Privacy Policy

The official and legally valid version of this content is the original Spanish version. Translations into other languages are provided solely for the convenience and understanding of users. In the event of any discrepancy, contradiction or conflict of interpretation between the Spanish version and any translated version, the Spanish version shall prevail in all cases.

In compliance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “GDPR”), and Article 11 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, we hereby inform you as follows:

The User must carefully read this Privacy Policy, which has been drafted in clear and accessible language to facilitate understanding, in order to enable the User to determine freely, knowingly and voluntarily whether he or she wishes to provide MEDLAND (hereinafter, the “Entity”) with his or her personal data or those of third parties.

Information on the Data Controller

Company name: MEDITERRANEAN SPAIN LAND, S.L.
Tax Identification Number (NIF): B54720214
Registered address: C/ Paseo del Prado – 03184 Torrevieja (Alicante), Spain
Data Protection Channel: https://corporate-line.com/cnormativo-medlandspain
Data Protection Officer: dpdexterno@bonetconsulting.com

Purpose, legal basis and retention of your personal data

The Entity will process the personal data provided by the User for the following purposes and for the retention periods indicated below:

To manage the provision and performance of the services and/or products contracted, as well as the preparation, monitoring and management of contracts, offers and service proposals, including the data of persons whose involvement is necessary for such purposes. The legal basis for this processing is the performance of a contract or the implementation of pre-contractual measures at the request of the data subject. In this case, personal data will be retained for as long as the contractual or pre-contractual relationship is maintained and, once terminated, for the legally required periods in order to address any liabilities arising therefrom.

To manage and respond to communications, as well as any type of request, suggestion, complaint or submission made by reporting persons/users through the Internal Information System, in accordance with Law 2/2023 of 20 February on the protection of persons reporting regulatory breaches and on combating corruption. Such communications may involve management of the matter and, where appropriate, referral to the department responsible for proper handling and compliance with the applicable legal framework. The legal basis for this processing is compliance with legal obligations applicable to the Entity. Data relating to the information received and internal investigations will be retained for the necessary and proportionate period for the purposes of complying with the Whistleblower Protection Law, and in no event for longer than ten years. Three months after receipt, the communications will be erased, except where retention is necessary in order to provide evidence of the existence and operation of the System and/or on the basis of other regulatory compliance requirements associated with the information, with the identity of the reporting person being anonymised in a separate area subject to appropriate security measures.

To send informational communications concerning products or services similar to those already contracted by the Customer. The legal basis for this processing is the legitimate interest of the Entity, within the framework of a prior contractual relationship and provided that such communications refer to the Entity’s own products or services similar to those initially contracted, always guaranteeing the right to object in each communication. In the case of electronic communications, this processing is covered by Article 21.2 of Law 34/2002 on Information Society Services and Electronic Commerce (hereinafter, the “LSSI”). Personal data will be retained until the right to object is exercised or the data subject unsubscribes from receiving such communications.

Within the framework of employment relations management, the Entity may process personal data of employees, candidates or associated personnel for the following purposes:

To manage the employment relationship, including the formalisation, development and termination of the employment contract, as well as payroll, accounting and administrative management.
To manage attendance control, time recording and compliance with working hours.
To organise and manage mandatory or necessary training activities for the performance of the job position.
To comply with obligations relating to occupational risk prevention, health surveillance and psychosocial risk management.
To exercise the employer’s monitoring powers provided for under labour legislation, in accordance with Article 20.3 of the Workers’ Statute.
To manage internal communications necessary for the proper conduct of the employment relationship, including operational notices, alerts, or access to corporate tools and documentation. Such communications may be made through personal contact means provided by the data subject when necessary for the development of the employment relationship, with corporate channels being used preferably where available.
To verify the absence of conflicts of interest or situations that may compromise the Entity’s integrity, security or regulatory compliance.
To ensure the implementation of equality, non-discrimination, anti-harassment policies and the protection of vulnerable groups in the workplace.
To process the image of employees for corporate or dissemination purposes, where prior express consent has been obtained.

