At MAHER HOLDING S.A., we are committed to privacy protection and the proper use of the personal data that we
process and that you provide to us, both online on this Website and, if applicable, any of its subdomains,
microsites, and offline.
Please read this policy carefully and ensure you understand it and agree with it before
providing your personal data. If you do not agree with it, please refrain from using this Website or its
and do not provide us with your data.
The act of accessing this site, using any of its services or providing your
data, either online or offline, will be understood as an affirmative act through which you give your consent
this is necessary) to process your data for the purposes indicated below.
2. WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?
MAHER HOLDING S.A.
Postal address: C/Lerun,1 – 20870 Elgoibar – Gipuzkoa - Spain
943 127 186
3. HOW HAVE WE OBTAINED YOUR DATA?
3.1. Obtained from the interested party themselves
If you are a current or potential customer or User of our Website, you have provided it yourself, either offline
online by requesting our products or services, or by contacting us to request information.
When you provide your data, you are guaranteeing that you are entitled to provide this information and that it is
true, up to date and does not breach any contractual restriction or third-party rights. You are responsible for
keeping your data and your profile correct and up to date. MAHER HOLDING S.A. accepts no responsibility if you
not do so. You agree not to impersonate other Users by using their registration data for the different Website
services and/or content.
3.2. Obtained automatically due to visiting our Website
When you visit our Website, we compile information through cookies and other tracking and web analytics
This means that data is sent from your browser to our servers to optimise our services and improve your User
experience. This data may be gathered and stored automatically by us or by third parties on our behalf. You can
consult our cookies policy.
3.3. Obtained from a person other than the interested party
It is possible that you have not directly provided us with your data, but that it has been provided by a third
with whom we work, to whom you have previously provided this data. For example:
- Our commercial or distributor network, prior provision of your data to one of our sales
Regarding the other people’s data, their privacy must be respected and special care taken when
posting their personal data. Only the holder can authorise the processing of personal data. The publication of
third-party data without their consent may infringe, in addition to the data protection regulations, those
to the right to honour, privacy or the image of these third parties.
It is the responsibility of the party who provides third-party data to: a) have their prior, express consent to
it, and b) inform them of the processing we are going to carry out with their data. Through the acceptance of
exempting us from any responsibility in the event of any complaint by the interested party.
4. WHAT CATEGORIES OF DATA DO WE PROCESS?
The data categories we process may be:
- Obtained from the interested party themselves: identification data
(full name, tax code), contact details (telephone, postal address, email address, billing or delivery
commercial and economic data (information on the products requested, customer history, and data necessary
payment: bank, credit card, etc.)
- Obtained automatically due to visiting our Website: User IP address, the
date and the time of the visit, the URL of the site from which the User has arrived, the pages of our
visited, information on the browser used (browser type and version, operating system, etc.). Also data from
profiles (information on preferences and interests, browsing or purchasing habits, the sales actions
the information you have requested), to be able to send you personalised information or exclusive campaigns,
- Provided by a third party: identification data
- Regarding data with special protection: We do not
process special categories of data
5. WHAT DO WE PROCESS YOUR DATA FOR?
The data you have provided, as well as the data generated during the course of the relationship we maintain with
can be processed for different purposes:
- If you are a current or potential customer: to maintain contact and
communication with you,
and manage the contractual and/or commercial relationship.
- If you have used our Website, or have sent or
received an email: to manage the requests you make online, and to contact you.
- In the event you access our
premises as a visitor: for access management and visitor control.
- In the event you have provided your CV: to contact you and manage the
selection process we
give your consent, we cannot take your CV into account.
- To protect the vital interests: of the interested
party or another third party.
Purposes with special duty of information:
- To send you, by electronic communication, information about our
activities, products and/or services similar to those requested, including advertising and/or commercial
communications to the effects of art.21 LSSICE 34/2002. If we already have a prior contractual relationship,
communications will be sent based on our legitimate interest. If we do not have a prior contractual
will only send you this type of communications if you have authorised them by marking the option that is
included for this purpose in the corresponding forms. The electronic communications we will send you will
in the communication itself, the option to stop receiving them. If you opt for this, we will stop sending
further communications of this type from then on.
- To transfer your data to other companies or entities,
directly related to MAHER HOLDING S.A., to be able to provide the service or product that you have
the administrative and accounting management that this provision requires. Specifically, we can communicate
data to the recipients set out in the specific section further down in this policy.
6. WHAT IS THE LAWFUL BASIS FOR PROCESSING YOUR DATA?
The legal basis that legitimises the processing of your data may be diverse:
- Fulfillment of the existing legal contractual or commercial relationship if you are already
customer, supplier, or participant in our activities. If you are a potential customer or supplier, it is the
precontractual relationship that links us.
- The provision of the data requested is compulsory as it is required to enter into and/or maintain
contractual or precontractual relationship and comply with the legal obligations deriving therefrom;
you do not provide it, we will not be able to provide the service resulting from this relationship.
- Consent: It may also be the case that you have granted us your consent for a specific
For example: for the sending of commercial communications, if you have entered our Website, if you have
our premises, if you have sent us your CV, if you have given your consent for taking photographs, etc.
- This consent is granted to us unequivocally when you
provide your data on- or offline, as this provision is deemed a clear affirmative act declaring this
provision of the data requested is compulsory as it is essential to attend to your request; if you
it, we cannot fulfil it. You can withdraw this consent at any time by sending us an email stating
email@example.com. This withdrawal will not affect the processing of your data for the
described, but this may mean we are unable to respond to your request.
