Privacy Policy – WR Freiria

1. WEB PRIVACY POLICY

v2 (03/10/2025)

IMPORTANT NOTICE: Although this policy has been translated into English language, the Spanish version of the policy shall take precedence. Only the Spanish language shall be the official, controlling, governing and recognised language of all documents of the WR FREIRIA GROUP. In the event of any dispute between the Spanish version and the English version, the Spanish version shall prevail.

In compliance with Regulation (EU) 2016/679 of 27 April 2016, (hereinafter ‘RGPD’) and the Organic Law 3/2018, of 6 December, on Data Protection and Guarantee of Digital Rights (hereinafter, LOPDgdd), you are provided with the following information on our processing of your personal data on this website.

The Information Security Policy PG-05.01 is available to interested parties.

1.1 DATA PROCESSING CONTROLLER

WR FREIRIA, S.L. (hereinafter, indistinctly, ‘WR FREIRIA’ or the ‘Company’)
Tax ID (CIF): B36843829
Address: Lugar Cerquillo 33, 36475, Salceda de Caselas (Pontevedra)
Email: protecciondatos@wrfreiria.com

1.2 PURPOSES OF YOUR PERSONAL DATA PROCESSING

The data that the Entity will keep about you are your name, address, phone number, and email address.

The processing of personal data carried out by WR3 PROGWEB S.L. is based on the following lawful grounds, in accordance with Article 6 of the General Data Protection Regulation (EU) 2016/679 (GDPR):

The consideration of your application when you send us your CV is based on your consent (Article 6(1)(a) GDPR).
The operation and maintenance management of the website is carried out on the basis of the company’s legitimate interest in ensuring the proper functioning and security of its digital services (Article 6(1)(f) GDPR).
The observation of your visit, browsing behavior and interaction with website content (for example, through analytics or cookies) is carried out only with your consent (Article 6(1)(a) GDPR).
Responding to requests for information, queries or claims submitted through the website or by telephone is based on your consent (Article 6(1)(a) GDPR).
Responding to and managing commercial proposals or quotations made through the website or by telephone is based on the performance of pre-contractual measures at the request of the data subject (Article 6(1)(b) GDPR) or, where applicable, on the data subject’s consent (Article 6(1)(a) GDPR). De igual modo, es posible que se nos exija utilizar y retener información personal por motivos legales y de cumplimiento.

The Entity will process your data and the information provided for the selection processes with the utmost confidentiality, adopting the necessary technical and organizational measures to prevent loss, misuse, alteration, and/or unauthorized access.

1.3 RETENTION PERIOD OF YOUR DATA

The Company shall process your personal data as long as it is necessary, depending on each case.

We shall keep for a maximum term of 2 years the CVs considered to be of interest in relation to technical profiles, and a maximum term of 2 years for non-technical profiles.
Regarding queries and claims, we shall retain your data once we have replied; they shall be blocked until the prescription of eventual responsibilities of our processing.
With regard to commercial proposals made, we shall treat your personal data during the term of the contract, and then keep them blocked for a period of 6 years and until the prescription of possible liability claims, unless no agreement is reached, in which case we shall securely and immediately destroy your personal data.
With regard to web management processing through cookies, we refer to the Cookie Policy in which you may find detailed information on the permanence or duration of each cookie on your equipment.

1.4 DATA UPDATE

Please notify us immediately of any changes in your data so that the information being processed is always up to date and accurate. In this regard, you represent and warrant that the information and data you have provided are accurate, current and truthful.

1.5 LEGITIMATE BASES OF OUR PERSONAL DATA PROCESSING

The Company processes your personal data for different purposes. Each processing activity must rely on a lawful basis as established by the applicable data protection regulations. The Group
Companies rely on the following legal bases, in accordance with Article 6 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”):

Consent (Article 6(1)(a) GDPR): You have provided your unambiguous and express
consent to the processing of your personal data for a specific purpose.
– E.g. by filling in the application form in the offers of employment on the website.
– – Consequence of failure to supply data: Data (and consents) requested are necessary for the processing and purposes indicated, so the omission of any of them shall prevent us from performing the aforementioned purpose. The acceptance of this processing is voluntary and your refusal shall not entail any negative consequence for you.
Legal obligation (Article 6(1)(c) GDPR): The Company is obliged in some cases, by virtue of different legal regulations, to process and/or transfer certain personal data to different entities. E.g. to the Tax Agency or to the Law Enforcement Forces and Agencies, at their request.
Legitimate interest (Article 6(1)(f) GDPR): The Company shall process your personal data based on a real and legitimate interest in doing so and your rights and interests do not override such interest.
– E.g. when managing your queries within our group of companies or sharing your CV also within our group of companies.
– E.g. when processing your professional location data as a contact person for a company.
– E.g. when consulting the social networks provided in order to assess certain elements necessary for your candidacy in the job offer to which you have applied.
Performance of a contract (Article 6(1)(b) GDPR): The company shall process your personal data in order to manage, if agreed, the contractual relationship with you as a consequence of the proposal sent to the company. – – – E.g. if a commercial contract is signed with you.

The personal data requested are adequate, relevant and strictly necessary for the purposes described. In no case are you obliged to provide them; however, failure to do so may affect the provision of the requested service or make it impossible to perform it.

