PRIVACY POLICY

1.PRIVACY POLICY FOR EUROPE

2.PRIVACY POLICY FOR MEXICO

1.PRIVACY POLICY FOR EUROPE

Identity of data controller

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and to all other applicable legislation, users are hereby informed that the personal data they provide shall be processed by Hijos de Juan de Garay S.A.U., whose Tax Identification Number is A20021507 and whose registered office is at Arboleda Obispo Otaduy nº 7-11, 20560, Oñati, Spain.

In addition, users are hereby informed that this privacy policy is applicable to the group companies of Hijos de Juan de Garay in Europe and that each of the said companies indicated below is an independent data controller:

  • HJGaray Corporación Industrial S.A.
  • Garay Slovakia S.R.O.

Hereinafter, all such companies shall be referred to as Hijos de Juan de Garay.

Purpose and legitimate basis of the processing

Your personal data shall be processed for the following purposes.

  • Contact:The purpose of the processing is the management of and response to requests made through the “contacts” section of the website.The legitimate basis of the processing is the express consent provided by users upon submitting their requests (Art. 6.1 (a) GDPR).
  • Ethics channel:The purpose of the processing is the management of the messages sent to us through our ethics channel.The legitimate basis of the processing is legitimate interest (Art. 6.1 (f) GDPR).
  • Advertisements:At times, Hijos de Juan de Garay may send you advertisements in relation to its products and services.The legitimate basis of the advertisements is express consent (Art. 6.1 (a) GDPR) in the case of interested parties who are not customers of Hijos de Juan de Garay, as well as legitimate interest (Art. 6.1 (f) GDPR) in the case of representatives of the customers of Hijos de Juan de Garay.
  • Potential customers:Hijos de Juan de Garay may process your personal data in order to maintain relationships of any kind and to inform you of its products and services, at your behest or with your consent.The legitimate basis of the processing is the legitimate interest (Art. 6.1 (f) GDPR) by which the parties are related, in relation to Art. 19 of the Spanish Organic Law 3/2018 of 5 December on Protection of Personal Data and Guarantee of Digital Rights.
  • Customers:Hijos de Juan de Garay processes the personal data of the representatives of its customers in order to manage the contractual relationship by which the parties are related.The legitimate basis of the processing is compliance with the law (Art. 6.1 (c) GDPR) and the legitimate interest by which the parties are related (Art. 6.1 (f) GDPR), in relation to Art. 19 of the Spanish Organic Law 3/2018 of 5 December on Protection of Personal Data and Guarantee of Digital Rights.
  • Suppliers and providers:Hijos de Juan de Garay processes the personal data of the representatives of its suppliers and providers in order to manage the contractual relationship by which the parties are related.The legitimate basis of the processing is compliance with the law (Art. 6.1 (c) GDPR) and the legitimate interest by which the parties are related (Art. 6.1 (f) GDPR), in relation to Art. 19 of the Spanish Organic Law 3/2018 of 5 December on Protection of Personal Data and Guarantee of Digital Rights.
  • Candidates for employment:If you have submitted your CV as a candidate for employment, Hijos de Juan de Garay shall process your personal data solely for this purpose.The legitimate basis of the processing is the express consent provided by the candidate upon submission of his or her CV (Art. 6.1 (a) GDPR), as well as the application of measures to his or her job application prior to entering into a contract (Art. 6.1 (b) GDPR).
  • Exercising rights and management of privacy:Hijos de Juan de Garay may process your data in order to manage your requests to exercise your data-protection rights or for any other purpose necessary for compliance with legislation on the protection of personal data. The legitimate basis of the processing is compliance with the law (Art. 6.1 (c) GDPR).

Disclosure of personal data

Hijos de Juan de Garay shall disclose your personal data solely to third parties, agencies and public institutions of the public administrations of Spain and of its autonomous and regional authorities, including the courts to which it is required by law to submit the data.

The data of customers, suppliers and providers may be disclosed to:(I) banks, in order to manage collection and payments deriving from our contractual relationship, and (ii) the group companies of Hijos de Juan de Garay, including its unit in Mexico.Further information on the processing of personal data by the unit in Mexico is available here .

