Privacy Policy

The responsible party for this website is NALANDA GLOBAL, S.A., with N.I.F. A-82692617 and registered office at Calle Proción, 7- Edificio América II Portal 4, 2° I, 28023, Madrid (“Nalanda”). Nalanda makes available to users of the websites located at the URLs https://nalandaglobal.com and https://www.obralia.com or accessible through the mobile application (hereinafter, “Web Platform”) this Privacy Policy, with the purpose of offering information on how we process your personal data and protect your privacy and information. We request that the user take a few minutes to carefully read this Privacy Policy. This Privacy Policy may be modified when necessary. In case modifications are made, we will inform you through the Web Platform, or by other means when possible, so that you can be aware of the new privacy conditions. Continuing to use the functionalities made available after having been notified of the mentioned modifications will imply your agreement with them, as an affirmative action. The data entered in the Web Platform for the provision of document management services are owned by the contracting entities and/or subcontractors. Between Nalanda and the Client (regardless of their position as the owner of the project, contractor, or subcontractor in the provision of services) there is a data processing relationship for data protection purposes, with Nalanda acting as the data processor and the client acting as the data controller (see Table No. 1). The obligations and responsibilities of Nalanda and the client, in their respective capacities as data processor and data controller, are established in section 3.4 of Nalanda’s General Contracting Conditions, accessible through this link under the title “CLIENT’S Responsibility in the use of the Web Platform as data controller and NALANDA’S Responsibility as data processor.” Table No. 1 In the event that the Client subcontracts other companies or freelancers, both the Client and Nalanda will have access to the documents of their subcontractors at different levels and, in turn, to the documentation of the workers involved in each project or job. Therefore, the Client is responsible for obtaining the pertinent authorization from their lower-level subcontractors and/or their freelancers/workers and guarantees that they have sufficient legitimacy for their processing, regulating their relationship in compliance with personal data protection regulations. ## For what purpose do we process your personal data? The personal data provided by users of the Web Platform will be processed for the following purposes: ### If you are a Client and/or User of Nalanda, or are in the process of contracting any service provided by Nalanda: – Processing of the registration process. – Management and maintenance of Users of the Nalanda portal. – Management and maintenance of Nalanda Clients. – Management of job vacancy requests in current or future selection processes of Nalanda. – Managing the normal use of the website and performing statistical analyses on the use of the website. ### In the case of professional contact data in any of the services provided by Nalanda, they will be processed for the following purposes: – Document management tool: for the publication of professional contact data necessary to enable the management of validation and authorization operations carried out through this tool. – Administration of the web directory “Páginas Naranjas”: to include the publication of such data, with the aim of listing and classifying the participating companies on the Web Platform and promoting relationships between them. – Administration of the purchasing tool: to enable the management of purchase and sale operations carried out through this tool. – Administration of the electronic invoicing tool: for the correct sending and receiving of invoices, we will collect the data of the person responsible for sending/receiving from each company and its different branches/centers. – Administration of the certification service: Nalanda will request the data of the person(s) responsible for certification/compliance of the corresponding company to make the necessary communications. ### Purposes related to commercial communications: – Commercial communications by any means about Nalanda’s products and services. – Commercial communications from third parties with whom Nalanda maintains collaboration agreements. ## What data is processed and from what sources does it originate? Depending on the relationship with the Client, Nalanda may process the following types of personal data: – Identification and/or contact data of users or client employees, their contractors and/or subcontractors (e.g., name and surname, professional phone number, professional email, IP address, etc.). – Economic and financial data of the Client or client employees, their contractors and/or subcontractors (e.g., payment methods of which you are the holder as an individual, etc.). – Academic and professional data of client employees, their contractors and/or subcontractors (e.g., academic degree, their position within the organization, etc.). The data that Nalanda processes as a result of interactions made by the user through our Web Platform come from the following sources: – Data provided by the client/user (or by a third party on their behalf) through the completion of forms made available during the online registration process or by any other means (e.g., customer service). – Data generated as a result of the development, execution, or maintenance of the relationship between the user and Nalanda. To ensure proper management in the processing of your data, Nalanda has appointed a data protection officer (DPO), whose email address is dpo@nalandaglobal.com. ## What is the legal basis for processing your data? Depending on the type and relationships between the client/user and Nalanda, the company will process the personal data of Web Platform users based on the following legal grounds: – Execution of the contractual relationship between Nalanda and the client: in relation to the purposes of processing the registration and managing the clients/users of the portal. – Compliance with legal obligations applicable to Nalanda (e.g., tax or invoicing obligations): in relation to the purposes of managing and maintaining Nalanda’s clients/users. – Nalanda’s legitimate interest: in relation to the purpose of sending advertising and promotional information regarding Nalanda’s products and services, in the case of Nalanda’s clients. – Legitimate interest of third parties: in relation to document management services, certification, or electronic invoicing, or with purchasing tools, or “Páginas Naranjas,” in accordance with Article 19 of Organic Law 3/2018, of December 5, on Personal Data Protection and the guarantee of digital rights (LOPDGDD), to the extent that such data is necessary for the professional location of the data subject solely