Privacy policy

Introduction

We are strongly committed to people’s privacy, so the protection of personal data is important to us.

We process data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation), Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights, and other applicable regulations.

This Privacy Policy was reviewed in February 2025 to fulfill the duties of information and transparency of the website itself and of the data controller in general, and to make the controller’s general terms on this matter available to any type of data subject, not only website users. There may be variations until its next review.

Who is the data controller for your data?

Controller: COPIFOR S.L.
Tax ID (NIF/CIF): B30321319
Address: C/ Mar Cantábrico 19 y 21, 30591 Balsicas (Murcia), Spain
Email: info@copifor.es

What is the origin and type of data we process?

The information we process may come from any of the following categories of sources:

Paper, electronic or digital forms.
Communication and messaging systems: email and messaging applications, telephone, etc.
Other lawful sources of information.

The categories of data we may process, depending on the type of data subject (user, customer, supplier, employee, etc.), the nature of the controller’s activity and the different data processing operations, are:

Identification data, for example: first name and surnames, identity document.
Identification codes or keys, for example: username, employee code.
Postal or electronic contact details, for example: telephone, email, social media profile.
Personal and professional characteristics data, for example: age, date of birth, qualifications, professional experience, résumé.
Economic, financial and insurance data, for example: bank details, credit card, etc.
Economic and non-economic payroll data and other employment-related information, for example: job position, payslip, etc.
Transaction data, for example: goods and services supplied and received.
Special category data, for example: health, trade union membership, racial origin.
Other data and information necessary or implicit in the performance of our activities, services and purpose.

MANDATORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED BY THE DATA SUBJECT

By ticking the corresponding boxes and entering data in the fields marked as mandatory (for example, with an asterisk) in the contact form or in download forms, data subjects expressly, freely and unambiguously accept that their data are necessary for the controller to handle their request; entering data in the remaining fields is voluntary.

The data subject guarantees that the personal data provided to the controller are truthful and undertakes to communicate any changes to them. The data requested through the website and marked as mandatory are necessary to provide an optimal service to the data subject. If not all the data are provided, we cannot guarantee that the information and services supplied will be fully adapted to their needs.

For what purposes do we process your personal data?

In general, data are processed to successfully carry out the actions implicit in the normal development and management of the controller’s activity. We may, however, specify different processing purposes depending on the possible categories of data subjects:

Customers and prospects: management and maintenance of commercial, pre-contractual and contractual relationships; internal administration; financial management; advertising and marketing; customer service.
Collaborators, creditors and suppliers: management and maintenance of commercial relationships, internal administration and financial management.
Employees: management, development and maintenance of the employment relationship, human resources management, communications, training activities, occupational risk prevention, working-time recording and other purposes arising from legal obligations and the development of employment relationships.
Candidates: management of résumés received, management of job offers and personnel selection.
Web and social media users: user support and management of communications between the parties.
Visitors: visitor support and access control to the premises.

Information on any other category of data subjects processed by the controller will be handled within the framework of its activity, in strict compliance with applicable rules and under the general criteria of this Privacy Policy.

Other general purposes the controller may implement are:

Creation of a commercial profile, with the aim of improving your experience by personalizing offers and communications. No individual decisions will be taken on the basis of that profile, and the controller will act on the basis of legitimate interest.
Video surveillance, for the security of property and people, as well as the corresponding employment monitoring, on the basis of legitimate interest.
Financial management and control of monetary obligations. In the case of debtors with certain, overdue and enforceable pending payments, the controller may report this circumstance to credit solvency files, debtor files and debt management or collection services, among others, on the basis of legitimate interest.
Communications: development and execution of communications through the available data and contact channels (email, instant messaging, etc.) with categories of internal data subjects (employees) and external ones (customers, prospects, collaborators, suppliers, etc.). The purposes of these communications may be informational, organizational, commercial and advertising, as appropriate, on the basis of informed consent and the controller’s legitimate interest.
Other purposes arising from the nature of the controller, motivated by the normal development and exercise of its activity, on a valid legal basis.

How long will we keep your data?

In general, personal data will be kept at least for as long as a relationship with the data subject exists, as long as deletion is not requested, as long as liabilities may arise, or as long as there is a legal retention requirement.

Data of candidates and job seekers will be deleted immediately when they are no longer of interest to the controller.

The controller’s data protection plan includes an inventory of retention periods that it observes in order to manage the different applicable retention periods.

Data will in all cases be deleted in a way that ensures their confidentiality.

What is the legal basis for processing your data?

The controller observes and applies the different legal bases that are applicable to each processing purpose. These are:

Informed consent of the data subject.
Pre-contractual or contractual commitments.
Legitimate interest of the controller.
Applicable legal obligations.
Other legal bases provided for by law.

To which recipients will your data be disclosed?

By default, data subjects’ data will not be disclosed to any third party, except: a) auxiliary services, authorized data processors or other third parties implicitly necessary for the proper provision of goods and services; b) competent public authorities and administrations in the exercise of their functions; c) other legitimate interested parties and third parties provided for by law.

