\ PRIVACY POLICY

1.- Data Controller

ONA ELECTROEROSIÓN, S.A.
Postal address: C/ EGUZKITZA, 1 48200 DURANGO – BIZKAIA (SPAIN)
Email ona@onaedm.com Tel. 946 200 800

2.- How we obtained your data

  • Obtained from the data subject: If you are a current or prospective client or simply a user of our website, you have provided it to us, either offline or online, when requesting our services to allow us to continue our contractual relationship with you, or on contacting us to request information or, for example, if you have come to our offices or plant, you will have provided it to us on entering our facilities as a visitor. Similarly, your data may have been obtained by us through our sales network, after you provided your data to one of our salespeople. We process the following categories of data: identifying information; postal or email addresses; commercial information and economic data. We do not process special category data.
    When you provide us with your personal data, you warrant that you are authorised to provide this information and that the information is true, accurate, complete and up-to-date, that it is not confidential, that it does not violate any contractual restrictions or third-party rights and that you agree not to impersonate other Users.
  • Obtained automatically when visiting our website: If you have provided us with the data through this website, we collect information, for example, when you access the site, when you complete any form with personal data, or when you contact us directly by email.
    When you visit our website, data is sent from your browser to our server, to optimise our services and improve your experience as a user, e.g., when you visit a page or when you log into our Services through third-party services such as social media sites or Google. This data may be automatically collected and stored by us or by third parties on our behalf. This data may include:
    – the user’s IP address
    – the time and date of the visit
    – the URL of the site from which the user came
    – the pages visited on our website
    – information about the browser used (type and version of browser, operating system, etc.).
    – We may process and record such uses, sessions and related information, either independently or with the assistance of third-party services, including through the use of “cookies” and other tracking technologies such as flash cookies and web analytics.
    Our website has social media plug-ins. When you choose to interact with us through a social networking site, we accept no liability for the privacy settings chosen by the user. The social networking site may provide information about your IP address or the pages that you are visiting on our website and it may install a cookie so that they work correctly or, for example, your name will appear in the “likes” that you give or in the comments you post on our page on a social networking site. If you do not want your personal data associated with these “likes” or comments to appear, set up your privacy accordingly to prevent it, pseudonymising your data by, for example, giving yourself a nickname or alias that does not reveal your real name/surname.
    If you log into one of these social networking sites while you are visiting our website, the social networking site may add this information to your profile and said information will be transferred to the social media site. If you do not want that data to be transferred, log out of the social networking site before you visit our websites or open our mobile applications, as we have no power over the way data is collected and transferred through social media plug-ins.
    If, on our official page on a social networking site, the user decides to publish and/or share any text, photos, videos and other types of information and/or content, they will be solely responsible for ensuring that such content complies with the relevant legal regulations. Regarding the data of third parties, remember that you must respect their privacy, taking special care when disclosing or publishing their personal data. Only the owner may authorise the processing of their personal data. On this website and on our official page on social media sites, the user may only publish personal data, photographs, information and other content belonging to or owned by the user or for which they have received third-party authorisation. If you provide us with or publish third-party data, you are responsible for obtaining their prior and express consent to use, disclose it and publish it, and it is your responsibility to inform them that we are processing their data or that you are publishing it. Besides breaching data protection regulations, the disclosure of third-party data without consent may violate the regulations regarding the right to honour, to privacy or to reputation of those third parties.
    In any event, we may delete any content published by the user from this website and our pages on social networking sites when we find that the user has breached the current legislation or the provisions of this privacy policy.
    The social media sites are not hosted directly in our Services. Your interactions with them are governed by their policies, not by ours. Read the privacy policies of these social media sites for detailed information about the collection and transfer of your personal data, your rights and how to configure your privacy settings.
  • Communication by a third party of the data subject’s data: If rather than you, the data subject, it is a third party that provides us with your data, your data may have been obtained by us through our sales network or dealers, after you provided your data to one of our salespeople.

3.- Third-party data

Regarding the data of third parties, you must respect their privacy, taking special care when publishing their personal data. Remember that, as a user, you may only provide or consent to the processing of your personal data, not the data of third parties, and if you provide us with third-party data you are transferring personal data and it is your responsibility to obtain the prior express consent of those third parties to use it and provide it to us, and you are responsible for informing them that their data is being added to our files.
Publishing the data of third parties without their consent may also violate the regulations regarding data protection, the right to honour, to privacy or to reputation of those third parties, rights whose protection is governed by the provisions of Act 1/1982, of 5 May, on civil protection of the right to honour, to personal and family privacy and to reputation.

4.- Data categories

We process the following categories of data: identifying information, professional information, economic and financial data and data on goods and service transactions.

5.- Purpose and legal basis

PURPOSE: To maintain contact and communication, to manage the contractual relationship.
LEGAL BASIS: Contractual relationship.

