GRUPO ENPLATER (hereinafter, the Group) is committed to due diligence and compliance with data protection regulations.

Below is detailed information on our confidentiality and personal data protection policy, in compliance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation or GDPR) and Article 11 of Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

The identification and contact details of the companies that make up the Group, and of the Data Protection Officer (DPO), are as follows:

  • Envases Plásticos del Ter, S.A. – C/ Industria, 1, 17257 Torroella de Montgrí (Girona)
  • Envases Plásticos de Aragón, S.L. – Pol. Industrial El Puyalón, 22200 Sariñena (Huesca)
  • Enplater Alta Segarra, S.L.
  • Enplater Grabados, S.L.,
  • Telephone: 972 761 570
  • Email:info@enplater.com
  • DPO contact details: rgpd@enplater.com
  • Data Protection Channel: corporate-line.com/cnormativo-enplater

 

Purposes of processing

The Group will process the information provided by data subjects for the following purposes:

  • Managing your reception, visits and meetings at our facilities.
  • Managing the provision and performance of services and products
  • Managing any type of request, suggestion, complaint or query about our professional services submitted by data subjects; handling it and, where appropriate, forwarding it to the department responsible so that it can be properly dealt with in compliance with the applicable regulatory framework.
  • Information and marketing communications: processing your data in order to inform you about activities, articles of interest and general information related to our business and the services / products contracted.
  • Managing data provided by job applicants through their Curriculum Vitae (CV) or by any other means, for the purposes of selection and recruitment.
  • Managing and handling reports: The personal data of employees will be processed in order to manage and handle reports, communications or complaints relating to the prevention of, and response to, harassment and violence against specially protected groups, in particular trans people, LGBTI people and minors. Processing will be carried out guaranteeing the confidentiality, integrity and proportionality of the information, and in compliance with current legislation. The legal basis for this processing is compliance with a legal obligation to which the controller is subject (Art. 6.1.c GDPR).
  • Equality, non-discrimination, prevention of harassment and psychosocial risks: The purpose of processing employees’ personal data is to manage and apply the measures necessary to ensure the principles of equal treatment and equal opportunities, as well as non-discrimination on the grounds of sex, sexual orientation, gender identity or expression, age, disability, race, religion, beliefs, or any other personal or social condition or circumstance. Data may also be processed to prevent, detect and manage situations of workplace harassment, sexual or gender-based harassment, and other psychosocial risks in the workplace, and to comply with internal protocols and the legal obligations established in the areas of occupational risk prevention and equality. The legal basis for this processing is compliance with a legal obligation to which the controller is subject (Art. 6.1.c GDPR) and the legitimate interest of the controller (Art. 6.1.f GDPR) in implementing additional measures to promote well-being, a positive working environment or a culture of equality beyond those required by law.
  • Internal investigation processes: Employees’ personal data may be processed in the context of internal investigation procedures where there are reasonable indications of irregular conduct or conduct contrary to applicable regulations, the Code of Ethics or the Entity’s internal policies. These investigations may be initiated by the Entity itself or arise from reports received through the internal reporting channels or the Internal Reporting System, in order to clarify facts that could constitute regulatory breaches, contractual breaches or violations of the organisation’s internal policies. The legal basis for this processing is compliance with a legal obligation to which the controller is subject (Art. 6.1.c GDPR) and the legitimate interest of the controller (Art. 6.1.f GDPR) in ensuring ethics, integrity and regulatory compliance within the organisation.
  • Ensuring the security of offices, facilities and people through access controls, video surveillance systems and other access control/identification systems.
  • Complying with the legal provisions applicable to the Group and its activities in the areas of health and occupational risk prevention.
  • Managing and monitoring the operation of the internal mechanisms, policies and protocols established by the Group for regulatory compliance purposes and for the management of the whistleblowing channels set up for that purpose.
  • Any other processing required for due compliance with the regulations and official / sector requirements to which our activity is subject.

In order to properly attend to you and manage the above purposes, your data will be processed for the relevant purposes in strict compliance with data protection regulations and with the Policy set out here. You may exercise your rights at any time (see the specific section).

 

Data retention criteria

  • Management of services / products contracted with the Group: the personal data provided in contracts, offers and/or service proposals, as well as the data of any other persons whose involvement is necessary, will be kept for as long as the contracted services remain in force. Once the contracted service(s) have ended, personal data will be kept where liabilities could arise for the Group and/or in compliance with other regulatory frameworks applicable to the Group or a legal provision requiring its retention. Personal data will be kept in a way that allows the identification of data subjects and the exercise of their rights, and under the technical, legal and organisational measures necessary to guarantee their confidentiality and integrity.
  • Curriculum Vitae management: as a rule, the Group keeps your Curriculum Vitae for a maximum period of one year; once that period has elapsed, it will be automatically destroyed in compliance with the data quality principle.
  • Management of Employment Contracts: personal data will in all cases be kept for as long as the employment relationship remains in force and, once it ends, where liabilities could arise between the parties and when required by a legal provision.

