Personal Data Protection Policy

Pursuant to applicable legislation on data protection, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), Organic Law on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD, 3/2018 of 5 December), we inform you that our Personal Data Protection Policy, with regard to the processing of personal data, is as described in detail below.

Data controller for personal data processing

The data controllers are the legal entities that make up the Nogar Group, which determine the purposes and methods for the processing of personal data. In other words, the controller(s)/joint controller(s) decides how and for what purposes personal data is processed.

For the purposes of this Data Protection Policy, the data controllers for the processing of personal data are all legal entities indicated in “Annex I: Companies of the Nogar Group”, available below. For each legal entity, the following data are indicated:

Company name
Tax ID no.
Registered office
Email: rgpd@gruponogar.com
Phone: 986 880 600
Activity

The Nogar Group companies act as joint controllers for portions of the data processing, namely:

Processing for security purposes
Processing for business activity coordination

For the purposes of Art. 26 GDPR, they will act as joint controllers when two or more group companies jointly determine the purposes and methods for the processing. En estos casos, para cumplir con el principio de transparencia y con las obligaciones que tienen los responsables del tratamiento, sobre todo en los relativo a los derechos del interesado, se ha elaborado un acuerdo de corresponsabilidad, cuyos aspectos esenciales están a su disposición en la página web https://www.gruponogar.com/politica-de-privacidad/corresponsables

Which personal data do we process and how do we protect it?

Personal data is any information about an identified or identifiable individual.

For the purposes set out in this Privacy Policy, the data controller collects and processes the personal data that are indicated for each type of processing. This will depend on the different services that you request or on the contractual relationship that you have with our company.

Our organization undertakes to process your personal data with complete confidentiality and to implement appropriate physical, technical and organizational security measures for the protection of your personal data.

In any case you guarantee and are responsible for the truthfulness, accuracy, validity and authenticity of the personal data provided and undertake to keep them properly updated.

Processing of “Customer” data

What kind of personal data do we process?

Identification data: name, national ID no., address, telephone number, email address.
Financial data: bank account number.
Academic and professional data: profession, position, experience, qualifications.
Transaction data: products and services supplied.

For what purpose do we process your personal data?

We process the personal data that you provide in order to manage the company’s customer data, to maintain the business relationship, to manage accounting, administration and billing, as well as tax obligations.

The purpose of advertising and market research has also been stipulated, and the express consent of the data subject to this purpose is also requested.

The personal data provided will be kept on file for as long as the business relationship continues to exist. If you decide to cancel your personal data, then they may be kept in our databases for the periods stipulated by law in order to comply with tax and accounting obligations, and they will be deleted after the expiry of these legal periods or any others that might apply.

What is the legal basis for processing your data?

The legal basis for processing your data is the implementation of a contract, as well as the fulfilment of a legal obligation by the data controller.

Based on the express consent that we have requested of you, we will notify you of offers and promotions that may be of interest to you.

To which recipients will your data be communicated?

Your personal data will not be transferred to any entity, except to public authorities as required by law.

We do not plan to transfer personal data internationally.

Processing of data of “Contacts and potential customers”

What kind of personal data do we process?

Identification data: name, address, telephone number, email address.

For what purpose do we process your personal data?

We process the personal data the you provide on the contact form for the purpose of management of business contacts and potential customers.

The purpose of advertising and market research has also been stipulated, and the express consent of the data subject to this purpose is also requested.

The personal data provided will be kept on file for as long as the business relationship continues to exist. If you choose to cancel your personal data, then it will be deleted from our contact database.

What is the legal basis for processing your data?

The legal basis for the processing of your data is the express consent requested.

To which recipients will your data be communicated?

Your personal data will not be transferred to any entity.

We do not plan to transfer personal data internationally.

Processing of “Suppliers” data

What kind of personal data do we process?

Identification data: name, national ID no., address, telephone number, email address.
Financial data: bank account number.
Academic and professional data: profession, position, qualifications.
Transaction data: products and services delivered.

For what purpose do we process your personal data?

We process the personal data that you provide to us for management of the company’s supplier data, to maintain the business relationship, for management of accounting, administration and payments, as well as tax obligations.

What is the legal basis for processing your data?

The legal basis for processing your data is the implementation of a contract, as well as the fulfilment of a legal obligation by the data controller.