PURPOSE:
To send prospective clients information about our products and/or services that are similar to those requested, through electronic communications.
In the case of users of the web form to receive our newsletter.
Installation of non-technical cookies.
If you provide us with your CV, to contact you and manage the selection processes we carry out.
LEGAL BASIS: Consent.

PURPOSE: Transfers due to tax regulations.
LEGAL BASIS: Compliance with a regulation or legal obligation.

PURPOSE: To send current clients information about our products and/or services that are similar to those requested, through electronic communications.
Profiling.
Installation of technical cookies.
To conduct opinion/satisfaction surveys.
In the case of users of our website, or the sender or recipient of an email: to handle requests made online and contact you.
LEGAL BASIS: Legitimate interest.

Providing the requested data is mandatory because it is necessary to enter into and/or maintain the contractual/pre-contractual relationship and meet the legal obligations that arise from it; if you do not provide it, we will be unable to provide the service derived from that relationship.
When the legal basis is consent, you may withdraw that consent at any time by sending us an email stating as such to ona@ona-electroerosion.com. This withdrawal does not affect the processing of your data for the other purposes described.
If the basis for said processing of your data is our legitimate interest, we consider this to be proportionate and to have a minimal impact on your privacy. However, your interests, rights and freedoms will always prevail over our legitimate interest, so if you do not wish us to process your data for these purposes, please send us an email stating as such to ona@ona-electroerosion.com and we will abide by this.

6.- Retention period

We will retain any personal data that you provide us until you ask us to delete it. Even if you make such a request, we may retain it for as long as is necessary – while restricting the processing thereof – solely in order to meet the legal/contractual obligations to which we are subject and for the period provided for by law for the limitation periods regarding any liabilities on our part and/or to file or defend ourselves against any claims arising from the relationship maintained with the data subject.

7.- Recipients

We hereby inform you that the data that you provide us may be disclosed to third parties for purposes directly related to the legitimate functions of the transferor and transferee, for example:

  1. To the transport companies responsible for the logistics of the shipping and delivery of our goods.
  2. To banks for the management of collections and payments.
  3. To the entities or organisations to whom we are legally obliged to disclose the data (tax authority, etc.)
  4. To insurance companies for the management and insurance of commercial risks.
  5. In the case of applicants for jobs in ONA ELECTROEROSION who have sent their CVs, their data may be disclosed to temporary employment agencies so that they can hire the candidate during the trial period.
  6. To our subsidiaries in other countries, or to the agents/dealers in our sales network, we will send any queries received via our website that have to be dealt with by them. If this involves an international transfer of data to a country that does not belong to the European Economic Area, the data subject gives their unequivocal consent for said transfer by providing their data.

International Transfers

At ONA ELECTROEROSIÓN, S.A., we ensure that personal data is always processed and stored in the European Economic Area. However, under certain circumstances, we may carry out international data transfers, e.g., if necessary for the execution/performance of a contract, in the interests of the data subject, between ONA ELECTROEROSIÓN, S.A. and another natural person or legal entity, when it is necessary for the performance of a contract between the data subject and ONA ELECTROEROSIÓN, S.A., for example, when we use service providers based outside the European Union, who may have access to personal data so that they are able to provide us with services that support our activity (hosting, housing, SaaS, remote backups, computer support or maintenance services, email clients, sending of emails and email marketing, file transfers, etc.) or for the implementation of pre-contractual measures adopted at the data subject’s request.
These entities may differ and change over time, but we choose entities that either belong to countries that implement a level of data protection that is equivalent to that in Europe or which have appropriate safeguards in order to achieve that level, or it will be carried out on the basis of any exceptions provided for this purpose in the GDPR.

8.- Rights

When applicable, you may exercise your rights of access, rectification, erasure, to restrict and object to the processing, to not be the subject of automated individual decision-making, by writing to the email or postal address that appears at the start of this privacy policy, in both cases submitting a written and signed request and attaching a copy of your ID, passport or other valid identifying document. If your information changes, you must inform us of this at the same address, with the company being held harmless if you fail to do so.
– Right of access: You may ask us what personal data we are processing and even request a copy of it.
– Right to rectification: You may request that we rectify any inaccurate personal data or that we complete any incomplete data, including through an additional declaration.
– Right to erasure (right to be forgotten): You may ask us to erase your personal data when: it is not necessary for the purpose for which it was collected, you withdraw your consent, it has been processed unlawfully or in order to fulfil a legal obligation.
– Right to restrict processing: You may request that we restrict the processing of your data, in which case we will only keep it for the purpose of filing or defending claims.
– Right to object: You may object to any processing of your data if such processing is based on the legitimate interest of the controller of the file or is for marketing purposes.
When we have received any of the above requests, we will reply to you within the legally prescribed period. You may file a complaint with the Spanish Data Protection Agency. If you would like further information about the rights that you can exercise or if you want to request the forms to exercise these rights, you can visit the Spanish Data Protection Agency’s website, www.agpd.es