to maintain relations with the legal entity in which the data subject provides services (or is an individual entrepreneur or freelancer). – Consent, if provided, for the purpose of sending promotional advertising information regarding products and services of third parties with whom Nalanda maintains collaboration agreements. ## To whom are your data communicated? The personal data processing described and informed in this Privacy Policy does not involve the communication or transfer of your data by Nalanda to third-party entities, except when there is a legal obligation or when necessary for the provision of the service contracted by the Client. In this regard, it is reported that certain functionalities of the Platform may involve the restricted dissemination of identification and/or professional data to Clients/users of the Platform. Furthermore, Nalanda’s data processors, i.e., service providers contracted by Nalanda who need access to them for the development of their functions, may access personal data. ## How long do we retain your data? Personal data will be retained for as long as the relationship with Nalanda lasts and/or to achieve the intended processing purpose or, if applicable, until you exercise your rights to terminate the processing. Once these periods have expired, your data will remain blocked for the attention of judicial, administrative, or fiscal claims, for the periods legally determined by the applicable regulations in each case. Subsequently, the client may request the complete deletion of their information, in which case it will no longer be accessible. To process this request, you must contact our data protection officer and write to dpo@nalandaglobal.com. In compliance with the principle of storage limitation, we reserve the right to keep data and documentation for the duration of the contractual relationship and subsequently for the time necessary for the specific purposes for which they were collected, to fulfill legal obligations and responsibilities arising from such processing, in accordance with the applicable regulations, such as the prevention of possible inspections. Therefore, it is agreed to retain the documentation for a prudential period thereafter. The documentation related to workers is automatically deleted five years after their deactivation on the portal. For candidates, their data will be retained for a period of 1 year. If you do not want your data to be retained for this period, you may exercise your right to deletion or withdraw your consent. ## What data must you provide us with? Nalanda informs clients and users that it will be necessary to provide at least the data marked with an asterisk (*) in the registration form. These data are strictly necessary to acquire the status of a registered client and, eventually, user, while the inclusion of data in the remaining fields is voluntary. If you do not provide at least these necessary data, Nalanda will not be able to manage the registration process or provide the contracted service. ## What must you guarantee when providing your personal data? The Client and/or user guarantees that the data provided are true, accurate, complete, and up-to-date, committing to keep them up-to-date, being responsible for any damage or harm, direct or indirect, that may result from the breach of this obligation and guarantee. In case the user provides data belonging to a third party, they guarantee that they have informed the third party of all the aspects contained in this Privacy Policy and obtained their authorization and have sufficient legitimacy to provide us with their data for the intended processing purpose. ## What measures do we take to protect your personal data? In response to Nalanda’s concern for ensuring the security of your data, measures have been implemented to ensure the confidentiality, integrity, and availability of your data. Additionally, specific security levels have been adopted for the protection of personal data and technical and organizational means have been installed to prevent the loss , misuse, alteration, unauthorized access, and theft of personal data provided through the Web Platform. Specifically, NALANDA holds the ISO/IEC 27001:2003 certification for Information Security Management Systems (ISMS) as well as the ISO 9001-2015 certification for Quality Management Systems. ## What are your rights regarding your personal data? Nalanda informs you that you have the right to obtain information about the personal data we are processing about you, as well as to request, in accordance with data protection regulations: – Access to your data to know what personal data we are processing about you. – Rectification of your personal data that you consider inaccurate and that are subject to processing by Nalanda. – Deletion of your data when, among other reasons, the data are no longer necessary for the purposes for which they were collected. – Restriction of the processing of your data, in which case we will only retain the data for which you have requested the restriction for the exercise or defense of claims. – Portability of your data in a structured, commonly used, and machine-readable format, as well as having them transmitted by Nalanda to another data controller. – Objection to the processing of your data, in which case we would stop processing them unless we need to continue doing so to fulfill our contractual or legal obligations, for legitimate compelling reasons, or for the exercise or defense of possible claims. Additionally, we remind you that you have the right to withdraw any consents you have given for the processing of your data, without affecting the lawfulness of the processing based on the consent prior to its withdrawal. Nalanda informs you that you can exercise your rights over your personal data by writing to NALANDA GLOBAL, S.A. (to the postal address Calle Proción, 7- Edificio América II Portal 4, 2° I, 28023 or electronically to dpo@nalandaglobal.com) accompanying a copy of your DNI, NIE, Passport, or equivalent document, on both sides, for the purpose of verifying your identity. Nalanda will provide the requested information within a maximum period of 1 month from the receipt of the request, although we inform you that this period could be extended by 2 more months considering the complexity and number of requests. Finally, we inform you that you can file a complaint with the competent Supervisory Authority in data protection matters, being in Spain the Spanish Data Protection Agency (www.aepd.es). However, prior to this, you may contact the Data Protection Officer, who will resolve the complaint within a maximum period of two months. ## OTHER PERSONAL DATA PROCESSING ### Cookies and similar: Cookies are files that are downloaded to the User’s browser and can be read later by Nalanda. This way, cookies allow various functionalities, such as recognizing a User who has previously accessed the website and being