Privacy Policy

1. Object

This Privacy Policy aims to inform individuals (hereinafter, users or interested parties) who visit our website (hereinafter, website, site, or web) about how we collect, process, and protect the personal data they choose to provide us by any means (forms, emails, phone calls, contracts, etc.) and after reading it, decide freely whether they want us to process them. Additionally, it will serve to expand the information that we have previously provided to interested parties, in the informative clauses provided in the processes of collecting their personal data. Likewise, this policy aims to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data (hereinafter GDPR) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD).

2. Who is responsible for processing your personal data?

Identity – Entity ALEXIA GRAU TOMÁS
CIF/NIF 24396117V
Postal address: Pza. Legión Española, 2, 46010 Valencia (Valencia)
Phone: 644380922
Email: aloha@hoala.es
Corporate Purpose: Training for professionals
Website: http://www.hoala.es/

3. What personal data will we process and how do we obtain them?

For the development of our business activity, it is essential to process personal data that can be collected through digital means (e.g., email, forms, or web questionnaires), by filling out paper documents (e.g., contracts or forms), or through face-to-face or telephone conversations. In any of these cases, the data will be processed fairly, lawfully, and transparently.

The categories of data that our entity will process about interested parties are:

• Identification data: name and surname, DNI or equivalent document, image, voice, and signature (handwritten or digital).
• Contact data: phone number, email, postal address.
• Commercial data: quotes, purchase conditions, service and/or purchase management and history, results of contacts (phone, email, messaging, and other communication channels).
• Access data: username and password.
• Accounting data: income and expense control, billing data.
• Banking data: bank accounts and cards.
• Transaction of goods and services: transfers and direct debits, amounts and concepts.
• Browsing data: analysis of time spent on our website, pages visited, demographic data (e.g., age, sex, language).

Our entity will not collect special category data (e.g., health data, ethnic origin, political opinions, or religious beliefs), but if it becomes necessary to process them, you will be informed, and prior and express consent will be requested.

Therefore, the requested data will be adequate, relevant, limited to the strictly necessary, and processed only by the personnel and/or collaborators authorized by our entity, who will have signed a confidentiality agreement and commit to complying with the necessary security measures that guarantee the confidentiality, integrity, and availability of the processed data and other requirements legally established in the GDPR. Therefore, they will be processed within the law.

The data to be processed are provided by the interested party or their legal representative, although there may be cases where we delegate some functions to certain collaborators, and they are responsible for collecting your data, but they will always be processed with your prior and express consent.

If an interested party does not provide the requested data or provides incomplete or incorrect data, it will not be possible to fulfill and maintain the relationship with them.

The categories of data we may process about a person will depend on the relationship they maintain with our entity, as shown below:

Clients: Identification, contact, access, commercial, accounting, banking, transaction of goods and services data will be processed, and they can only be collected if the client provides them to us, either in person, by phone, by email, or through our web forms.

Participants and Students: Identification, contact, access, and commercial data will be processed and can be provided by the students or participants in our events or by the companies they work for, either in person, by phone, by email, or through our web forms.

Information Seekers: Whether the requested information is by phone or in writing (e.g., email or web forms), we will request and process your identification, contact, and commercial data.

Suppliers and Collaborators: Identification, contact, access, commercial, accounting, banking, transaction of goods and services, and financial data will be processed. These data can be processed throughout all stages of the commercial relationship.

Job Applicants: For this category of interested parties, curricular, identification, contact, and other data related to their professional or personal characteristics will be processed when they send us their application by any means (e.g., in person, by email, web forms). They can also be collected during selection interviews (in person or by video conference). Their job application can even reach us through a collaborator to whom we have delegated certain functions.

Social Media Users: We are present on different social networks and may process identification, contact, commercial, and other data that the user enables to be viewed or shared with other users of the social network, including curricular data (e.g., LinkedIn). For more information, consult our Social Media Policy.

Subscribers: In the subscription forms for our newsletters, an email address is requested.