1.6 RECIPIENTS

The Company may share or transfer your personal data to third parties only in the cases and under the conditions established by law, in accordance with Articles 28 and 6 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

The Company shall transfer your personal data to third parties in the following cases:

Based on Consent (Article 6(1)(a) GDPR): When you have given your explicit consent for this purpose. For example, if you have authorised it, your CV data may be shared with contracted temporary employment agencies.
By Legal Obligation (Article 6(1)(c) GDPR): When the Company is required to disclose data by virtue of applicable law or at the request of competent authorities.
For Legitimate Interest (Article 6(1)(f) GDPR): When there is a legitimate business interest, your CV data may be shared internally within the Group with the following companies established in Spain: WR FREIRIA Galvanic, S.L., WR FREIRIA Stamping, S.L., WR FREIRIA Inyección, S.L., and WR FREIRIA Componentes, S.L., provided that such interest does not override your own rights and freedoms.

1.7 PROVISION OF SERVICES BY THIRD PARTIES WITH ACCESS TO PERSONAL DATA

In certain cases, the Company engages external companies or service providers that may have access to personal data in order to assist in the provision of specific services — in particular, IT support and the hosting of this website.

Whenever such access occurs, it is carried out under a written data processing agreement that ensures compliance with the confidentiality, data protection, and security obligations established in Article 28 of the General Data Protection Regulation (EU) 2016/679 (GDPR). These agreements guarantee that any processing of personal data to which these providers have access is performed solely for the purpose of delivering the contracted service and always in accordance with the applicable data protection legislation.

The list of service providers who have access to personal data, together with the description of the services they provide, is available upon request by contacting the Company’s legal department through the email address indicated in this document.

1.8 INTERNATIONAL DATA TRANSFER

In some cases, the Company engages external companies or service providers that may have access to your personal data in order to collaborate with us in the provision of specific services — in particular, IT support and the hosting of this website. With all such providers, the Company signs the corresponding confidentiality and data-processing agreements to ensure that any access to and use of personal data for the provision of these services is carried out in full compliance with applicable data-protection laws.

Where these service providers are located outside the European Economic Area, all international transfers of personal data are carried out in accordance with the requirements set out in Chapter V of the General Data Protection Regulation (EU) 2016/679 (GDPR), ensuring that appropriate safeguards are implemented, such as Standard Contractual Clauses approved by the European Commission or other mechanisms recognized by the GDPR.

The list of providers who have access to your personal data, as well as the services provided by each of them, is available upon request to the legal department at the email address indicated in this document.

1.9 SECURITY

WR FREIRIA takes all necessary security, technical and organizational measures to protect your personal data against loss or abuse. For example, your data is stored in a secure operating environment without public access. In some instances, your personal data is encrypted using Secure Socket Layer (SSL) technology during transmission. This means that an approved encryption procedure is used for communication between your computer and the WR FREIRIA servers, as long as your browser supports SSL.

If you wish to contact WR FREIRIA by email, please note that we cannot guarantee the confidentiality of the information sent. Third parties can read the contents of email messages.
Therefore, we recommend that you send us confidential information by regular mail only.

1.10 YOUR RIGHTS REGARDING OUR PROCESSING OF YOUR PERSONAL DATA

In accordance with Articles 12 to 22 of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the criteria established by the Spanish Data Protection Agency (AEPD), you may exercise the following rights in relation to the processing of your personal data:

Right to be Informed (Transparency): You have the right to obtain clear, concise, and transparent information about how the Company processes your personal data, including the purposes, lawful bases, recipients, retention periods, and your rights.
Right of Access (Article 15 GDPR): You have the right to obtain confirmation as to whether the Company is processing your personal data and, if so, to access such data and receive a copy of the information we hold about you. The Company shall respond to any access request within one month.
Right to Rectification (Article 16 GDPR): You have the right to request the correction or completion of any inaccurate or incomplete personal data concerning you.
Right to Erasure or “Right to be Forgotten” (Article 17 GDPR): You have the right to request the deletion of your personal data when, among other reasons, such data are no longer necessary for the purposes for which they were collected, or you withdraw the consent on which the processing is based.
Right to Restriction of Processing (Article 18 GDPR): You may request that the processing of your data be restricted in certain circumstances—for example, while the accuracy of the data is being verified or when you have objected to processing. In such cases, your data will only be retained for the exercise or defence of legal claims.
Right to Data Portability (Article 20 GDPR): You have the right to obtain the personal data you have provided to the Company in a structured, commonly used, and machine- readable format and to transmit those data to another controller where technically feasible.
Right to Object (Article 21 GDPR): You may object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the Company’s legitimate interests. In such cases, the Company will cease processing your data unless compelling legitimate grounds prevail or for the exercise or defence of legal claims.
Right not to be Subject to Automated Decisions (Article 22 GDPR): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you in a similar way. The Company will inform you if such processes exist.
Right to Withdraw Consent (Article 7(3) GDPR): When the processing is based on your consent, you have the right to withdraw it at any time without affecting the lawfulness of the processing carried out prior to such withdrawal

If you believe that your rights have not been properly respected, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD), available at www.aepd.es You may exercise your data protection rights at any time by sending a written communication to the Company’s registered office or by email to the address indicated in this Privacy Policy. Requests must include proof of identity and will be processed free of charge within the statutory time limits.