1.    INTRODUCTION

At Cerba Internacional S.A. España (hereinafter, Cerba) we are fully committed to the security of your personal data. Protecting the privacy of our users means continuing to maintain our commitment to transparency in the use of their data, all with the aim of reinforcing protection mechanisms, working to offer greater control over the processing of personal data carried out on our website (www.cerba.com).

The following is a description of the practices we use to respect and protect the privacy of our portal users.

2.    IDENTIFICATION AND CONTACT DETAILS OF THE PERSON IN CHARGE

Cerba Internacional S.A. España (hereinafter Cerba), is responsible for the processing of personal data processed through this website. You can find more information by visiting our Legal Notice available on our website.

  • Party responsible for processing personal data: Cerba Internacional S.A. Spain.
  • Spanish tax ID (CIF): A08559932
  • Registered Office: Pza. Llull 7-10, 08203 Sabadell, Barcelona (Spain).
  • Data Protection Contact Person email address dealing with requests related to the protection of personal data: lopd@cerba.com

As a Data Controller, Cerba processes personal data in accordance with the provisions of current regulations regarding personal data protection, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 regarding the protection of natural persons with regard to the processing of their personal data and the free movement of such data (RGPD) and Spanish Organic Law 3/2018 of 5 December regarding the protection of personal data and guarantees of digital rights (LOPDGDDGDDD), for the purposes of which you are provided with the following processing information.

3.    PURPOSES OF THE PROCESSING OF PERSONAL DATA

The processing of personal data included in this website is detailed below:

  • Management of contact and information requests (Request quote, Contact): The website offers several contact forms (Request a quote, Contact us) so that any interested party can contact Cerba to request information or require any assistance derived from the services provided by the entity. The basis for legitimising the processing of the data will be the legitimate interest of Cerba in responding to the contacts or requests sent by users. This data will be kept for the time necessary to comply with the request and for the time established by law, with a minimum duration of 3 years.
  • Management of diagnostic tests requested: Cerba provides users with a portal for consulting the analytical results carried out by the organisation. The basis of legitimacy of the data processing will be the contractual relationship established between the user and Cerba. The data and information related to the management of diagnostic tests will be kept for as long as the relationship between the parties exists and, even then, for as long as the legally established retention periods do not expire.
  • Curriculum vitae management (Work with us): The information collected in the “Work with us” form will be used to manage the personnel selection processes in which the user may fit. The basis of legitimacy of the data processing will be the consent given by the user by selecting the acceptance box of our Privacy Policy before sending the CV. The user will have the right to revoke their consent at any time without affecting the lawfulness of the processing based on the consent prior to its withdrawal. This data will be kept for the time necessary to manage the selection process and will subsequently be destroyed within a maximum period of 1 year.
  • To send you information about our activities and products: The information collected in the forms may be used to send you commercial information about Cerba’s activities, products and services, if you specifically authorise us to do so. The legitimate basis for sending our activities and news will be the explicit consent given by the user by selecting the optional acceptance box at the bottom of the forms provided on the website. The user will have the right to revoke their consent at any time without affecting the lawfulness of the processing based on the consent prior to its withdrawal. These data will be kept as long as the user does not revoke their consent to their processing and for the time established by law, with a minimum duration of 3 years.
  • Management of user registration. The information collected in the registration form will be used to manage the user’s registration in the private area, as well as consultation and access to their results and/or orders placed. The basis of legitimacy of the data processing will be the consent given by the user by selecting the acceptance box of our Privacy Policy before sending the registration. The user will have the right to revoke their consent at any time without affecting the lawfulness of the processing based on the consent prior to its withdrawal. These data will be kept for the duration of the contractual relationship between the parties, as long as the user does not revoke their consent to the processing thereof, and for the time established by law, with a minimum duration of 3 years.
  • To attend to and manage the purchase made by the user through the purchase form located on the website: The user’s personal data will be collected and processed in order to process the order and subsequent payment for the products and services offered on the website. The basis of legitimacy of the data processing will be the execution of a purchase contract to which the interested party is a party. If the user does not provide their personal data, their purchase cannot be processed and the requested service cannot be provided. These data will be kept for the duration of the contractual relationship between the parties and for the time established by law for the fulfilment of tax obligations.
  • Saving the abandoned shopping cart and reminding the user that he/she has left a product in the shopping cart, in case he/she has initiated a purchase by entering the e-mail address. The basis of legitimacy of the data processing will be the legitimate interest of the Data Controller to facilitate as much as possible the purchase of its products for which the user has shown an interest by adding them to the cart. The data will be kept from the moment the user adds the selected product to the shopping cart until the moment he/she confirms the purchase for a period not exceeding five days.
  • Reception, management and resolution of reports of irregularities. Information relating to possible infringements reported by informants will be managed through the channel provided by Cerba. The basis for legitimising the processing of the data will be compliance with a legal obligation based on Law 2/23, of 20 February. The data will be kept for the time necessary to decide whether to initiate an investigation into the facts reported. In any case, if three months have elapsed since receipt of the infringement report and no investigation has been initiated, the data must be deleted, unless the purpose of the storage is to leave evidence of the functioning of the procedure.
  • Investigation of irregularities reported through the irregularity reporting channel. After verifying the origin of the reported facts and determining the existence of solid evidence to support the veracity of the communication, the data provided shall be used to initiate an investigation. The basis for legitimisation is the fulfilment of a legal obligation. Data on unproven facts or untruthful information will be deleted immediately upon becoming aware of such circumstances, unless such untruthfulness could constitute a criminal offence, in which case the information will be stored for as long as is necessary for the duration of the prosecution.