able to perform analyses on the use of the web service to improve it. However, it is not possible to determine the User’s identity from the cookies used by Nalanda, unless the User provides additional information through other means, and these can be linked to the cookies downloaded. You can access our Cookie Policy through the following link https://nalandaglobal.com/politica-de-cookies/ ### “Hablemos” Form: The data provided through the “Hablemos” Form will be processed to attend to your contact request. Legal basis: The legal basis that legitimizes the processing is the execution of a contract constituted at the moment of sending your contact request. Additionally, if you have authorized it by checking the corresponding box in the contact form, you may receive commercial communications by any means about products, services, promotions, news, or events from Nalanda, related to their services. You can obtain more information about this in the communications section of this Privacy Policy. Additionally, you can withdraw the consent provided as indicated in the data subject rights section of this Privacy Policy. Retention period: The data will be processed for the time necessary to resolve your contact request. Subsequently, they will be blocked and retained for 3 years for the attention of any responsibilities arising from the processing. ### “Request More Information” Form: The data provided through the “Request More Information” Form will be processed by Nalanda to attend to your information request. Legal basis: The legal basis that legitimizes the processing is the execution of a contract constituted at the moment of sending your information request. Additionally, if you have authorized it by checking the corresponding box in the information request form, you may receive commercial communications by any means about products, services, promotions, news, or events from Nalanda or third parties with whom Nalanda maintains collaboration agreements related to their services. You can withdraw the consent provided as indicated in the data subject rights section of this Privacy Policy. Retention period: The data will be processed for the time necessary to resolve the user’s contact request. Subsequently, they will be blocked and retained for 4 years for the attention of any responsibilities arising from the processing. ### “Work for Us” Form: The personal data provided through this form will be processed by Nalanda to manage your application in the corresponding selection process. Legal basis: The legal basis is the execution of a contract constituted at the moment of sending your application. Retention period: Your data will be retained for a period of 1 year. If you do not want your data to be retained for this period, you can exercise your right to deletion. Your personal data will not be transferred to third parties except for legal obligation. You can exercise your rights at any time as indicated in the data subject rights section of this Privacy Policy. ### “Hire or Expand” Form: Nalanda will process the data provided through the “Hire or Expand” form with the purpose of providing and managing both personalized basic document management CAE services and, if applicable, certification services configured in different packages (Basic Document Management CAE, Silver Pack, Gold, or Platinum), at the provider’s choice, as well as subsequent collection and follow-up. Legal basis: The legal basis that legitimizes the processing is the execution of the contract formalized with the client through their registration in the service and acceptance of the particular and general contracting conditions. Additionally, based on Nalanda’s legitimate interest, commercial communications may be sent to the user by any means (including electronic) about services, products, news, or events from Nalanda related to Nalanda’s own services (e.g., document management and/or supplier certification services). You can obtain more information about commercial communications in the communications section of this Privacy Policy. Retention period: The data will be processed for this purpose while the contractual relationship between the parties lasts and during the legally established prescription periods. You can exercise your rights as indicated in the data subject rights section of this Privacy Policy. The data provided through the drop-down “Leave a Message” and specifically regarding the user’s choice of the respective drop-down (i) contact form and (ii) commercial form, (i) with the purpose of attending to the information request and (ii) according to the commercial purpose of their request, through their selection, request for a videoconference, commercial training visit, or loyalty call. Legal basis: The legal basis that legitimizes the processing is the user’s consent expressed at the moment of sending their contact request based on the requested subject. Retention period: The data will be processed for the time necessary to resolve the user’s contact request. Subsequently, they will be blocked and retained for 3 years for the attention of any responsibilities arising from the processing. Additionally, if you have authorized it by checking the corresponding box in the help form, you will receive, through the provided contact means, including electronic ones, commercial communications about products, services, promotions, news, or events from Nalanda, related to the document management and information sector for companies, as services related to Nalanda’s corporate purpose. You can obtain more information about commercial communications in the communications section of this Privacy Policy. You can withdraw the consent provided and exercise your rights at any time, as indicated in the data subject rights section of this Privacy Policy. ### Sending Commercial Communications: Nalanda informs the user that they may receive those commercial communications they request or that refer to products, services, promotions, news, or events from Nalanda. The tool used for sending commercial communications by email will include links and small transparent images associated with your email address. This way, when one of these images is downloaded or the links contained in the email are accessed, Nalanda can know, for statistical purposes, if the email has been opened or if any link has been accessed from that email. You can prevent these uses by configuring your email manager or program to prevent the automatic download of images and not accessing the links included in the emails you receive. In each communication, the user can object to receiving this type of information through the specific mechanisms for processing the unsubscribe, as well as request, if applicable, their right to revoke consent, objection, or deletion. ### More Information: If the user has any doubts about the information collected in our Privacy Policy, they can send an email to dpo@nalandaglobal.com.