1. USER INFORMATION
Who is responsible for processing your personal data?
Grupo Xtra is the DATA CONTROLLER for the USER's personal data and informs you that this data will be processed in accordance with the provisions of Regulation (EU) 2016/679, of April 27 (GDPR), and Organic Law 3/2018, of December 5 (LOPDGDD).
Why do we process your personal data and for what purpose?
Depending on the form through which we obtained your personal data, we will process it confidentially for the following purposes:
In Contact forms, on the Home and Contact pages
- Send commercial advertising communications via email, fax, SMS, MMS, social networks, or any other electronic or physical means, present or future, to customers, enabling commercial communications related to products or services similar to those initially contracted with the customer (Art. 21.2 LSSI). (based on the controller's legitimate interest, Art. 6.1.f GDPR)
In forms to apply for a job vacancy, on the Jobs page
- We will use the information provided to evaluate the application and manage your participation in ongoing staff selection processes. (based on the consent of the data subject given by submitting their application through the corresponding form, Art. 6.1.a GDPR).
- The data provided may be stored to assess your suitability for future vacancies that may arise in our company, thus avoiding having to request your information again. This processing will only be carried out during the specified retention period outlined below. (based on the controller's legitimate interest in maintaining a candidate database to streamline future selection processes, Art. 6.1.f GDPR).
How long will we keep your personal data?
They will be retained no longer than necessary to maintain the purpose of the processing or while there are legal requirements for their custody, and when they are no longer necessary, they will be securely deleted to ensure data anonymization or total destruction. Specifically, contract-related data will be retained for at least three years after the service ends, in accordance with Royal Decree 933/2021, of October 26. Grupo Xtra may retain the data for a maximum of five years if necessary.
To whom do we provide your personal data?
No personal data communication to third parties is planned unless necessary for the development and execution of the purposes of the processing, to our service providers related to communications, with whom the CONTROLLER has signed confidentiality and data processing contracts required by current privacy regulations. These service providers include technical services, legal services, or SaaS solution providers such as Microsoft.
What are your rights?
In accordance with Articles 15 to 22 of the GDPR, the data subject has the following rights regarding the processing of their personal data:
- Right of Access: Data subjects have the right to know whether their data is being processed, as well as to access or obtain a copy of their personal data.
- Right of Rectification: Data subjects may request the correction or update of their data when it is inaccurate.
- Right of Deletion: Data subjects may also request the deletion of their data when, among other reasons, they are no longer necessary for the purposes for which they were collected.
- Right to Portability: Individuals have the right to have the personal data they provided transmitted directly to another controller in a structured, commonly used, and machine-readable format, where technically feasible.
- Right to Restriction: In certain circumstances, data subjects may request the restriction of their data processing, in which case we will only retain it for the exercise or defense of claims.
- Right to Object: In certain circumstances and for reasons related to their particular situation, data subjects may object to their data processing. The data controller will stop processing the data unless there are compelling legitimate grounds or for the exercise or defense of possible claims.
Data subjects may also file a complaint with the Spanish Data Protection Agency (www.aepd.es) if they believe their data protection rights have been violated.
Contact details to exercise your rights:
Grupo Xtra AVDA ELS ARCS, 24 - 46940 Manises (València). E-mail: info@xtra-auto.com
2. MANDATORY OR OPTIONAL NATURE OF INFORMATION PROVIDED BY THE USER
USERS, by ticking the corresponding boxes and entering data in the fields marked with an asterisk (*) in the contact form or presented in download forms, expressly and freely and unequivocally accept that their data is necessary to fulfill their request, by the provider, with the inclusion of data in the remaining fields being voluntary. The USER guarantees that the personal data provided to the CONTROLLER is true and is responsible for communicating any changes to them.
The CONTROLLER informs that all data requested through the website is mandatory as it is necessary to provide an optimal service to the USER. If all data is not provided, it cannot be guaranteed that the information and services provided will be fully tailored to your needs.
3. SECURITY MEASURES
In compliance with current personal data protection regulations, the CONTROLLER is complying with all provisions of the GDPR and LOPDGDD for processing personal data under its responsibility, and explicitly with the principles described in Article 5 of the GDPR, whereby data is processed lawfully, fairly, and transparently concerning the data subject and is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.
The CONTROLLER guarantees that it has implemented appropriate technical and organizational policies to apply the security measures established by the GDPR and the LOPDGDD to protect the rights and freedoms of USERS and has communicated the appropriate information for them to exercise their rights.
For more information on privacy guarantees, you can contact the CONTROLLER through Grupo Xtra AVDA ELS ARCS, 24 - 46940 Manises (València). E-mail: info@xtra-auto.com