  • Internal Reporting System: personal data will be kept only for the time strictly necessary to decide whether to open an investigation into the reported facts. In any case, if three months pass without an investigation being opened, the data must be deleted from the reporting system, unless they have been anonymised or the purpose of retention is to keep evidence of the operation of the system. After that period, and if the report is accepted for processing, the data may continue to be processed. Once the investigation has concluded, we will keep the data for as long as necessary to adopt and implement the relevant measures and, thereafter, they will be blocked for the limitation period for criminal, civil, commercial, labour and/or administrative liabilities. In no case will the data be kept for more than 10 years.

  • Other: all other data and information provided by the user by any means will be kept for as long as necessary to fulfil the purpose for which they were collected.

 

Legal basis

The legal basis on which the Group may process the personal data of users, customers and potential customers rests on the following grounds:

  • The consent of data subjects for the processing and management of any request for information or query about our services and products.
  • The consent given by job applicants for selection and recruitment purposes.
  • The framework for the provision and/or contracting of services / products with the Group.
  • The legitimate interest in sending you information and marketing communications and/or promotional offers related to the Group’s activity and the services / products contracted, by email or any other means.
  • Compliance with legal obligations and internal regulatory compliance procedures.
  • The legitimate interest in ensuring the security of offices, facilities and people.

 

Recipients

Personal data will not be disclosed to third parties, except where required by law.

Source

Personal data are obtained directly from data subjects and from our partners. The categories of personal data provided to us are:

  • Identification data.
  • Postal or email addresses.
  • Data provided and/or consented to by the data subjects themselves that are related to and necessary for the management and performance of the service / product requested.


Rights

Right of Access, Rectification and Erasure: data subjects have the right to obtain confirmation as to whether or not the Group is processing personal data concerning them. Data subjects have the right to access their personal data, to request the rectification of inaccurate data or to request its erasure where, among other reasons, the data are no longer necessary for the purposes for which they were collected.

Right to Restriction and Objection: in certain circumstances, data subjects may request the restriction of the processing of their data, in which case we will only keep them for the exercise or defence of claims. In certain circumstances and on grounds relating to their particular situation, data subjects may object to the processing of their data. In that case the Group will stop processing the data, except for compelling legitimate grounds or for the exercise or defence of possible claims.

Right to withdraw consent: data subjects have the right to withdraw their consent at any time, except in the case of processing of personal data provided for in data protection regulations or necessary for the provision of the contracted service, which do not require such consent. However, withdrawal does not have retroactive effect and will therefore not affect the lawfulness of processing based on consent given previously.

These rights may be exercised through our Data Protection Channel, the access details of which are given at the beginning of this Policy.

Security and Control Measures

General

In compliance with data protection regulations, the Group will process personal data applying the appropriate technical, legal, organisational and security measures in order to guarantee the confidentiality and integrity of the information it manages, as established in current legislation.

We ask you to inform the Data Protection Officer, using the contact details / Channel set out in this Privacy Policy, of any security risk of which you have any indication or knowledge that could compromise the integrity and confidentiality of personal data and/or confidential information, so that the necessary measures can be taken to prevent its unauthorised processing, loss, destruction or accidental damage.

Cybersecurity

As a specific concept complementing the above, the Group applies cybersecurity measures to prevent and manage possible attacks and fraud by cybercriminals that threaten the privacy and protection of the data that our Entity processes and accesses in the course of its activities and operations.

In this regard, we wish to warn you that, in potentially risky situations involving communications whose content and/or format raise doubts about their authenticity, we recommend that you disregard them and contact the Data Protection Officer using the contact details given in this Privacy Policy.

Likewise, any request you receive that appears to come from our Entity concerning changes in payment methods, requests for data or contact persons or for confidential (non-public) information, bank and/or credit card details and/or other official data should not be acted upon without direct confirmation from our Entity through an alternative means. We appreciate and need your cooperation in reporting any notification relating to this type of request and other possible situations of cyberattack risk in which our Entity may be used, as well as any possible security risk of which you may become aware.

Internal Reporting System (SIIF)

The Group has implemented an Internal Reporting System (SIIF), which is a key element for oversight, control and prevention in the area of regulatory compliance, reflecting the highest commitment, rigour and professionalism in terms of security, confidentiality, data protection, experience, independence and expertise in handling the reports received.

The internal reporting channels integrated into the System have been implemented through technical tools that meet all the requirements necessary to provide and guarantee the commitments set out above. The SIIF also guarantees the basic principles of anonymity, proper recording, preservation and non-alteration, prevention of conflicts of interest, whistleblower protection and prevention of retaliation.

Through this System, all whistleblowers must report in good faith any indication, suspicion or evidence of possible regulatory breaches, offences, unethical behaviour and, in general, non-compliance with the protocols, rules and codes of conduct of the Group.

Access to the SIIF is provided in a separate section of our website.

Supervisory authority

In the event of any disagreement with the Group regarding the processing of your data, you have the right to lodge a complaint with the relevant Data Protection Supervisory Authority. In Spain, this Authority is the Spanish Data Protection Agency (www.aepd.es).

 

Assistance and support

Data subjects may contact the Group with any questions about the processing of their personal data or the interpretation of our Policy by contacting the Data Protection Officer (DPO) at the address given at the beginning of this Policy.