Hereunder we provide you with all the information concerning our Privacy Policy with regard to the personal data we collect.

1. Data controller of your personal data

INGASO FARM, S.L.U. (B01342401) (hereinafter, “INGASO”)

Polígono El Carrascal, P 8-9. Lanciego 01308. Alava, Spain

Contact email: rgpd@farmfaes.com

We also inform you that this data protection policy will apply to any of the companies belonging to the Faes Group. You can check all companies that make up the Faes Group via this link.

2. Specific personal data that will be collected

The personal data we will collect and process will be those you furnish us with if there are data collection forms and the data you may send us when using any contact sections that may exist. These personal data that we will process will be adequate, relevant and not excessive as required in order to comply with the purposes outlined below.

3. Purposes, legitimation and storage of the processing of your personal data
   • DATA OF CUSTOMERS OR POTENTIAL CUSTOMERS

Purpose: to maintain contact and communication with the customer, manage the contractual and/or commercial relationship, including after-sales services and the management and billing of the services and/or products requested. Furthermore, customers may be sent advertising or promotional communications pursuant to article 21 of Law 34/2002, of 11 July, governing the Information Society Services and Electronic Commerce.

Legitimacy: The legal basis that legitimises us for the processing of personal data of our customers is the contractual relationship in each case.

Storage: until termination of the contractual relationship and, subsequently, during the legally required periods.

• DATA OF SHAREHOLDERS, ANALYSTS, INVESTORS AND MEDIA

Purpose: To maintain contact and communication with shareholders, investors, analysts and the media.

Legitimacy: The user’s consent by requesting information through our contact form and by checking the acceptance box of the privacy policy.

Storage: Until the data subject revokes the consent and requests the withdrawal of the service.

• SUBSCRIPTION TO OUR WEBSITES

Purpose: The provision of services that have been requested by the data subject, in each case, in accordance with the detailed description in each of the websites.

Legitimacy: The user’s consent by requesting subscription to the web page for the provision of the services and by checking the acceptance box of the privacy policy.

Storage: Until the data subject revokes the consent and requests the withdrawal of the service.

• CONTACT FORM

Purpose: To provide you with a medium through which you can contact us and answer your requests for information.

Legitimacy: The user’s consent by requesting information through our contact form and by checking the acceptance box of the privacy policy.

Storage: Once your request is resolved by means of our form or answered by email, if no new processing has been generated.

• SIGN-UP FORM FOR PARTICIPATION ON THE BLOGS

Purpose: Possibility of enabling users to actively participate on the different publications available on the website, through publishing personal opinions on said websites.

Legitimacy: The user’s consent by sending us their personal information and by checking the acceptance box of the privacy policy.

Storage: Until the data subject revokes the consent and requests the removal of their personal data.

• SENDING OF EMAILS

Purpose: To answer your requests for information, deal with your requests and respond to your enquiries or doubts.

Legitimacy: The user’s consent by asking us to provide information through the email address.

Storage: Once the user’s request has been answered by email, if no new processing has been generated.

• SUBMISSION OF CURRICULUM VITAE

Purpose: To have your curriculum vitae so that you can take part in our recruitment processes.

Legitimacy: The user’s consent by sending us their personal information and documentation for our recruitment processes and by checking the acceptance box of the privacy policy.

Storage: During the open personnel selection processes and, subsequently, for one (1) year for future processes.

• SUBSCRIPTION TO OUR NEWSLETTERS

Purpose: To send informative and advertising communications related to any of the products and/or services of the Faes Group, including by electronic means, such as emails.

Legitimacy: The user’s consent by subscribing to our newsletters and/or commercial communications and by checking the acceptance box of the privacy policy.

Storage: Until the data subject revokes the consent and requests the withdrawal of the service.

• DRAWS AND COMPETITIONS

Purpose: The participation in draws and/or competitions organised by the Faes Group.

Legitimacy: The user’s consent by subscribing to these draws and/or competitions and by checking the acceptance box of the privacy policy.

Storage: During the performance of said draws and/or competitions.

• ACCESS TO WI-FI BY VISITORS

Purpose: To facilitate visitors to any of the facilities of companies that form part of the Faes Group with access to the Internet through their electronic devices. This is also a security measure to know which devices are connected to the Faes Group network.

Legitimacy: The user’s consent by accessing the Wi-Fi network and by checking the acceptance box of the privacy policy.

Storage: During the time essentially needed for access by visitors to the Wi-Fi network.

• SOCIAL NETWORKS

The companies that make up the Faes Group have different profiles on some of the main social networks of the Internet, with INGASO being data controller of personal data users send privately to companies of the Faes Group. The processing of data belonging to people who become followers of the official pages that the companies of Faes Group have on the different social networks and/or that get in contact through these official pages and/or that carry out any link or connection action through such social networks, will be governed by this section and by the privacy and use policies of the social network in question in each case. Accordingly, the processing that INGASO will carry out with the data within each of the social networks will at most be the processing that the social network allows corporate profiles.

Purpose: It will process your data for the purpose of correctly managing your presence on social networks, reporting activities, products or services of the Faes Group, as well as any other purpose that the regulations of social networks may allow.

4. Recipients of your personal details

INGASO undertakes not to sell, disseminate or transmit in any other way the users’ personal data to third parties, except in the cases set out in this privacy policy.

Your personal data will be communicated to other Faes Group merchants for internal administrative purposes, including the processing of personal data of customers or employees.