For further information on this processing, please contact our Data Protection Delegate (lopd@cerba).

4.    PURPOSES OF THE PROCESSING OF PERSONAL DATA

The data may be accessed by those suppliers who provide services to Cerba, when the purpose of the processing so requires. Cerba has signed the corresponding data processing contracts with each of the suppliers that provide services to Cerba in order to guarantee that these suppliers will process the data in accordance with the provisions of current legislation. The data may also be communicated to other companies belonging to the Cerba group for the purposes described above. In the event that international data transfers are required, we will inform you and implement security measures to ensure that the transfers are carried out securely.

No other transfers of data are foreseen, except in those cases where there is a legal obligation to do so or to those necessary service providers linked to Cerba.

5.    UPDATING PERSONAL DATA

It is important that in order for us to be able to keep personal data up to date, the user always informs us about changes that in any way affect or include his personal information.

The user guarantees that the personal data provided are truthful and that all the information provided corresponds to their real situation, that they are up to date and accurate. It is necessary to communicate any modification of the same when appropriate.

6.    RIGHTS REGARDING PERSONAL DATA PROTECTION

At Cerba, we guarantee that you can exercise all your rights:

  • Right of access: The right to access your data and obtain confirmation of its processing, as well as a copy of the personal data being processed.
  • Right of rectification: The right to keep your data up to date at all times and to request the rectification of any inaccurate data.
  • Right to erasure: the right to request erasure when the data is no longer necessary for the purposes for which it was collected.
  • Right of limitation: The right to request the limitation of the processing of your personal data when the accuracy, lawfulness or necessity of the data processing is in doubt, in which case the data may be retained for the exercise or defence of claims.
  • Right to object: The right to object to the processing of your personal data when the legal basis for processing is legitimate interest. Cerba will stop processing your data unless it has a compelling legitimate interest or for the formulation, exercise or defence of claims.
  • Right to portability: The right to data portability, where the legal basis that enables us to process your data is the existence of a contractual relationship or your consent.
  • Right to revoke consent: You may withdraw your consent to the processing of your data for one or more of the above purposes at any time.

You may exercise your rights at any time and free of charge by sending an e-mail to lopd@cerba.com indicating the right you wish to exercise and your identification details, or by contacting our Data Protection Officer at the same e-mail address.

You will also have the right to lodge a complaint with the Spanish Data Protection Agency if you consider that a breach of data protection legislation has been committed with regard to the processing of your personal data: www.aepd.es

7.    TREATMENT OF COOKIES

The Cerba website uses cookies. A cookie is a small file that is downloaded and stored on the user’s computer when the user accesses a website. Cookies allow the website, among other things, to store and retrieve information about the browsing habits of the user or their computer and, depending on the information they contain and the way in which they obtain it, they can be used to recognise the user.

You can obtain more information by reading our Cookies Policy.

8.    MINORS

We understand the importance of protecting information relating to minors, especially on the Internet. For this purpose, we make available to you all our contact channels to provide further information, context and explanation by our experts and/or Data Protection Officer.

Anyone who provides data through the forms on this website and accepts its processing declares that they are over 14 years of age, and access to and use of the portal by minors under that age is prohibited. If at any time, the Data Controller detects that a minor under 14 years of age has provided personal data, the data will be cancelled.

9.    SOCIAL NETWORKS

The purpose of tools such as Facebook, LinkedIn, Instagram, etc. or other social networks is to give visibility and dissemination to the activities carried out by our organisation. These tools store personal data on the servers of the respective services and are governed by their own Privacy Policy. It is recommended that you review and read the conditions of use and Privacy Policy of the social network at the time of registration, taking into account the different configuration possibilities in relation to the degree of privacy of the user profile on the social network.

Likewise, the Controller reserves the right to remove from its social networks any information published by third parties that violates the law, incites to do so or contains messages that violate the dignity of persons or institutions, as well as the right to block or denounce the profile author of these messages.

10.    UPDATING THE PRIVACY POLICY

Cerba reserves the right to modify this Policy in order to adapt it to new legislation or jurisprudence. Your rights under this Privacy Policy will not be limited, nor will substantial modifications be made without prior notice to you. All changes to this Privacy Policy will be posted on this page and, if significant, we will provide you with a more prominent notice.

The Privacy Policy was last updated on 10/04/2022.