PRIVACY POLICY

In accordance with current personal data protection regulations, we provide you with the following information:

1. INFORMATION FOR DATA SUBJECTS AND/OR USERS

JAMONES VOLATIN, S.L. makes this Privacy Policy available to you to provide detailed information on how the personal data that you, as a data subject and/or user, provide or have provided will be processed, through any means (website, email, telephone, in person, online or paper forms, etc.).

JAMONES VOLATIN, S.L. has adopted all the necessary technical and organizational measures to guarantee the confidentiality, integrity, availability and resilience of the personal data under its control.

Responsibilities of Data Subjects and/or Users

By providing your data, you, as a data subject and/or user (hereinafter referred to as the Data Subject), confirm that you are over 18 years of age and that the information provided to JAMONES VOLATIN, S.L. is true, accurate, complete and up to date.

For these purposes, the Data Subject confirms that they are responsible for the accuracy of the information provided and undertake to keep it appropriately updated so that it reflects their actual circumstances. The Data Subject shall be responsible for any false or inaccurate information provided, as well as any direct or indirect damages or losses that may arise as a result.

2. DATA CONTROLLER

Company name: JAMONES VOLATIN, S.L.
Tax Identification Number (NIF): B31627839
Postal address: Pol. Ind. La Serna Ciudad Agroalimentaria Tudela, Vial D Calle D, Parc. 6-40 - 31500 Tudela (Navarra), Spain
Telephone: +34 948 847 136
Email: lopd@volatin.com

3. PURPOSES, RETENTION PERIODS AND LEGAL BASES FOR DATA PROCESSING

JAMONES VOLATIN, S.L., as the Data Controller responsible for processing the personal data of the Data Subject, including any data that may be provided in the future, informs you that such data will be processed in accordance with current personal data protection regulations. The following information is provided regarding each of the processing activities carried out by JAMONES VOLATIN, S.L.:

CONTACT / ENQUIRIES

Purpose of processing: To respond to and follow up on enquiries, requests for information, suggestions and complaints, as well as to maintain contact with individuals who have expressed an interest in the company, its products or services.

Data retention criteria: Data will be retained for the period necessary to process and respond to the enquiry.

Legal basis for processing: GDPR Article 6(1)(f). Processing is based on the legitimate interests of the Data Controller in handling and responding to communications or requests received.

PRO FORMA INVOICES / QUOTATIONS

Purpose of processing: To prepare and deliver pro forma invoices and/or quotations requested by Data Subjects, as well as to follow up on them by telephone, electronically or in person.

Data retention criteria: Data will be retained for as long as there is a mutual interest in doing so, or until the Data Subject requests its erasure.

Legal basis for processing: Processing is necessary to take steps at the request of the Data Subject prior to entering into a contract (GDPR Article 6(1)(b)), as well as for the legitimate interests of the Data Controller in preparing and following up on quotations requested by Data Subjects (GDPR Article 6(1)(f)).

CUSTOMERS

Purpose of processing: To manage customers, maintain contractual and/or commercial relationships with them, manage the purchase of products and/or services, and carry out the company's administrative (invoicing, collections, etc.), accounting and tax management, as well as to comply with the legal obligations arising from these activities.

Data may also be processed to establish contact with individuals providing services within a legal entity (company, organization, etc.), as well as sole traders and independent professionals, in order to establish or maintain business-to-business (B2B) relationships with them.

Data retention criteria: Data will be retained for as long as the contractual and/or commercial relationship between the parties continues and its erasure has not been requested. If erasure is requested, data will continue to be retained for the periods required by applicable legislation (tax, commercial, etc.) regarding the limitation of liabilities.

Legal basis for processing: GDPR Article 6(1)(b). Processing is based on the performance and maintenance of contractual and/or commercial relationships between the parties, as well as compliance with the associated legal obligations (tax, commercial, etc.).

The processing of professional contact details for business relationships is based on the legitimate interests of the Data Controller in contacting, establishing and/or maintaining business relationships with the legal entity for which the Data Subject provides services, as well as with sole traders and independent professionals (GDPR Article 6(1)(f) and Article 19 of the Spanish Organic Law on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD)).

RECORDS OF ACCESS TO FACILITIES

Purpose of processing: To monitor and manage individuals entering the facilities in order to comply with occupational risk prevention, food safety and hygiene regulations.