The legal basis for such processing activities shall, depending on the specific nature of each activity, be the performance of the employment contract (Art. 6.1(b) GDPR), compliance with legal obligations (Art. 6.1(c) GDPR), the legitimate interest of the Entity (Art. 6.1(f) GDPR), or the data subject’s consent (Art. 6.1(a) GDPR), where necessary. Personal data will be retained for the duration of the employment relationship and, once terminated, for the legally required periods to address any possible liabilities.

To send marketing communications, newsletters or mailings, where such communications are not covered by a prior contractual relationship under the terms indicated above. The legal basis for this processing is the data subject’s consent, freely, specifically, informedly and unambiguously given. Personal data will be retained until the consent granted is withdrawn or the data subject unsubscribes from receiving such communications.

To manage the receipt and assessment of applications, CVs and recruitment processes, including unsolicited applications sent through the website or contact email, as well as their consideration for present or future vacancies matching the candidate’s profile. The legal basis for this processing is the data subject’s consent, manifested through the submission of the application. Personal data will be retained until consent is withdrawn and, in any event, for a maximum period of one year from receipt of the curriculum vitae.

To ensure the security of persons, property and facilities through video surveillance systems. The legal basis for this processing of personal data is the legitimate interest of the Entity in preserving the security of its facilities, persons and property. Images will generally be retained for a maximum period of 30 days from capture, unless they must be retained longer in order to prove the commission of acts affecting the integrity of persons, property or facilities, or to comply with a legal obligation.

To manage the professional relationship with suppliers, collaborators and third parties, including the maintenance of the commercial, administrative, accounting and invoicing relationship deriving from services contracted by the Entity. The legal basis for this processing is the performance of the contract and compliance with the legal obligations applicable to the Entity. Personal data will be retained for the time necessary to manage the contractual relationship and subsequently for the legally required periods.

To manage and monitor internal compliance mechanisms, policies and procedures, including internal control activities, and the prevention, detection and investigation of breaches of legal rules or internal policies. The legal basis for this processing is compliance with legal obligations and, where applicable, the public interest or the legitimate interest of the Entity in ensuring regulatory compliance and the integrity of its organisation. Personal data will be retained for the time strictly necessary for the processing, investigation and closure of the relevant actions and subsequently for the legally required periods.

To manage requests for the exercise of data protection rights received through the channel made available by the Entity for this purpose. The legal basis for this processing is compliance with a legal obligation applicable to the controller. Personal data will be retained for the time necessary to process and resolve the request and subsequently for the legally required periods to demonstrate that the request was properly addressed.

To manage and respond to reports or communications concerning the prevention of and response to harassment, violence or particularly serious conduct, especially where affecting specially protected groups, including, where applicable, trans persons, LGTBI persons and minors, as well as to process any internal actions that may be appropriate. The legal basis for this processing is compliance with legal obligations, the substantial public interest and, where applicable, the establishment, exercise or defence of legal claims, depending on the specific nature of the communication and the data processed. Personal data will be retained for the time strictly necessary for the handling of the communication, the investigation and the adoption of the appropriate measures and subsequently for the legally required periods. If such communications are channelled through the Internal Information System, the periods provided for in Law 2/2023 of 20 February shall apply.

To comply with the legal obligations applicable to the Entity, in commercial, tax, accounting, administrative, anti-money laundering, labour, data protection or any other area that may be applicable. The legal basis for this processing is compliance with a legal obligation. Personal data will be retained for the periods established in the applicable regulations in each case.

Likewise, the Entity may process personal data for any other purposes necessary to comply with legal obligations or specific regulatory requirements applicable to its activity.

The personal data processed generally come from the data subject. However, in certain cases, the data may come from third parties with whom the data subject maintains a relationship, such as client companies, collaborating entities or suppliers, as well as from publicly accessible sources where legally permissible. In such cases, the data subject will be informed under the terms established in Article 14 GDPR.