Claimants: Identification, contact, and personal information data of oneself or third parties that you want to inform us about concerning the claim you submit will be processed.

Website Users: When visiting our website, and only if the user expressly authorizes it, analytical data (e.g., time of visit or pages visited) and even demographic data (e.g., gender, age, country, or language) may be collected. For more information, visit our Cookies Policy.

More Information for Interested Parties: The legally established information will be made available to interested parties in the corresponding informative clauses included in the different data collection means so that you can freely and expressly decide if you want the requested personal data to be processed by our entity.

All categories and types of personal data processed will be duly identified in the corresponding processing activities owned by our entity.

4. What will your data be used for?

In general, the processing of personal data carried out by our entity is aimed at fulfilling and maintaining the relationship with different groups of people, such as clients or suppliers. Also, with other people who contact us proactively through our web forms, by phone or in person, by email or postal mail, such as job applicants or information seekers, web/blog or social media users, and interested parties in general.

Depending on this relationship, the processing of your data serves different purposes, which we detail below:

Clients: Your personal data will be processed to identify you, fulfill and maintain the pre-contractual and contractual relationship, including the sending of commercial communications by various means, responding to inquiries, conducting quality controls, and commercial statistics, providing our services, managing accounting and billing, the transaction of goods and services, managing collections, handling incidents, claims, and exercising rights, as well as for other purposes we are obliged to fulfill this relationship, the laws we are subject to, and to fulfill our legitimate interests.

Participants and Students: Your personal data will be processed to identify you, fulfill and maintain the pre-contractual and contractual relationship, including the sending of commercial communications by various means, responding to inquiries, conducting quality controls, and commercial statistics, providing training, registering you as a participant in our events, managing accounting and billing, the transaction of goods and services, managing collections, handling incidents, claims, and exercising rights, as well as for other purposes we are obliged to fulfill this relationship, the laws we are subject to, and to fulfill our legitimate interests.

Information Seekers: We will process your personal data to attend to your general information requests, to identify you, to send or deliver quotes and information about the services of interest, including in our response (verbal or written) the commercial information related to the request. We will also follow up by various means to know the decisions made regarding the commercial proposals we have sent you.

Job Applicants: Your data will be processed to include you in our selection processes and job pool, to identify you, and to contact and inform you about vacancies, coordinate interviews, and other matters related to your application.

Suppliers and Collaborators: Your personal data will be processed to maintain the commercial relationship, whether for requesting quotes, contracting services, identifying you, registering you as a speaker at our training activities, managing accounting, conducting the transaction of goods and services, as well as for other purposes necessary to fulfill this relationship, our legal obligations, and legitimate interests.

Social Media Users: We will process your personal data to maintain the relationship as users of the same social network, to identify you, contact you, share news, and other personal data you allow sharing with other members of the social network. For more information, consult our Social Media Policy.

Subscribers: Your data will be processed to send you our newsletters or advertising by email, to identify you, and to process the unsubscription from these mailings if you request it.

Claimants: Personal data will be processed to identify you, manage your claim, and contact you about its status, in addition to fulfilling our legal obligations and legitimate interests.

Website Users: Data can also be processed for different purposes (e.g., visit analysis) when accepting the installation of cookies when visiting our website. For more information, visit our Cookies Policy.

More Information for Interested Parties: The legally established information will be made available to interested parties in the corresponding informative clauses included in the different data collection means (e.g., web forms) so that you can freely and expressly decide if you want the requested personal data to be processed by our entity for the purposes explained therein.

5. Why do we process your data (legal basis)?

The processing of your personal data by our entity is carried out based on one or more of the following legal grounds:

When you provide us with your express, free, informed, and unequivocal consent, after being informed at the time of collecting your data and in more detail with this privacy policy. After reading this policy and agreeing with it, you can voluntarily authorize us to process your data for one or more purposes by checking the boxes provided for this purpose in our web forms, through your verbal consent (requiring voice recording), or by signing the informative clauses we provide at each moment when requesting your personal data. For the execution of a contract to which you are a party or when you have requested pre-contractual measures from us. When the processing is necessary for compliance with a legal obligation applicable to our entity. When the processing is necessary for the satisfaction of legitimate interests pursued by our entity or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject. In this regard, we inform you that our entity has conducted an analysis weighing our legitimate interests against the rights and freedoms of the data subject, always respecting their fundamental rights. If the user is under 14 years old, it will be necessary to obtain consent from parents, guardians, or legal representatives to process their data. The user is solely responsible for the accuracy of the data they submit to us.

