Privacy policy
The CAF Group is seriously committed to strict compliance with data protection regulations in the different countries, taking into account the regulatory advances recently produced in some of them and, in particular, in the countries of the European Union, especially a through Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 regarding the protection of natural persons with regard to the processing of personal data and the free circulation of these data.
CAF informs about its Privacy Policy, with the purpose of informing website users about the processing of their data, as well as the fundamental principles on personal data protection that it applies. Despite this, certain services may contain conditions of use with provisions regarding the protection of personal data, with a specific Privacy Policy that prevails over this one.
You agree to carefully read this Privacy Policy to inform yourself about the standards and practices adopted by CAF to protect your personal data and to better understand our relationships with third parties who may have access to such data.
In any case, the user is solely responsible for the information provided on the website.
1. Controller of the processing activities
The contact details of the Data Controller are as follows:
- Construcciones y Auxiliar de Ferrocarriles, S.A with registered office at José Miguel Iturrioz Street, 26, Beasain (hereinafter, CAF).
To guarantee adequate management in the processing of your data, CAF has designated a Data Protection Officer, to whom you can contact for any question you may need and who you can contact at the following email address: dpo@caf.net.
2. Purposes of the processing of personal data
The different purposes for processing your personal data are detailed below, as well as the legal basis that support the processing activities:
| Purpose | Additional Information | Legal basis (variable depending on the specific processing activity) |
|---|---|---|
| Manage the data of all people who access the website through the cookies and pixels that will be installed on their devices, as well as maintenance and support of the use of the website and improving their browsing experience. | Manage user web navigation. Data processing to allow easier access and navigation through our digital media. For example, to offer you the version of the web page that best suits the device used. |
*We inform you that your privacy is important to CAF and, in this sense, we have made the appropriate balancing test to verify that your interests, rights and fundamental freedoms do not prevail over ours before applying legitimate interest as a legal basis for the purposes mentioned in this section. You can request a copy of the conclusions of said balancing test at the following email address: dpo@caf.net.
3. Recipients of personal data
The recipients of the data, in addition to the Controller for the processing, may be public bodies and authorities and Courts and Tribunals when there is a legal obligation to provide the data.
Likewise, your personal data may be accessed by trusted companies so that they process them on our behalf within the framework of their provision of services, following our instructions and respecting our Privacy Policy and any other appropriate confidentiality and security measure. These providers are not authorized to use or disclose your personal information except as necessary to provide services on our behalf or to comply with legal requirements.
4. International data transfers
CAF may transfer your personal data to recipients located in countries outside the European Economic Area that may have data protection laws different from European ones. This includes those countries that, according to the European Commission, do not have an adequate level of protection for personal data. You can obtain more information about international transfers made by CAF, along with the safeguards that were applied in each case, by sending an email to dpo@caf.net.
5. Data retention period
The retention period of your data will be determined based on the duration of your relationship with CAF and the legally established periods. In this sense, the criteria that CAF uses to set the retention periods of your data has been determined in accordance with the requirements established in the applicable legislation, regulations, and regulatory guidelines, as well as CAF's operational requirements related to the correct management the existing relationship with the different categories of data subjects. The personal data provided will be kept for the period necessary for the execution of the purposes described in this policy, and as long as deletion is not requested by them, in which case, the personal data will remain blocked for the period necessary to compliance with a legal obligation or for the formulation, exercise and defence of claims that may arise from their processing. Later, it will be deleted.
6. Rights of data subjects
- CAF undertakes to respect the confidentiality of your Personal Data and to guarantee the exercise of your rights, and specifically:
- Access your data: You have the right to access your data to know what personal data we are processing that concerns you.
- Request rectification or deletion of your data: In certain circumstances, you have the right to rectify personal data that you consider inaccurate and that concerns you, and that is subject to processing by CAF, as well as the right to request the deletion of your data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
- Request the limitation of the processing of your data: In certain circumstances, you will have the right to ask us to limit the processing of your data, in which case we inform you that we will only keep the data on which you have requested limitation in the processing for the exercise or defence of claims.
- To the portability of your data: In certain circumstances, you will have the right to receive the personal data that concerns you, and that you have provided to us, in a structured format of common use and machine reading, as well as to have it transmitted by CAF to another controller.
- Oppose the processing of your data: In certain circumstances and for reasons related to your situation, you will have the right to object to the processing of your data in which case, we would stop processing it unless we must continue to do so for compelling legitimate reasons or for the exercise or the defence of possible claims.
- To exercise these rights, and for any other clarification, the data subject may write to the postal address indicated above or to the following email address: dpo@caf.net. Finally, you can file a claim with the competent data protection supervisory authority (www.aepd.es).
7. Modifications
CAF undertakes to always inform the user if in any case there is a different or new data processing than those mentioned in section 1.2 of this Privacy Policy through the website or by other means, so that you can learn about the new privacy conditions.