Hijos de Juan de Garay collaborates with third-party providers of services such as hosting, consultancy, administrative and other, similar services. The said providers shall process your data in observance of the documented instructions of Hijos de Juan de Garay and solely for the purpose for which the data were provided.In this sense, Hijos de Juan de Garay has entered into pertinent agreements with the said providers in relation to the said processing.

Transfers abroad of personal data

Personal data shall be transferred abroad solely when strictly necessary in order to manage our relationship.The Mexico-based unit of Hijos de Juan de Garay, Garay Componentes Tubulares S.A. de C.V., shall receive the data transferred abroad.

When it is necessary to transfer abroad additional personal data, it shall be done in strict observance of the obligations defined under current legislation on protection of personal data.

Retention of personal data

The duration of the retention of your data may vary, depending on the purpose of the processing:

  • Contact and potential customers: When users contact Hijos de Juan de Garay to request information on our products and services, their data shall be retained for two years from their most recent contact, such that each successive contact or relationship of the users resets the two-year period.
  • Ethics channel: If you send us a message through our ethics channel, your personal data shall be retained for as long as is necessary to manage your message and subsequently until the statute of limitations has elapsed.
  • Advertisements: If you are not a customer of Hijos de Juan de Garay, your data shall be processed for this purpose until you withdraw your consent or express your objection to being sent advertisements.If you are a customer, your data shall continue to be retained in order to manage our contractual relationship, but you shall be sent no further advertisements once you express your objection to them.However, if you are a customer and do not express your objection to being sent advertisements, you shall continue to receive them, even if you are not our customer in the future, on the basis of legitimate interest, until you object to the processing of your data.
  • Customers, suppliers and providers: The personal data of our customers, suppliers and providers shall be retained as long as the contractual relationship remains legally valid and subsequently until the statute of limitations has elapsed.
  • Candidates for employment: Data obtained from CVs and any other information provided for the purpose of being included in our hiring processes shall be retained for three years from their receipt. If Hijos de Juan de Garay considers that your CV may be used in future hiring processes, you shall be asked to update the CV before the expiry of the said three-year period.
  • Exercising rights and management of privacy: If you have exercised your data-protection rights or if we need to process your data to comply with legal obligations set forth under data-protection legislation, your data shall be retained for as long as is necessary to comply with our obligations and subsequently until the statute of limitations has elapsed.

Application of security measures to personal data

Hijos de Juan de Garay has implemented the necessary technical and organisational security measures to ensure a suitable security level for the risk involved, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, in compliance with Art. 32 of Regulation (EU) 2016/679 (GDPR).

Exercising data-protection rights

If you wish to revoke your consent or to exercise your rights of access, rectification, objection, erasure, restriction, data portability or your right not to be subject to automated decision making, including the preparation of profiles, you may submit a written request to our data controller in Europe at Arboleda Obispo Otaduy nº 7-11, 20560, Oñati, Spain or by email at protecciondatos@hjgaray.es.

In addition, you may file a complaint with the Spanish Data Protection Agency (AEPD).

 

Commitments of users

Users agree to inform Hijos de Juan de Garay of any change in the personal data they have provided.The said change may be reported by email: protecciondatos@hjgaray.es.

2.PRIVACY POLICY FOR MEXICO

Identity of data controller

Pursuant to the Federal Law on Protection of Personal Data in Possession of Individuals, and to all other applicable legislation, users are hereby informed that the personal data they provide shall be processed by Garay Componentes Tubulares S.A. de C.V., whose registered office is at Calle Cerrada del Laurel nº 105, Colonia Fraccionamiento Industrial El Vergel, Celaya, Guanajuato, Mexico.

Purpose of the processing

Your personal data may be processed for the following purposes.

  • Contact:The purpose of the processing is the management of and response to requests for information sent to us by any means.
  • Ethics channel:The purpose of the processing is the management of the messages sent to us through our ethics channel.
  • Advertisements:At times, Garay Componentes Tubulares S.A. de C.V. shall send users advertisements in relation to its products and services.
  • Potential customers:Garay Componentes Tubulares S.A. de C.V. may process your personal data in order to maintain relationships of any kind and to inform you of its products and services, at your behest or with your consent.
  • Customers:Garay Componentes Tubulares S.A. de C.V. processes the personal data of the representatives of its customers in order to manage the contractual relationship by which the parties are related.
  • Suppliers and providers:Garay Componentes Tubulares S.A. de C.V. processes the personal data of the representatives of its suppliers and providers in order to manage the contractual relationship by which the parties are related.
  • Candidates for employment:If you have submitted your CV as a candidate for employment, Garay Componentes Tubulares S.A. de C.V. shall process your personal data solely for this purpose.
  • Exercising rights and management of privacy:Garay Componentes Tubulares S.A. de C.V. may process your data in order to manage your requests to exercise your data-protection rights or for any other purpose necessary for compliance with legislation on the protection of personal data.