6. Data Retention

The personal data provided will be retained as long as we maintain the relationship with you and for the necessary time to fulfill the purpose for which your data was collected.

Once this relationship has ended, we will keep your data blocked in cases where it is necessary to retain it until the prescription of liabilities for the sole purpose of claims or legal actions, as well as to comply with our legal obligations, for example:

Stakeholders	Sectoral Scope	Legal Basis	Retention Period
Clients/Suppliers	Accounting	Art. 30.1 R.D. Commercial Code	6 years from the last entry
Clients/Suppliers	Tax	Art. 66 General Tax Law 58/2003	General period: 4 years; In case of losses during the fiscal year: 10 years; Invoices: 5 years
Employees	Labor	Art. 21 Royal Legislative Decree 5/2000 – Social Order	4 years
Job Applicants	Labor	Labor Relations Guide	1 year
Employees	Occupational Risk Prevention	Art. 4.3 Royal Decree 5/2000 – Social Order	5 years
Job Applicants	Job Applications	Labor Relations Guide – AEPD	1 year

 

7. Profiling

We do not create profiles or make automated decisions using your personal data. However, if we do so, you will be informed and prior authorization will be requested.

Similarly, you have the right to object to this type of processing at any time by writing to our entity at aloha@hoala.es.

8. Data Transfer

As a general rule, our entity does not transfer personal data to third parties without prior consent, although it will be necessary to do so in the following cases:

If you are a customer, student, participant, collaborator, or supplier, your personal data may be transferred to third-party entities by legal obligation (e.g., Tax Agency) or in those cases and entities necessary to provide our services or pay invoices (e.g., banks).

Additionally, your personal data as a customer, student, participant, collaborator, or supplier may be processed by certain providers to whom we delegate some of our obligations (e.g., accounting advisors). All of them have committed through a data processing agreement to comply with the same security measures implemented by our entity, as well as to maintain the duty of secrecy and confidentiality regarding the processed personal data, among other obligations in the field of personal data protection.

If you are a job applicant, your data will not be transferred to third-party entities unless we are legally obliged to do so.

If you are an information requester, your data will not be transferred to third-party entities unless we are legally obliged to do so.

In the case of users of our website, your data may be processed through the use of cookies by collaborators (e.g., Google), if you accept the use of all cookies when visiting our website. For more information, visit our Cookie Policy.

In general terms, we may transfer your personal data to Judges, Courts, Public Prosecutor’s Office, and/or the competent Public Administrations in the event of possible claims when we are obliged to do so.

9. International Data Transfer

In the event of transfers to third-party entities located in countries outside the European Economic Area, we will inform you and request your prior and express consent.

10. Security Measures

Our entity has implemented all the necessary technical and organizational measures to protect the processed personal data, preventing its loss, theft, or unauthorized use.

These measures have been created based on the type of data processed and the purposes that motivate such processing. They are periodically verified in our internal compliance controls with personal data protection regulations and through external audits.

11. Your Rights

As the owner of your personal data, and acting on your own behalf or through your legal representative (e.g., individuals under 14 years of age), you can contact our entity at any time and request to exercise your rights regarding personal data protection.

We explain what these rights are:

Right of Access:

You have the right to know and request from us at any time the following information:

• Whether we are processing your personal data or not.
• The purposes of the processing, as well as the categories of personal data involved.
• The origin of your data, if you did not provide it to us.
• The recipients or categories of recipients to whom your personal data have been or will be disclosed, including, where applicable, recipients in third countries or international organizations.
• Information about the appropriate safeguards relating to the transfer of your data to a third country or international organization, if applicable.
• The envisaged period of retention, or if not possible, the criteria used to determine this period.
• If automated decisions, including profiling, exist, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing.
• A copy of your personal data undergoing processing.

