Redegal

Your privacy is a priority for REDEGAL, a company based in Spain with registered office at [insert address] and tax identification number A32318354 (hereinafter, the “Company”). The Company is the Data Controller for the personal data of applicants (the “Applicants”) and is committed to respecting such data, handling it with the utmost care, and providing the highest level of protection in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “GDPR”), as well as applicable national legislation.

This privacy notice provides information about the personal data we collect, the purposes for which it is processed, your rights, and how you can exercise them. Please read the following carefully to understand our views and practices regarding your personal data and how we treat it. Any questions regarding the processing of your personal data may be sent to the following email address: rrhh@redegal.com.

1. Purpose of Processing and Legal Basis

The Company collects and uses your personal data in connection with your application for a current or future position at the Company. The legal basis for processing your personal data for an active application is the performance of pre-contractual measures (Article 6.1(b) GDPR). The legal basis for processing your data (retention) for future vacancies is your consent (Article 6.1(a) GDPR). Certain information (e.g., visa status, work permits, etc.) is collected and processed to comply with a legal obligation (Article 6.1(c) GDPR).

2. Personal Data Processed

The Company processes the following categories of personal data as part of its recruitment activities:

Personal identification data;

Address and email;

Phone number;

Video (if interviews are conducted via video);

Demographic characteristics;

Nationality and, if necessary, proof of identity, work permit, and residence permit (mandatory inspection under foreign labor laws);

Curriculum vitae, cover letter, academic qualifications/training, and professional experience;

Information shared during interviews, in your CV, or via correspondence;

Photographs;

Psychological data;

Hobbies and interests;

Publicly accessible information about you on the internet;

Criminal record certificate (if legally required);

References (only with your consent);

Data from visits to our website or our Recipients’ websites (e.g., traffic data, location data, weblogs, etc.);

Social media data (LinkedIn).

3. Recipients

The Company may grant access to your personal data to subcontractors for processing on our behalf and in accordance with our instructions. Depending on your specific circumstances, one or more of the following may be recipients of your data:

Factorial HR, HR platform, Spain

SendGrid (Twilio), email delivery service, Ireland

Amazon Web Services (AWS), web hosting, Germany

Microsoft Azure, Germany

4. Automated Decision-Making/Profiling

Some of our providers enable us to pre-select suitable candidates based on criteria explicitly defined by us or commonly associated with the relevant position. The candidate screening process is automated; however, all final hiring decisions are made by our staff. This process is based on our legitimate interest in identifying candidates most likely to be hired. It does not evaluate key characteristics of individuals and is fully anonymous.

5. Security

The Company has adopted appropriate measures to ensure all personal data is securely stored, including safeguards to prevent accidental loss, unauthorized use, or access. We restrict access to your personal data to those with a genuine business need to know. Those processing your information do so only in an authorized manner and are bound by a duty of confidentiality.

The Company also has procedures in place to respond to any suspected data security breaches. We will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

6. International Data Transfers

The Company hosts its platform and personal data within the European Economic Area, specifically in the EU-West1 region of Amazon Web Services, located in Frankfurt, Germany.

7. Data Retention Period

If your application is successful, all information obtained during the selection process will be included in your employee file. If your application is not successful, we will not retain your personal data longer than necessary for the purposes for which it was collected, unless you have given us consent to do so.

8. Your Rights

Under the GDPR, you have certain rights in relation to how we process your personal data:

Right to be informed: You have the right to receive clear, transparent, and easily understandable information about how we use your personal data and your rights.

Right of access: You have the right to access your personal data.

Right to rectification: You have the right to have your personal data corrected if it is inaccurate or incomplete.

Right to erasure (“right to be forgotten”): This allows you to request the deletion of your personal data where there is no compelling reason for us to continue processing it. This is not an absolute right and is subject to exceptions.

Right to restrict processing: You have the right to block or suppress further use of your personal data. When processing is restricted, we may still store your data but not use it further.

Right to data portability: You have the right to obtain and reuse your personal data for your own purposes across different services.

Right to object to processing: You have the right to object to certain types of processing.

Right to lodge a complaint: You have the right to file a complaint with your national data protection authority regarding how we handle your personal data.

Right to withdraw consent: If you have given your consent to something we do with your personal data, you have the right to withdraw that consent at any time.

Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal (or similarly significant) effects on you.

The Company typically responds to requests and provides information free of charge. However, we may charge a reasonable fee to cover administrative costs if:

the request is clearly unfounded, excessive, or repetitive; or

multiple copies of the same information are requested.

You can exercise your rights by sending a written request to the following email address: miguel.romero@redegal.com. In some cases, your request may be denied if it involves the deletion of data necessary to fulfill legal obligations.

9. Complaints to the Data Protection Supervisory Authority

The Company aims to address any concerns or questions you may have about our use of your personal data. Every data subject has the right to lodge a complaint with the relevant supervisory authority. If you believe our processing of your personal data violates data protection laws, you may file a complaint with the supervisory authority in your country of residence, place of work, or where the alleged violation occurred.