To which recipients will your data be communicated?

Your personal data will not be transferred to any entity, except to public authorities as required by law.

We do not plan to transfer personal data internationally.

Processing of “Employee” data

What kind of personal data do we process?

Identification data: name, national ID card number, date of birth, address, telephone number, email address, signature, image.
Data on personal characteristics: Sex, marital status, nationality, age, date and place of birth and family data.
Data on social circumstances: licenses and permits.
Economic and financial data: bank account number, payroll data, tax deductions, other amounts withheld (if applicable).
Academic and professional data: profession, position, experience, qualifications.
Data from presence monitoring: in certain cases your fingerprint will be used.

For what purpose do we process your personal data?

We process the personal data that you provide in order to manage the employment relationship, ad to manage the payroll, administration and payments, as well as the company’s compliance with the tax and labor obligations, access control, training and professional development, and the prevention of occupational hazards.

The personal data provided will be kept on file for as long as the employment relationship continues to exist. If, after termination of the employment relationship, you decide to cancel your personal data, then it will be kept until the legal deadlines stipulated by the accounting, tax and labor regulations have expired. Once these deadlines have elapsed, your data will be deleted from our system.

What is the legal basis for processing your data?

The legal basis for the processing of your data is the implementation of an employment contract as well as the fulfilment of a legal obligation of the data controller.

In addition, the processing of your fingerprint is a voluntary control system based on the employee’s consent. Objection to processing does not result in any consequences for the employee.

To which recipients will your data be communicated?

The transfers are made as necessary to public authorities as required by law: Tax Agency, Social Security, Mutual Insurance, etc.

Data are also transferred for legitimate purposes related with the company’s activity:

It will be necessary to communicate the bank details (tax ID no., name and family names, and account number) to the financial entities in charge of the payment of the salaries.
Likewise, in cases where it is necessary to justify personnel expenses in any subsidy, training activity or project financed with public funds, payroll data might be communicated to the public administrations responsible for the evaluation of such subsidies and/or projects, in compliance with applicable legislation.

We do not plan to transfer personal data internationally.

Processing of data of “Job Applicants”

What kind of personal data do we process?

Identification data: name, national ID card number, date of birth, address, telephone number, email address, image.
Data on personal characteristics: Sex, marital status, nationality, age, date and place of birth.
Academic and professional data: profession, position, experience, qualifications.

For what purpose do we process your personal data?

We process the personal data that you provide to us for the management of the company’s recruitment processes.

The personal data provided will be kept as long as the data subject has not revoked consent, so that we can continue keep their curriculum vitae on file for future selection processes. If you choose to cancel your personal data, then it will be deleted from our job applicant database.

What is the legal basis for processing your data?

The legal basis for the processing of your data is the express consent requested.

To which recipients will your data be communicated?

Your data could be transferred to other companies in the NOGAR group, so that you can participate in recruitment processes. At the end of this document you can consult an updated list of the companies that make up the NOGAR group.

We do not plan to transfer personal data internationally.

Processing of data for “business activity coordination”

What kind of personal data do we process?

Data on employees of subcontractors such as:

Identification data: name, national ID card number, date of birth, address, telephone number, email address, image.
Data on personal characteristics: Sex, marital status, nationality, age, date and place of birth.
Academic and professional data: profession, position, experience, qualifications.
Employment data: Forms TC1 and TC2, and payroll data. Data on CR policy

For what purpose do we process your personal data?

To carry out our obligations as main contractor and/or head of the workplace. Among other purposes, for the prevention of occupational risks and compliance with obligations in social and labor matters, social security, health monitoring, coordination of business activities with workers of auxiliary companies and preparation of reports.

The personal data provided will be kept for as long as the contractual relationship with the subcontractor continues to exist and the legal periods defined by accounting, tax and labor regulations have not expired.

What is the legal basis for processing your data?

The legal basis for the processing of your data is the implementation of a contract between the data subject and the data controller, as well as the fulfilment of a legal obligation of the controller.

To which recipients will your data be communicated?

Your data will not be transferred, except when required by law.

We do not plan to transfer personal data internationally.

Processing for “security purposes”

What kind of personal data do we process?

Data of employees, customers, associates, suppliers, job applicants and visitors in general to the organization’s facilities, including:

Identification data:
1. Access control: name, national ID card number, date of birth, address, telephone, email address, signature
2. Video surveillance: image

For what purpose do we process your personal data?