- Fulfillment of a standard or legal
obligations: such as those established in regulations on finance, tax, social security,
prevention, consumers and users, penal code (art.31 bis: establishment of reporting channels), etc.
legitimate interest as an organisation also constitutes a legal basis for using your data,
legitimate interest is foreseeable by you and that you can reasonably expect that we will use it for this
when we collect it depending on the relationship or service that links us. E.g. to:
Inform you of our activities, products and/or services, even by electronic
communication, if we already have a prior contractual relationship with you. Otherwise, we will only
send you this type of communications if you authorise it by marking the option that is expressly
included for this purpose in the corresponding forms.
- In any event, we deem the indicated processing of your data proportionate and that it has minimal
on your privacy. However, your interests, rights and freedoms will always prevail over our
interest, so if you would prefer we did not process your data for these purposes, please send us an
email stating this to firstname.lastname@example.org, and we will do so.
- Respond to the requests or orders you make, e.g. via the forms on our Website.
7. HOW LONG WILL WE KEEP YOUR PERSONAL DATA?
7.1. General storage period
The personal data that you provide will be stored while the contractual, precontractual or commercial
is maintained and, once these come to an end, while the interested party does not request its deletion. Even if
their deletion is requested, we will be able to hold it for the time needed, limiting its processing, only to:
- Fulfil the legal/contractual obligations to which we are subject,
- and/or for the legally established
period for the expiry of any responsibilities on our part,
- and/or the exercise or defence of complaints
stemming from the relationship maintained with the interested party.
In line with the above criteria,
either in electronic records or on paper, may be deleted, at the discretion of the organisation, depending
logistics needs and/or storage space that make it advisable to eliminate information or documentation.
7.2. Specific storage period
- If you have presented your candidacy for employment, by sending us your CV: we will keep it
request its deletion / for its period of validity, to be able to contact you for the selection process.
8. TO WHOM CAN WE COMMUNICATE YOUR DATA?
We inform you that the data you provide may be communicated to third-party entities for purposes directly related
legitimate functions of assignor and assignee, such as:
- To banking entities: for the management of collection and payments.
- To the occupational health
centre and independent prevention service: in compliance with the obligations of occupational
occupational risk prevention.
- Entities or organisations to which there is a legal obligation to communicate data:
for example, Inland Revenue.
- To notary’s offices, courts or tribunals, registries, public prosecutors, loss
- To insurance companies: for the management and insurance of commercial risks / in case of
insurance and surety for insurance against collection of transactions or civil liability insurance / to
against defective products in the event of possible customer complaints.
- To any of the companies that make up the
business Group for internal administrative purposes, include the processing of personal data of
suppliers and staff.
9. INTERNATIONAL DATA TRANSFERS
At MAHER HOLDING S.A., we ensure your personal data is always processed and located in the European Economic
Nevertheless, in certain circumstances, we may make international data transfers, for example, in the event it
necessary to enter into or execute a contract, in the interest of the interested party, between MAHER HOLDING
and another natural or legal person; or in the event it is necessary to execute a contract between the
party and MAHER HOLDING S.A. for example when using service providers located outside of the European Union that
have access to personal data, for the purpose of providing auxiliary services for our activity (accommodation,
housing, SaaS, remote backups, IT maintenance or support services, email managers, email senders and email
marketing, file transfers, etc.) or for the execution of precontractual measures adopted at the request of the
These entities may be different and vary over time, but we will try to select entities that
belong to countries with a level of protection equivalent to Europe on data protection, or that have appropriate
guarantees that this level is met. Otherwise they will be carried out based on one of the exceptions stipulated
this purpose in the GDPR.
10. WHAT ARE YOUR RIGHTS WHEN YOU PROVIDE YOUR DATA?
You may, when relevant, exercise your rights to access, rectify, delete, limit and oppose its processing, as well
signed, written request, attaching a copy of your national identity document, passport or other valid document
identifies you. In the event your data changes, you must report this to the same address; this entity accepts no
responsibility if you fail to do so.
- Right to access: You can ask us what personal data we are
and request a copy thereof.
- Right to rectify: You can request the rectification of incorrect personal data
or to complete it if it is incomplete, by means of an additional declaration.
- Right to deletion (the right
to be forgotten): You can request we delete your personal data when: it is not necessary for
it was collected, you withdraw your consent, it has been processed unlawfully or due to compliance with
- Right to the limitation of processing: You may request the limitation of processing of your
data, in which case we will only store it for the exercise or defence of complaints.
- Right to oppose: You
can oppose the processing of your data if this processing is based on the legitimate interest of the
responsible for the file or for advertising purposes.
- Right to oppose automated decisions: You can oppose
being subject to decisions based solely on automated treatment of your personal data, including the
profiles that cause legal consequences for you or significantly affect you. E.g. to analyse or predict
related to performance at work, economic situation, health, preferences or personal interests, etc. In
can draw up profiles on your preferences, if you do not oppose this.
Once we receive any of the above requests, we will respond within the legally established timelines. You may make
complaint before the Spanish Data Protection Agency. If you would like further information about the rights you
exercise and to request the forms for exercising your rights, you can to visit the Website of the Spanish Data
Protection Agency, www.aepd.es.