Data retention criteria: Data will be retained for the period necessary to fulfil the purpose for which it was collected and to determine any potential liabilities arising from that purpose and the processing of the data. Applicable occupational risk prevention and food safety regulations (BRC, IFS, etc.) shall apply.

Legal basis for processing: GDPR Article 6(1)(f). Processing is based on the legitimate interests of the Data Controller in ensuring compliance with occupational risk prevention, food safety and hygiene regulations, as well as compliance with any applicable legal obligations.

SUBMISSION OF CURRICULUM VITAE (CV)

Purpose of processing: To file and register documentation and CVs voluntarily provided by Data Subjects for future recruitment processes for positions within the company.

Data retention criteria: Data will be retained for a maximum period of one year or until the Data Subject exercises their right to erasure.

Once this period has elapsed, if you wish to continue participating in the Data Controller's recruitment processes, please submit your CV again.

Legal basis for processing: GDPR Article 6(1)(a). Processing is based on the consent given by the Data Subject when providing their personal data to participate in recruitment processes. By submitting or sending their CV, the Data Subject authorizes the processing of their data through a clear affirmative action.

SUPPLIERS

Purpose of processing: To manage suppliers, maintain contractual and/or commercial relationships with them, and carry out the company's administrative (invoicing, collections, etc.), accounting and tax management, as well as to comply with the legal obligations arising from these activities.

Data may also be processed to establish contact with individuals providing services within a legal entity (company, organization, etc.), as well as sole traders and independent professionals, in order to establish or maintain business-to-business (B2B) relationships with them.

Data retention criteria: Data will be retained for as long as the contractual and/or commercial relationship between the parties continues and its erasure has not been requested. If erasure is requested, data will continue to be retained for the periods required by applicable legislation (tax, commercial, etc.) regarding the limitation of liabilities.

Legal basis for processing: GDPR Article 6(1)(b). Processing is based on the performance and maintenance of contractual and/or commercial relationships between the parties, as well as compliance with the associated legal obligations (tax, commercial, etc.).

The processing of professional contact details for business relationships is based on the legitimate interests of the Data Controller in contacting, establishing and/or maintaining business relationships with the legal entity for which the Data Subject provides services, as well as with sole traders and independent professionals (GDPR Article 6(1)(f) and Article 19 of the LOPDGDD).

4. DATA DISCLOSURE

As a general rule, personal data will not be disclosed to third parties, except where there is a legal obligation to do so or where disclosure is necessary for the provision of services or for maintaining and developing relationships, including but not limited to:

• Public administrations, judges and courts, for compliance with legal obligations and the handling of potential liabilities arising from applicable regulations.
• Financial and banking institutions, for the management of collections and payments.
• Payment service providers, for the management of collections and payments (Mastercard, VISA, PayPal, etc.).
• Transport companies, for the delivery and/or collection of products.
• Service providers contracted by the Data Controller, acting as Data Processors.

Although this does not constitute a disclosure of data, third-party companies acting as Data Processors (our service providers) may need to access your information in order to carry out certain processing activities or provide services.

These Data Processors access your data in accordance with our instructions, may not use it for any other purpose and must maintain the strictest confidentiality.

International Data Transfers

JAMONES VOLATIN, S.L. does not intend to transfer your personal data internationally to countries outside the European Economic Area (EEA).

Where such transfers are necessary, they will only be made to recipients located in a country, territory, one or more specified sectors within that country, or an international organization that has been recognized by the European Commission as providing an adequate level of protection; or to recipients covered by the EU-US Data Privacy Framework; or where one of the appropriate safeguards provided for in Article 46(2) of Regulation (EU) 2016/679 applies.

5. RIGHTS OF DATA SUBJECTS

Everyone has the right to obtain confirmation as to whether the Data Controller is processing personal data concerning them. They also have the right to withdraw, at any time, any consent previously given for a specific purpose, without affecting the lawfulness of processing based on consent before its withdrawal.

Data protection legislation allows Data Subjects to exercise their rights of access, rectification, erasure and data portability, as well as their rights to object to or restrict processing and, where applicable, not to be subject to decisions based solely on automated processing of their personal data.