Likewise, in order to provide the services offered on our web pages, INGASO may share your personal data with the following service providers, who are contractually bound to protect the confidentiality and security of personal data to which they have access, and they in turn will have their own corresponding privacy conditions:

• FOOCUZZ, S.L., with registered office in Spain, processes personal data in order to manage the Faes Group web platforms and to provide analytical services.
• DISTANS80, S.L., with registered office in Spain, processes personal data in order to manage the Faes Group web platforms and to provide analytical services.
• MARKETING MANAGER SERVICIOS DE MARKETING, S.L.U., with registered office in Spain, processes personal data in order to manage the Faes Group web platforms and to provide analytical services.
• THE ROCKET SCIENCE GROUP LLC, d/b/a MailChimp (hereinafter, “MailChimp”), with registered office at 675 Ponce de León Ave NE, Suite 5000, Atlanta, Georgia, United States, processes personal data in its status as provider of information systems.

Likewise, the personal data of users can be consulted by regulatory, police or public bodies or national or international courts, or transferred to them, either when we have the obligation to do so in compliance with applicable legislation or when they request such data.

By accepting this data protection privacy policy, users expressly and unequivocally authorise the communication of their data to Faes Group companies, on the understanding that in certain cases this involves an international transfer of data to a country not belonging to the European Union and giving their unequivocal consent to such transfer. If we transfer the personal data of users to any territory outside the European Economic Area (comprising the Member States of the European Union plus Iceland, Liechtenstein and Norway), we guarantee the protection of users’ personal data: (i) applying the level of protection required in accordance with local legislation on data protection or privacy applicable to INGASO; (ii) acting in accordance with our standards and policies; and (iii) we inform you that MailChimp certifies the agreement with the EU – US Privacy Shield Framework.

5. Users’ rights with regard to their personal data

The users’ rights set out in this section may be exercised by sending a communication to INGASO at the address of the registered office given in the first section of this personal data privacy policy, or to the email address rgpd@farmfaes.com, attaching a copy of your national ID document.

Users may withdraw their consent at any time. Likewise, users are informed that they may request the exercise of the following rights:

• Right to request access to personal data. Anyone has the right to obtain confirmation as to whether or not INGASO is processing personal data concerning them, as well as to obtain a copy of the personal data being processed.
• Right to request rectification of your personal data, in the event that they are inaccurate and/or the removal of the same.
• Right to request the restriction on processing your personal data, in which case we will only keep them for the exercise or defence of claims.
• Right to object to the processing of your personal data, in which case INGASO will cease to process your personal data, unless there are imperious legitimate reasons for the exercise or the defence of possible claims that require the processing of your personal data.
• Right to the portability of your personal data, in which case you will have the right to receive the personal data you provided to INGASO in a structured, commonly used and mechanical reading format, and that INGASO transmits them to a new data controller of your choice.

In the event of any disagreement with INGASO in relation to the processing of your data, we inform you that you may file a complaint with the appropriate data protection authority, with the Spanish Agency for Data Protection (AEPD) holding terms of reference, www.agpd.es

6. Origin of your personal data

The personal data that we process at INGASO come directly from the data subject in the event that it was they who provided them to us, or from other companies of the Faes Group.

The categories of data processed are:

• Identification data
• ID codes or passwords
• Postal or electronic addresses
• Commercial information
• Financial data

Likewise, specially protected personal data are processed, such as genetic data and health-related data that are duly protected by the appropriate security measures implemented for that purpose.

7. Technical and transactional data

Below, we indicate the categories of technical and transactional data that we can collect about users:

• Information regarding their browser and device.
• Statistics regarding the use of our web pages by users.
• Usage data.
• As well as any information the user provides to us when using our web pages.

The aforementioned data, as well as the personal data generated through cookies (you may consult the Cookies Policy at the following link [include link to the cookie policy]), are collected in a pseudonymized format and are subject to objections to the processing of these personal data, as detailed in the Cookies Policy.

Purpose: We do not use the personal data indicated in this section to control individual visitors or identify them, but rather to obtain practical knowledge of the way in which users use our web pages that allows INGASO to improve them for users.

8. Personal data of third parties

With regard to other people’s data, we remind you that you must respect their privacy, paying special attention when publishing their personal data. Likewise, as a user, you can only consent to the processing of your personal data, but not those of third parties, since the communication of data from third parties represents a transfer of personal data.

In the event of providing us with personal data of third parties, it is your exclusive responsibility to have their prior and express consent to use them and communicate them to us. You are also responsible for notifying said third parties of the inclusion of their data into our filing system.

9. What happens if you do not provide us with your personal data?

The provision of your personal data is voluntary, so if you do not provide us with the same we will be unable to serve you correctly or provide the services we offer from our different websites.

10. Updating personal data

When you voluntarily provide us with your personal data, you guarantee that you are authorised to provide us with said data and that the information is true and up-to-date. Furthermore, so that we can keep your personal data updated, it is important that you notify us whenever these have been amended; otherwise, we will not be liable for the veracity of these data.

11. Linked websites and third-party applications

Our websites may feature hyperlinks that will let you exit the sites and allow you to access another website. The linked sites are not under the control of INGASO and have different privacy policies. INGASO’s Privacy Policy only affects the personal information that is obtained from our websites, through your use of the Faes Group software or the services of the Faes Group, or through your relationship with the Faes Group. INGASO does not accept any liability whatsoever for said third-party websites.