What are your rights when you provide us with your data and/or we process it?

As a data subject, you may at any time ask us to exercise any of the following data protection rights:

Access to the data subject’s personal data, to confirm whether or not data concerning them are being processed and to obtain further information about this processing.
Rectification or erasure of the data subject’s personal data when, among other reasons, they are inaccurate or no longer necessary for the purposes for which they were collected.
Restriction of the processing of the data subject’s personal data in certain circumstances, in which case they will only be kept for the establishment, exercise or defense of claims, for the protection of the rights of another person or for reasons of public interest.
Receiving the personal data concerning you that you have previously provided to us, in a structured format where possible (data portability).
Objecting to the processing of your data in certain circumstances and on grounds relating to your particular situation. The company will stop processing your data, except for compelling legitimate grounds or for the establishment, exercise or defense of possible claims.
Withdrawing consent, which may result in the termination or cancellation of the existing business or contractual relationship, if any, without prejudice to processing carried out before the withdrawal of consent.

To do so, you only need to contact us at the email or postal address indicated at the beginning.

Optionally, you may also contact our designated data protection officer, or the Data Protection Agency, to learn more about your rights or to request their protection by the supervisory authority.

Data security

We adopt in our information system the technical and organizational measures necessary to ensure an adequate level of confidentiality, integrity, availability and resilience of data, in order to protect the rights and freedoms of data subjects.

The controller complies with the provisions and principles described in the GDPR to process data lawfully, fairly and transparently in relation to the data subject, and in a manner that is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

However, to the extent permitted by law, we accept no liability for damages arising from alterations that third parties may cause in our information system. Any security breach will be promptly and appropriately reported to the competent authority and/or the State security forces.

Sending communications or information

Our policy on sending information by electronic means (email, instant messaging, etc.) is limited to sending only communications that we consider to be of interest to our users and data subjects in relation to the company’s functions and activity, or that you have consented to receive.

If you prefer not to receive these messages, we will offer you, through them, the possibility of exercising your right to cancel and unsubscribe from receiving such messages, in accordance with Title III, Article 22 of Law 34/2002 on Information Society Services and Electronic Commerce.

Social media

The controller may have a presence on social networks through the corresponding profiles. This section, and any legal and privacy terms present on the website, apply to the processing of data of users or data subjects who become followers of, or otherwise link to, those profiles.

The purposes for which the controller uses these profiles are communication, business development, marketing and advertising, handling queries addressed to the controller and user support, informing about actions, activities and events organized by the controller or in which it participates, and interacting through the official profiles.

The legal bases set out in the section “What is the legal basis for processing your data?” above are supplemented in this case because the user or data subject may have a profile on the same social network as the controller and has decided to join or connect with the controller’s profile, thereby showing interest in the information published by the controller. Therefore, by following the controller’s profiles, you give your consent to the processing of the data available on your profile.

Users may at any time access the privacy policies and terms of the corresponding social network, and configure the privacy settings of their profile. Posts made by users will be visible to other users, so users are themselves primarily responsible for their own privacy.

Users who follow and/or participate in our profiles shall refrain from:

Publishing content or information contrary to the law, morality and good faith. No unlawful, disruptive or inappropriate use or behavior is permitted, nor any that may generate negative opinions about the profile or infringe the rights of individuals.
Behaving in a manner contrary to the principles of legality, honesty, responsibility, protection of human dignity, protection of minors, protection of public order, protection of private life, consumer protection and intellectual and industrial property rights.

The controller reserves the right to remove, without prior notice, any content considered inappropriate. It also disclaims any liability in relation to the security measures of each platform; users must be aware of them together with the legal terms and conditions of use of the platform itself.

The controller is expressly exempt from any liability that may arise from the use of social networks by minors or persons with disabilities. The controller’s social networks do not knowingly collect any personal information from minors; therefore, if the user is a minor, they must not register or use the controller’s social networks or provide any personal information. In Spain in particular, the processing of a minor’s personal data may only be based on consent from the age of 14. Moreover, if any rule or regulation so requires, or the user has a disability, the intervention of the holder of their parental authority or guardianship, or of their legal representative, will be necessary, by means of a valid document proving the representation.

Employment and candidate management

Individuals interested in the controller’s job offers may provide their data and professional information to the controller through different channels, preferably through the existing forms, email addresses and other means available for this purpose, where applicable.

These data will be processed in accordance with the privacy terms set out here for the purpose of managing applications for possible job offers, internships and training at the responsible entity and any subsidiaries or companies belonging to the same business organization, where they exist and as applicable.

Processing will be based on the data subject’s informed consent or another valid legal basis.

The data provided, if they are not of professional interest to the entity or once they are no longer necessary for the purposes for which they were collected, will be deleted, ensuring their confidentiality and anonymization.

Any data subject may withdraw their consent and exercise the privacy rights to which they are entitled under the terms set out in this privacy policy.