These rights are subject to the following conditions:

• Exercising these rights is free of charge, except where requests are manifestly unfounded or excessive (e.g., repetitive requests). In such cases, the Data Controller may charge a fee proportionate to the administrative costs incurred or refuse to act on the request.
• Data Subjects may exercise their rights directly or through a legal or voluntary representative.
• We must respond to requests within one month. However, depending on the complexity and number of requests, this period may be extended by a further two months.
• We are obliged to inform Data Subjects of the available means of exercising their rights. These means must be accessible, and the exercise of a right cannot be refused solely because the Data Subject chooses a different means of communication. Where a request is submitted electronically, information will be provided through that channel whenever possible, unless otherwise requested.
• If the Data Controller does not act on a request, the Data Subject will be informed within a maximum of one month of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority.

How Can You Exercise These Rights?

Data Subjects may exercise their rights by sending a written communication to the postal or email address of the Data Controller, indicating "EXERCISE OF DATA PROTECTION RIGHTS" ("EJERCICIO DERECHOS LOPD") in the subject or reference and including the details of the request, an address for notifications, the date and their signature.

Upon request, we will provide the appropriate forms for exercising these rights, once you indicate which right you wish to exercise.

Furthermore, particularly if you believe that your rights have not been fully satisfied, you may lodge a complaint with the national supervisory authority, the Spanish Data Protection Agency (Agencia Española de Protección de Datos), at C/ Jorge Juan, 6 – 28001 Madrid, Spain.

6. SOCIAL MEDIA

JAMONES VOLATIN, S.L. uses social media as another means of communicating with you. Information collected through messages and communications that you publish may contain personal information that is publicly available online.

These social media platforms have their own privacy policies explaining how they use and share your information. We therefore recommend that you review them before using these platforms to confirm that you agree with how your information is collected, processed and shared.

The processing of personal data belonging to individuals who follow and/or establish any connection or interaction through the Data Controller's official social media pages shall be governed by this Privacy Policy and the privacy policies of the respective social media platforms.

The Data Controller will process your data for the purposes of properly managing its presence on the relevant social media platform, sending personal and individual messages through the platform's communication channels, informing you about activities, products and/or services of the Data Controller or third parties related to our activities, as well as any other processing permitted under the regulations of the respective social media platforms.

7. COOKIES

As a general rule, when browsing the internet, you can accept or reject cookies through your browser settings.

This website may use cookies and similar technologies, such as local shared objects, Flash cookies or pixels. These are small files that certain platforms, including websites, may install on a user's device (computer, tablet, smartphone, etc.).

They may serve various purposes, including storing browsing preferences, collecting statistical information, enabling certain technical features and storing information about users' browsing habits or their devices.

Cookies are useful for several reasons. From a technical perspective, they allow websites to operate more efficiently and adapt to user preferences, such as remembering a user's language or currency.

They also help website Data Controllers improve their services and make advertising more effective through the statistical information or browsing habits collected.

The installation and use of certain cookies require users' informed consent. Cookies requiring consent include analytics, advertising and affiliate cookies, while technical cookies and those necessary for the operation of the website or the provision of services expressly requested by the user are exempt.

Users can configure their browsers to receive notifications when cookies are received and to prevent their installation on their devices. Please refer to your browser's instructions for further information.

For further information about cookies, please consult our Cookie Policy.

8. MANDATORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED BY DATA SUBJECTS

By selecting the corresponding checkboxes and entering their data into fields marked as mandatory in the various forms, Data Subjects expressly, freely and unequivocally acknowledge that such data is necessary for the Data Controller to process their requests. Providing information in the remaining fields is voluntary.

If all mandatory data is not provided, the corresponding processing activities cannot be carried out and, consequently, the Data Subject's requests, contracts or applications cannot be processed.

The Data Subject guarantees that the personal data provided is accurate and undertakes to communicate any changes to it.

9. SECURITY MEASURES

JAMONES VOLATIN, S.L. undertakes to protect your personal information by using reasonably reliable and effective physical, organizational and technological measures, controls and procedures designed to preserve the integrity and security of your data and guarantee its privacy.

In addition, all personnel who have access to personal data have received training and are aware of their obligations regarding the processing of such data.

Contracts entered into with suppliers include clauses requiring them to maintain confidentiality regarding any personal data they access in the course of providing contracted services, as well as to implement the necessary technical and organizational security measures to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.

All these security measures are reviewed periodically to ensure their suitability and effectiveness.

However, absolute security cannot be guaranteed, and no security system is completely impenetrable. Therefore, if any information processed under our control is compromised as a result of a security breach, we will take the appropriate measures to investigate the incident, notify the supervisory authority and, where applicable, inform the affected Data Subjects so that they can take appropriate measures.