Disclosure of personal data

Garay Componentes Tubulares S.A. de C.V. shall disclose your personal data solely to third parties, agencies and public institutions, including the courts to which it is required by law to submit the data.

The data of customers, suppliers and providers may be disclosed to:(I) banks, in order to manage collection and payments deriving from our contractual relationship, and (ii) the following group companies of Hijos de Juan de Garay:

  • HJGaray Corporación Industrial S.A.
  • Hijos de Juan de Garay S.A.U.
  • Garay Slovakia S.R.O.

These group companies are established in Europe and process personal data in observance of Regulation (EU) 2016/679 (GDPR) to ensure that the processing takes place under the most stringent standards of security.Further information on the privacy policy of Hijos de Juan de Garay in Europe is available here .

Garay Componentes Tubulares S.A. de C.V. collaborates with third-party providers of services such as hosting, consultancy, administrative and other, similar services. The said providers shall process your data in observance of the documented instructions of Garay Componentes Tubulares S.A. de C.V. solely for the purpose for which the data were provided.In this sense, Garay Componentes Tubulares S.A. de C.V. has entered into pertinent agreements with the said providers in relation to the said processing.

Transfers abroad of personal data

Personal data shall be transferred abroad solely when strictly necessary in order to manage our relationship.The recipients of the data are the group companies of Hijos de Juan de Garay, identified in the preceding section.The transfer abroad of personal data shall be in strict compliance with the provisions of current data-protection legislation, pursuant to Art. 37 of the Federal Law for the Protection of Data Held by Private Companies or Individuals.

When it is necessary to transfer abroad additional personal data, it shall be done in strict observance of the obligations defined under current legislation on protection of personal data.

Retention of personal data

The duration of the retention of your data may vary, depending on the purpose of the processing:

  • Contact and potential customers: When users contact Garay Componentes Tubulares S.A. de C.V. to request information on our products and services, their data shall be retained for two years from their most recent contact, such that each successive contact or relationship of the users resets the two-year period.
  • Ethics channel: If you send us a message through our ethics channel, your personal data shall be retained for as long as is necessary to manage your message and subsequently until the statute of limitations has elapsed.
  • Advertisements: Your data shall be processed for this purpose until you withdraw your consent or express your objection to being sent advertisements.
  • Customers, suppliers and providers: The personal data of our customers, suppliers and providers shall be retained as long as the contractual relationship remains legally valid and subsequently until the statute of limitations has elapsed.
  • Candidates for employment: Data obtained from CVs and any other information provided for the purpose of being included in our hiring processes shall be retained for two years from their receipt. If Garay Componentes Tubulares S.A. de C.V. considers that your CV may be used in future hiring processes, you shall be asked to update the CV before the expiry of the said three-year period.
  • Exercising rights and management of privacy: If you have exercised your data-protection rights or if we need to process your data to comply with legal obligations established under data-protection legislation, your data shall be retained for as long as is necessary to comply with our obligations and subsequently until the statute of limitations has elapsed.

Exercising of data-protection rights

If you wish to revoke your consent or to exercise your rights of access, rectification, objection or erasure or if you wish to restrict the use and disclosure of your personal data, you may submit a written request to our data controller in Mexico, at Calle Cerrada del Laurel nº 105, Colonia Fraccionamiento Industrial El Vergel, Celaya, Guanajuato, Mexico or by email: protecciondatos.mx@hjgaray.com.

Notification of changes in the privacy notice

Garay Componentes Tubulares S.A. de C.V. shall inform you by email of any change in the privacy notice, indicating how to access the updated text.

 

Commitments of users

Users agree to inform Garay Componentes Tubulares S.A. de C.V.of any change in the personal data they have provided.The said change may be reported by email: protecciondatos.mx@hjgaray.com.