Recipients of your personal data and international transfers

The Entity may disclose the data subject’s personal data to the following recipients where necessary depending on the purpose of the processing and on the legal basis applicable in each case:

Competent Public Administrations, such as the Social Security authorities, the Spanish Tax Agency, subsidy management bodies or the Public Prosecutor’s Office, where disclosure of personal data is necessary for compliance with legal obligations applicable to the Entity.
Social Security collaborating mutual insurance entities, occupational risk prevention services or other similar entities, where necessary for compliance with obligations in labour, safety and health matters or for the protection of employees.
Legal representatives of employees, including works councils, trade unions and prevention delegates, in cases where labour legislation so requires.
Clients or entities linked to the provision of services, exclusively where it is essential to identify employees for the proper performance of the contracted service, in all cases limiting disclosure to data that are adequate, relevant and not excessive, in accordance with the principle of data minimisation.
Service providers acting as data processors, with whom the Entity has entered into the corresponding data processing agreement in accordance with Article 28 GDPR.
Personal data may be disclosed, where necessary, to the competent authorities, the Public Prosecutor’s Office, judicial bodies or third-party data processors providing services linked to the management of the Internal Information System, subject to the appropriate contractual and confidentiality safeguards.
Judicial authorities, the Public Prosecutor’s Office and law enforcement authorities, where disclosure is necessary in order to comply with a legal obligation, for the establishment, exercise or defence of legal claims, or in compliance with requests or orders from such authorities.

As a general rule, no international transfers of personal data are envisaged. However, if technological service providers are used that may involve the processing of data outside the European Economic Area, such transfers shall be carried out in full compliance with Articles 44 et seq. GDPR, through the adoption of appropriate safeguards, such as the execution of standard contractual clauses approved by the European Commission or other valid mechanisms under the applicable regulations.

Personal Data Protection Rights

In order to ensure transparency in the processing of your personal data, we inform you of the rights granted to you by data protection legislation. Each of these rights and how you may exercise them in relation to the personal data we hold is set out below.

Right of access: You have the right to know whether the Entity is processing your personal data.
Right to rectification: You have the right to request the correction of inaccurate data.
Right to erasure: You have the right to request the deletion of your personal data when they are no longer necessary for the purpose for which they were collected.
Right to restriction of processing: You have the right to request that the use of your data be restricted, so that they are retained only for the defence of legal claims.
Right to object: You have the right to object to the processing of your personal data, unless there are legitimate grounds or they are required for the defence of legal claims.
Right to data portability: You have the right to receive the data in a structured and readable format in order to transfer them to another controller, where possible.
Right to withdraw consent: You have the right to withdraw the consent given at any time, except where processing is authorised by law or necessary for a contracted service, without retroactive effect.
Right not to be subject to automated decisions: You have the right not to be subject to automated decisions based on personal data that significantly affect you, such as profiling.

You may communicate and process the exercise of your rights and report any indication or knowledge you may have of possible security breaches, cyberattacks and/or possible breaches or irregularities concerning data protection legislation through the channel and/or email enabled by the Entity for this purpose: https://corporate-line.com/cnormativo-medlandspain / dpdexterno@bonetconsulting.com

In the event of disagreement with the Entity in relation to the processing of your data, you have the right to lodge a complaint with the corresponding Data Protection Supervisory Authority. In Spain, this authority is the Spanish Data Protection Agency (www.aepd.es).

The Entity may request additional information to confirm the identity of the applicant where there are reasonable doubts in this regard and will respond to the request within a maximum period of one month from receipt, which may be extended in particularly complex cases.

Internal Information System

The Entity has implemented an Internal Information System (SIIF), which constitutes a fundamental pillar for supervision, control and prevention in the field of regulatory compliance, reflecting the highest commitment, rigour and professionalism in matters of security, confidentiality, data protection, experience, independence and knowledge in the handling of communications received.