The purpose of the processing is to maintain security at the facilities and control of entries to the company’s premises, as well as the improvement and control of business processes, through the capture and recording of images by a closed-circuit video camera system (video surveillance).

The personal data provided will be kept on file for the legally established period. The images are kept on file during the periods stipulated by law (one month). The images may be kept on file for longer than one month by blocking them for the purpose of making them available to the competent authorities during the limitation period for the corresponding actions.

What is the legal basis for processing your data?

The legal basis for processing your data is the legitimate interest of the data controller.

To which recipients will your data be communicated?

No transfers are made, except those that are strictly necessary: to the Security Forces, as well as to Courts and Tribunals when required by law.

We do not plan to transfer personal data internationally.

Processing of “DUE”

What kind of personal data do we process?

Identification data of passengers and crew members of the vessels, such as: name, national ID card number, nationality.

For what purpose do we process your personal data?

The personal data provided will only be used by us as agents, to fulfil our obligations as reporting entities and to submit the DUE and its accompanying documentation.

We inform you that you, as shipowner/captain, are responsible for ensuring that the information submitted is up-to-date and that you are in possession of the documentation required by the maritime authorities, by the port authorities, by the organizations responsible for police and security matters, as well as by any other administration which, in accordance with its powers, is the recipient of the information contained in the DUE.

The personal data provided will be kept on file for a period of 5 years.

What is the legal basis for processing your data?

The legal basis for the processing of your data is the fulfilment of a legal obligation on the part of the data controller.

To which recipients will your data be communicated?

The data will be transferred to the Port Authority, to the General Directorate of Ports and Merchant Marine, as well as to the security forces and agencies.

No other transfers are made, except those required by law to public bodies.

We do not plan to transfer personal data internationally.

What are your rights when you provide us with your data?

Pursuant to applicable data protection legislation, you have a number of rights related with the processing of your personal data. The exercise of these rights will be free of charge for you, except in cases in which manifestly unfounded or excessive requests are made, especially if they are repetitive.

These rights are as follows:

Right to information: You have the right to be informed in a concise, transparent, intelligible and easily accessible manner, in clear and simple language, about the use and processing of your personal data.
Right of access: You have the right to ask us at any time to confirm whether we are processing your personal data, to provide you with access to your personal data and information about its processing and to obtain a copy of the data. Copies of your personal data provided by us will be free of charge, although requests for additional copies may be subject to a reasonable charge based on administrative costs. We may ask you to prove your identity or require you to provide further information that is necessary for processing your request.
Right of rectification: You have the right to request the rectification of inaccurate, outdated or incomplete personal data concerning you. You may also request that personal data that is incomplete be completed, including by submitting an additional declaration.
Right of deletion: You have the right to request the deletion of your personal data when, among other reasons, the data is no longer necessary for the purposes for which it was collected. However, this right is not absolute, so that our organization may continue to keep you data on file, properly blocked, in the cases stipulated in applicable regulations.
Right to restrict processing: You have the right to request that we restrict the processing of your personal data. This means that we may continue to keep your data on file, but not carry out further processing if any of the following conditions are met:
- if you challenge the accuracy of the data, for a period of time that allows the data controller to verify the accuracy of the data;
- if the processing is unlawful and you object to the deletion of the data, but instead request restriction of use of your data;
- if our entity no longer needs the data for the purposes of processing, but you need the data for the preparation, filing or defense against claims;
- If you have objected to the processing, while we verify whether our entity’s legitimate reasons take precedence to yours.
Right to data portability: You have the right to have your data transmitted to another data controller in a structured, commonly used and machine-readable format. This right applies where the processing of your personal data is based on consent or on the performance of a contract, and where this processing is carried out by automated means.
Right of opposition: This right allows you to object to the processing of your personal data, including profiling. We will be obliged to take your right into account unless we have demonstrated legitimate reasons for the processing or for the preparation, filing or defense against claims before processing your data.
Right to opt out of automated decisions, including profiling: This right entitles you to refuse to be subject to a decision based solely on automated processing, including profiling, when such decisions have legal effects or affect you in a similar way. This right applies unless such a decision is necessary for the conclusion or implementation of a contract, is authorized by law or is based on consent.
Right to revoke consent: Where we have obtained your consent to process your personal data in connection with certain activities (for example, for the purpose of sending you marketing communications), you may revoke your consent at any time. If you do so, then we will cease to carry out data processing for that particular activity for which you had previously granted consent, unless there is another reason that justifies the continued processing of your data for these purposes. If there is one, then we will notify you of this situation.
The right to file a complaint with an oversight authority: Usted tiene derecho a presentar una reclamación ante la Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid, 901 100 099 – 912 663 517 (www.agpd.es), o en la en la dirección electrónica: https://sedeagpd.gob.es/sede-electronica-web/vistas/formQuejasSugerencias/seleccionarQuejaSugerencia.jsf

