The personal data you submit are processed to keep records of attendees to training sessions organised by the company. The personal data submitted will be kept for as long as the cancellation of the data has not been requested. If you decide to cancel the personal data, they will be deleted from our course attendee database.
3. What legitimacy do we have for processing your data? The legal basis for processing your data is the execution of a contract, as well as compliance with the legal obligations of the data handler.
4. Who will your data be communicated to? Transfers of data will be done as required to comply with legal obligations with entities such as the Xunta de Galicia (Autonomous Government of Galicia) or the Fundación Tripartita. International transfers of personal data are not contemplated.    

Data processing: “Teachers”

1. What type of personal data do we process? Identification data: Name, ID card No. (DNI), address, telephone no., email address. Financial data: Bank account. Academic and professional data: Profession, position, qualifications.
2. What is the purpose of processing your personal data? All the personal data you submit is processed to manage teachers in courses organised by the company. The personal data submitted will be kept for as long as the cancellation of the data has not been requested. If you decide to cancel your personal data, they will be deleted from our teachers database.
3. What legitimacy do we have for processing your data? The legal basis for processing your data is the execution of a contract, as well as compliance with legal obligations of the data handler.
4. Who will your data be communicated to? Transfers of data will be done as required to comply with legal obligations with entities such as the Xunta de Galicia or the Fundación Tripartita as well as the Tax Authorities and the Social Security. Data transfer for legitimate purposes related to the company’s activities will also be carried out. It will be necessary to send your bank data (Tax Identification Number, name and surname(s) and account number) to the financial entities responsible for paying the teaching work. International transfers of personal data are not contemplated.

Data processing: “Participants in tests”

1. What type of personal data do we process?
  • Identification data: Name, ID card No. (DNI), address, telephone no., email address.
  • Driving licence data: Status of the driving license.
  • Health data: Medical aptitude for carrying out tests or trials.
2. What is the purpose of processing your personal data? The personal data you submit are processed to keep records of attendees to tests to carry out studies organised by the company. The personal data submitted will be kept for as long as the cancellation of the data has not been requested. If you decide to cancel the personal data, they will be deleted from our test attendee database.
3. What legitimacy do we have for processing your data? The legal basis for processing your data is the express and voluntary authorisation given to do the tests that you have voluntarily signed up for.
4. Who will your data be communicated to? There will be no transfers of data. International transfers of personal data are not contemplated.

What are your rights when you submit your data?

According to the applicable data protection legislation, you have a range of rights regarding the processing of your personal data. Exercising these rights is free of charge for you, except in cases of manifestly groundless or excessive requests, especially if they are repetitive. These rights are as follows:
  1. Right to information: You have the right to be informed, in a concise, transparent, intelligible and easily accessible manner, with a clear and simple language on the use and handling of your personal data
  2. Right to access: You have the right to request us to confirm if we are processing your personal data at any time and the right to access this data and to information on how they are processed as well as to obtain a copy of the data. The copy of your personal data that we will send you is free of charge, although a request for additional copies may be subject to a reasonable fee due to administrative costs. You will be requested to accredit your identity or other information before satisfying your request.
  3. Right of correction: You have the right to request correction of your personal data if they are incorrect, out of date or incomplete. You can also request completion of your personal data that are incomplete in an additional statement.
  4. Right to delete: You have the right to request your personal data to be deleted when, among other reasons, the data are no longer necessary for the purposes they were collected for. However, this right is not absolute, therefore our organization may keep these data, duly blocked, as laid down in the applicable legislation.
  5. Right to limit processing: You have the right to request the limiting of processing of your personal data, which means that we can still store it, but not continue to process it in any of the following cases:
    • You contest the accuracy of the data, during the period necessary for the data handler to verify their accuracy.
    • The processing is illicit, and you are opposed to the deletion of the data and request instead the limitation of its use.
    • Our entity no longer needs the data for the processing purposes, but does need them for formulating, exercising or defending from claims.
    • You have expressed opposition to processing, while verifying if the legitimate reasons of our entity prevail over yours.
  6. Right to data portability: You have the right to request your data be transmitted to another data handler in a structured commonly used format and readable mechanically. This right is applicable when the processing of your personal data is based on consent or the execution of a contract and this processing is carried out by automated means.
  7. Right to oppose: This right entitles you to oppose the processing of your personal data, including drawing up profiles. We will not be able to satisfy this right if we accredit legitimate reasons for the processing or for formulation, in the exercise or defence from claims.
  8. Right not to be subject to automated decisions, including profiles: This right enables you not to be subject to decisions based solely on automated processing, including the drawing up of profiles, when these decisions produce legal effects or affect you in a similar manner. Unless this decision is necessary for the formalization or execution of a contract, is authorized by law or based on consent.
  9. Right to withdraw consent: When your consent has been obtained for processing your personal data with regard to certain activities (for example, to send you commercial communications), you can withdraw your consent at any time. In this case, we will stop that specific activity for which you have previously consented to, except in cases where there are other reasons to justify continuing with the processing of your data, in which case you will be notified.
  10. The right to present a complaint before the authorities: You are entitled to present complaints before the Agencia Española de Protección de Datos (Spanish Data Protection Agency), C/ Jorge Juan, 6, 28001 Madrid, Tel.: +34 901 100 099 – 912 663 517 (www.agpd.es), or by writing to: https://sedeagpd.gob.es/sede-electronica-web/vistas/formQuejasSugerencias/seleccionarQuejaSugerencia.jsf
You may exercise the above-mentioned rights by sending a letter to our Customer Attention Department, or by sending an email to rgpd@ctag.com, accompanied by a document accrediting your identity and providing the details necessary to process your request. For further information about your rights, go to the Spanish Data Protection website: www.agpd.es.