Right of Rectification:

Request us to rectify your personal data when it is inaccurate or incomplete.

Right of Objection:

You may object to the processing of your data when it is incorrect or no longer necessary.

If you act as a defendant or person affected by a complaint under Law 2/2023, you cannot exercise your right of objection, as it is presumed (subject to rebuttal) that there are legitimate reasons for the processing of your personal data, in accordance with Article 31.4 of the Law.

Right to Erasure:

Request us to delete your data for any of the following reasons:

• Your data are no longer necessary for the purposes for which they were collected or processed.
• You have withdrawn your consent for the processing of your data.
• You have exercised the right of objection.
• Your data have been unlawfully processed.
• Your data must be deleted to comply with a legal obligation.

Right to Restriction of Processing:

You may request us to exercise this right in any of the following cases:

• When you contest the accuracy of your data, for a period that allows the controller to verify the accuracy of the data.
• When the processing is unlawful and you oppose the deletion of your data and request the restriction of their use instead.
• When we no longer need the data for the purposes of processing, but you require them for the establishment, exercise, or defense of legal claims.
• When you have objected to processing under Article 21(1), pending verification of whether the legitimate grounds of the controller override yours.

Right to Data Portability:

This refers to the right to receive your data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and to transmit those data to another controller.

Right Not to be Subject to Automated Decision-Making:

Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

To exercise any of your rights, you must submit a written request to our entity either by postal mail to: Pza. Legión Española, 2, 46010 Valencia, or by email to: aloha@hoala.es, indicating the rights you wish to exercise, accompanied by a copy of your ID card or equivalent document so that we can identify you and your contact details to send you our response. If you act on behalf of another person, you must provide proof of their representation.

If you wish to submit a suggestion or query regarding the processing of your personal data, you can contact our data protection consultants:

BUSINESS ADAPTER, S.L.

Ronda Guglielmo Marconi, 11, 26, (Parque Tecnológico) 46980 Paterna (Valencia).

Interest Party Attention Form

Please note that you have the right to lodge a complaint with the Spanish Data Protection Agency at: C/ Jorge Juan, 6, 28001 Madrid or at www.aepd.es.

12. Commitment to Personal Data Protection

Scope of Application

Our commitment to personal data protection is binding for all departments and employees of our entity, as well as for those third parties acting on our behalf.

Purpose

We have established protocols for the processing of your personal data, in accordance with European and Spanish data protection regulations.

Principles

We will process your data lawfully, fairly, and transparently, with data minimization, accuracy, limited retention, integrity, confidentiality, and accountability.

Special Categories of Data

Our entity prohibits the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, or data concerning sex life or sexual orientation, except in legally authorized exceptions and with the prior consent of the data subject.

Rights of Data Subjects

Our entity will promptly and diligently address and respond to your requests to exercise your rights.

Record of Processing Activities, Impact Assessment, and Security Measures

Our entity maintains a record of processing activities and analyzes the purposes of processing, categories of data subjects and data, recipients, international transfers, retention periods, etc., to assess the risks of processing and implement necessary security measures to ensure the confidentiality, integrity, and availability of personal data.

Furthermore, the necessity of conducting a Data Protection Impact Assessment for each processing activity has been analyzed, and if required, the designation of a Data Protection Officer, ensuring that the appointed person meets the sufficient knowledge and experience as required by current regulations.

Monitoring

We receive external assistance to advise us on this matter, monitoring all publications made by competent supervisory authorities and other European and Spanish entities related to data protection regulations, in order to comply with this legislation at all times.

13. Updating of this Policy

Our entity reserves the right to modify this Policy without prior notice. Therefore, we recommend consulting it each time you visit our website.

Text updated on July 4, 2024.