The internal reporting channels integrated into the System have been implemented through technical tools that include all the necessary requirements to ensure and guarantee the commitments referred to above. Likewise, the SIIF guarantees the basic principles of anonymity, proper record-keeping, preservation and non-alteration, prevention of conflicts of interest, protection of the reporting person and prevention of retaliation.

Through this System, every reporting person must communicate in good faith any indication, suspicion or evidence of possible regulatory breaches, criminal offences, unethical behaviour and, in general, any breach of the Entity’s protocols, rules and codes of conduct.

Access to the SIIF has been enabled in a separate section of our website.

Processing of personal data within the Internal Information System

Within the framework of the Internal Information System (SIIF), the Entity will process personal data for the purpose of managing and processing the communications received, as well as analysing, verifying and investigating the facts reported, and, where appropriate, adopting the relevant corrective, disciplinary or legal measures.

This processing is carried out in compliance with the legal obligations established by Law 2/2023 of 20 February on the protection of persons reporting regulatory breaches and on combating corruption, as well as, where appropriate, on the basis of the legitimate interest of the Entity in preventing and detecting unlawful conduct or conduct contrary to internal rules.

Within the framework of these activities, the following categories of personal data may be processed:

Identification and contact data of reporting persons, affected persons and third parties involved.
Professional and employment data linked to the relationship with the Entity.
Information relating to the facts reported, including descriptions, assessments or associated documentation.
Where appropriate, special categories of data pursuant to Article 9 GDPR, where their processing is strictly necessary for the investigation and there is a sufficient legal basis under the applicable regulations.

The personal data may come from the reporting person (whether identified or anonymous), the affected persons or third parties participating in the investigation.

Confidentiality and protection of the reporting person

The Entity guarantees the confidentiality of the identity of the reporting person, as well as of any third party mentioned in the communication and of the persons affected. Access to the data shall be restricted exclusively to authorised personnel involved in the management and investigation of the communications.

Likewise, any form of retaliation, discrimination or unfavourable treatment against the reporting person or against those cooperating in the investigation is expressly prohibited, under the terms set out in Law 2/2023.

The exercise of rights in matters of data protection may be limited where necessary to preserve the confidentiality of the reporting person’s identity, prevent obstruction of the investigation or ensure the proper conduct of the proceedings, under the terms provided for in the applicable regulations.

Security and control measures

General

The Entity will process personal data by applying the appropriate technical, legal, organisational and security measures in order to guarantee the confidentiality and integrity of the information it manages in accordance with the applicable regulations.

Cybersecurity

As a specific and complementary concept to the foregoing, the Entity applies cybersecurity measures to prevent and manage possible attacks and fraud by cybercriminals that threaten the privacy and protection of the data that our Entity processes and accesses within the framework of its activities and operations.

In this regard, we wish to warn you that in the event of possible risk situations arising from communications whose content and/or format raise doubts as to their authenticity, we recommend disregarding them and contacting the Entity through the contact details indicated in this Privacy Policy.

Likewise, any request you receive purportedly from our Entity relating to changes in payment methods, requests for data or contact persons, confidential (non-public) information, bank details and/or credit card details and/or other official data should not be complied with without direct confirmation from our Entity by an alternative means.

We appreciate and require your cooperation in reporting any notification relating to this type of request and other possible cyberattack risk situations in which our Entity may be used, as well as any possible security risk of which you may become aware.

Attention and support

Data subjects may submit to the Entity any questions regarding the processing of their personal data or the interpretation of our Policy by contacting the Data Protection and Privacy Officer through the email addresses indicated at the beginning of this Policy.

Updates and amendments

The Entity reserves the right to modify and/or update the information on data protection whenever necessary for proper compliance with the applicable regulations in this field. Should any amendment be made, the new text will be published in this same section of the website.