You may exercise the aforementioned rights by sending a communication to our Customer Service Department, or by sending an e-mail to: rgpd@gruponogar.com, enclosing a document proving your identity and providing the details necessary to process your request.

Data subjects can obtain additional information about their rights on the website of the Spanish Data Protection Agency, www.agpd.es.

Annex I: NOGAR Group companies

NOGAR GROUP is the trade name under which the following group of companies operates:

SERVINOGA, S.L.

Tax ID Code: B36301109
Address: Commercial Pier, unnumbered, 36900 Marín – Pontevedra.
Contact telephone: 986880600
Activity: Holding company for the shares of related companies, which in turn serves as the company in charge of monitoring and managing the group’s progress.

CEFERINO NOGUEIRA, S.A.

Tax ID Code: A36023265
Address: Commercial Pier, unnumbered, 36900 Marín – Pontevedra.
Contact telephone: 986880600
Activity: Shipping agent, land and sea transport, warehousing, forwarding, ship chartering, commercial agency, coordination of international trade.

GALIGRAIN, S.A.

Tax ID Code: A36184943
Address: Commercial Pier, unnumbered, 36900 Marín – Pontevedra.
Contact telephone: 986880600
Activity: Stevedoring, loading and unloading of ships, freight forwarding, handling and storage of all types of goods.

INTERNACIONAL DE COMERCIO Y SERVICIOS, S.L.

Tax ID Code: B36006468
Address: Commercial Pier, unnumbered, 36900 Marín – Pontevedra.
Contact telephone: 986880600
Activity: Marketing of raw materials for animal feed.

COMPAÑIA DE COORDINACION DEL COMERCIO INTERNACIONAL, S.L.

Tax ID Code: B36002921
Address: Commercial Pier, unnumbered, 36900 Marín – Pontevedra.
Contact telephone: 986880600
Activity: Import and marketing of tropical timber.

INMOBILIARIA PONTENO, S.L.

Tax ID Code: B36007029
Address: Commercial Pier, unnumbered, 36900 Marín – Pontevedra.
Contact telephone: 986880600
Activity: Acquisition, purchase and sale, development, construction and dealing in real estate and real estate trade in general. Technical assistance in the development of the different construction projects carried out by the different companies of the group, mainly warehouses.

COMPLEJO INDUSTRIAL DE CAMPAÑO, S.A.

Tax ID Code: A36008423
Address: Commercial Pier, unnumbered, 36900 Marín – Pontevedra.
Contact telephone: 986880600
Activity: Bulk storage center.

EXPLOTACIONES FORESTALES DE GALICIA, S.L.

Tax ID Code: B36002244
Address: Commercial Pier, unnumbered, 36900 Marín – Pontevedra.
Contact telephone: 986880600
Activity: Forestry activity.

CESUNOGA, S.L.

Tax ID Code: B36383917
Address: Commercial Pier, unnumbered, 36900 Marín – Pontevedra.
Contact telephone: 986880600
Activity: Holding company of the shares of “Inversiones Gallegas del Cable SA”

COMPAÑIA DE PROMOCION Y FINANCIACION COMERCIAL E INDUSTRIAL, S.A.

Tax ID Code: A36006179
Address: Commercial Pier, unnumbered, 36900 Marín – Pontevedra.
Contact telephone: 986880600
Activity: Holding company of both movable assets and real estate

NOGARTRAIN, S.A.U.

Tax ID Code: A94115847
Address: Commercial Pier, unnumbered, 36900 Marín – Pontevedra.
Contact telephone: 986880600
Activity: Rail freight transport services