EOS CORRUGATED GROUP EVO SAS informs data subjects, through the present Privacy Policy, on the data processing undertaken in the course of its business activities. To this end, we define the context in which personal data are processed and explain, in a transparent and concise way, both the rights that protect data subjects with regard to this processing and the guarantees related to the application of the processing data principles. Which are the personal data we process? The information we process may be obtained directly from data subjects, the legal entity for which they work, a colleague or a public or private trusted source, after having obtained their consent to give us their personal data, if required to do so in accordance with the applicable law. We specifically inform you that in our systems we treat information referred to:

• Identification details, commercial and administrative data: name, surname, telephone number, address, email, etc.
• Information related to the data subject’s occupation: the company he works for, the role or position within the company, his specific department, as well as any other information provided during the contractual or business relationship. Data subjects must know that if they give us personal details of other people in this context, such as their colleagues or company employees, these must also have knowledge of all the content of this Privacy Policy.
• Information on the activities or interactions with us concerning any services provided by the company.
• Curriculum details the data subject spontaneously may have given us on paper or automated support through the website or via email or any recruitment process he may participate in.

Which is our purpose for processing personal data and why is it legal and justified? In EOS CORRUGATED GROUP EVO SAS we only process personal data if we have an adequate justification and if permitted under applicable law. Thus, we use solely and exclusively personal information if:

• We have previously obtained consent.
• Processing is essential to fulfil the acquired contractual obligations or to perform pre-contractual actions, if so required by the data subject.
• Processing is imperative to fulfil our legal obligations.
• Processing is essential to fulfil actions taken in the public interest or in the exercise of public authorities that we may be given.
• Processing is necessary to satisfy legitimate interests and does not unduly affect their interests, rights, and fundamental freedoms.

We inform you that the current legal basis for processing personal data used by EOS CORRUGATED GROUP EVO SAS results from its commercial relationship, so that we can manage, perform, improve and fulfil our obligations. The legal basis related to business notifications, communications and actions are to satisfy legitimate interests. In the context of certain communications, we may base data processing on the express and implied consent, previously requested and freely given by the data subject. In relation to curriculum management, our legal basis results from the consent given by the data subject and the legitimate interest that allows applicants to participate in the different recruitment processes. Objectives of data processing EOS CORRUGATED GROUP EVO SAS has the objective of processing personal data in a transparent, legal and fairly manner, supervising its accuracy, integrity and confidentiality and using only the necessary data related to the purposes for which they are processed. Specifically, we process data to:

• Manage the relationship between the company and clients within the services we provide, commercial offers, customer management, payments organisation, compliance of accounting and tax requirements, billing and any other actions related to the initial provision of services, including those of commercial nature.
• Manage the relationship between the company and suppliers within the services required, including budget requests, orders, purchase management and any other actions related to the initial provision of services.
• Reply to data subjects’ requests received in person or in an automated way and give them effective support.
• Improve the quality of our interactions and services by adapting our offers to their specific needs.
• Manage, schedule, interact and communicate with the different actors.
• Archive and keep the registers that constitute the company records and allow the development and improvement of its business activities. In order to maintain the accuracy of personal data, we may ask data subjects to confirm the recorded information, although we would appreciate that they spontaneously report any changes in their personal circumstances so that we can keep this data updated.
• Any other purpose that may be required by law and the relevant authorities.

Who has access to personal data and to who are they transferred? In EOS CORRUGATED GROUP EVO SAS we commit ourselves to under no circumstances sell, disseminate or transfer your personal data to third parties who do not have any connection with us. Over the course of our activities and in order to achieve the purposes described above and for which personal data are conceived, these can be consulted by the following categories of recipients or transferred to them if necessary:

• To our product suppliers or the brands that manufacture or represent these products.
• To the brand distributor in order to offer him warranty and after-sales services, to keep him informed and to conduct customer satisfaction surveys on the offered products and services.
• To the group of enterprises we belong to (GRUPO EOS).
• To our staff, that means, those people who work in EOS CORRUGATED GROUP EVO SAS
• To our independent agents or intermediaries, if any.
• To our IT systems and cloud services suppliers, lawyers and external consultants.

In any case, we remind you that the third parties mentioned above are also bound by contract to protect the confidentiality and security of your personal data in compliance with applicable law. How do we protect personal data? EOS CORRUGATED GROUP EVO SAS has the adequate organisational and technical measures to ensure the security and confidentiality of your personal data subject to processing. These measures take into account the nature, scope, context and purposes of the processing as well as the risk of varying likelihood and severity for the rights and freedoms of individuals. The controller and the processor shall implement appropriate organisational and technical measures to ensure a level of security adequate to the risk and to the latest technological developments. How long do we retain personal data? We will only keep your personal data the necessary time to fulfil the purpose for which they have been collected, to meet the legal requirements and as long as you do not request their deletion. In the event that the legal basis for the processing data is a contract concluded between you or your enterprise and our company, the data retention period will be the same as for the contract term (we will add another period that will reflect the prescription of legal claims referred to this contract). When they are no longer necessary for this purpose, personal data will be deleted with appropriate security measures to ensure the pseudonymisation or the absolute destruction of data. Data provided for commercial and promotional purposes will be kept and processed beyond the termination of the commercial relationship until the data subject withdraws his consent and without prejudice to the exercise of the rights that restrict or delete this processing. Which rights are data subjects entitled to and how can they exercise them? Data subjects can exercise the following rights under the conditions and within the limits defined by law:

• To access their data: data subjects have the right to access and know, amongst others, which personal data relating to them we are processing as well as the purposes for which they are processed.
• To request the rectification of their data: data subjects have the right to obtain the rectification of inaccurate or incomplete data relating to them, as well as the updating of those data that do not correspond to their current situation.
• To request the removal of their data: data subjects can request the removal of their data when, inter alia, they consider that it is no longer necessary for the purposes they were collected or when they withdraw their consent for the processing.
• To request the restriction of processing under certain circumstances: data subjects will have the right to request the restriction of processing, in which case data will be kept, as specified by the RGPD (Spanish acronym for General Data Protection Registry) for the exercise or defence of claims, with the purpose of protecting the rights of another natural or legal person and for reasons of public interest or in compliance with a legal obligation.
• To data portability under certain circumstances: data subjects shall have the right to have the data given to us transferred in a structured format of common use and machine-readable. In this case, data has to be directly transferred from EOS CORRUGATED GROUP EVO SAS to another processing controller.
• To object to processing under certain circumstances and for reasons relating to his particular situation: data subjects shall have the right to object to the processing of their data. In such cases, we would stop processing them, unless there are compelling legitimate grounds or the exercise or defence of potential claims are going to be undertaken.
• They also have the right to withdraw consent at any time, without affecting the lawfulness of previous processing based on that consent.
• Data subjects have the right to complain to the control authority (aepd.es) if they consider that the processing is not in accordance with the regulations in force.

If you have any questions or you wish to exercise the rights previously mentioned, you can send an email to [email protected] or a letter to the address 142 Avenue Louis Néel Zone du Lac 07000 PRIVAS. In both cases, also send the adequate documents that identify you. How will you be informed of any changes in the Privacy Policy of EOS CORRUGATED GROUP EVO SAS? You will be informed in advance of any future changes or addition to the processing of personal data undertaken by EOS CORRUGATED GROUP EVO SAS through an individual notification or our usual channels of communication, such as email or our website.