Privacy policy

Data controller

The data controller is INDEX PRODUCCIONES, S.L., Font de la Uxola 4, 03803 Alcoy (Alicante), Spain.

Privacy principles

At INDEX PRODUCCIONES, S.L. we are committed to working continuously to guarantee privacy in the processing of your personal data, and to giving you the most complete and clear information we can at all times. We encourage you to read this section carefully before giving us your personal data.

If you are under fourteen years of age, please do not give us your data without your parents’ consent.

This section explains how we process the data of the people who have a relationship with our organisation. Starting with our principles:

We do not ask for personal information unless it is necessary to provide the services you request from us.
We never share personal information with anyone, except to comply with the law or when we have your express authorisation.
We will never use your personal data for purposes other than those stated in this privacy policy.
Your data will always be processed with a level of protection appropriate to data protection legislation, and we will not subject it to automated decision-making.

This privacy policy has been drafted taking into account the requirements of current data protection legislation:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons (GDPR).
Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPD).
Spanish Royal Decree 1720/2007 of 21 December (RLOPD).

We may amend this privacy policy when processing criteria change, to make it easier to understand or to adapt it to current legislation. We recommend that you check it regularly.

Processing activities

Suppliers

Legal basis: GDPR 6.1(b): processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
GDPR 6.1(c): processing is necessary for compliance with a legal obligation to which the controller is subject.
Royal Legislative Decree 2/2015 of 23 October, approving the consolidated text of the Workers’ Statute.
Law 58/2003 of 17 December, the General Tax Law.
Purposes of processing: Purchase of the products and/or services we need to carry out our activity.
Monitoring of subcontractors where applicable.
Data subjects: Suppliers.
Employees of our suppliers.
Categories of data: Name and surname, national ID/tax ID/identity document, address, signature and telephone number.
Employment details: job position. Occupational safety training.
Financial and insurance data: bank details.
Categories of recipients: Financial institutions (payment of invoices).
Spanish Tax Agency (Agencia Estatal de Administración Tributaria).
International transfers: No international transfers of the data are planned.
Retention period: The data will be kept for as long as necessary to fulfil the purpose for which it was collected and to determine any liability that may arise from that purpose and from the processing of the data, in accordance with Law 58/2003 of 17 December, the General Tax Law.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, the General Data Protection Regulation.

Clients

Legal basis: GDPR 6.1(a): the data subject has given consent to the processing of their personal data for one or more specific purposes.
GDPR 6.1(b): processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
GDPR 6.1(c): processing is necessary for compliance with a legal obligation to which the controller is subject.
Royal Legislative Decree 2/2015 of 23 October, approving the consolidated text of the Workers’ Statute.
Law 58/2003 of 17 December, the General Tax Law.
Purposes of processing: Supply of our products / services.
Data subjects: Clients.
Categories of data: Name and surname, national ID/tax ID/identity document, address, signature and telephone number.
Financial and insurance data: bank details.
Categories of recipients: Financial institutions.
Spanish Tax Agency (Agencia Estatal de Administración Tributaria).
International transfers: No international transfers of the data are planned.
Retention period: The data will be kept for as long as necessary to fulfil the purpose for which it was collected and to determine any liability that may arise from that purpose and from the processing of the data, in accordance with Law 58/2003 of 17 December, the General Tax Law.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, the General Data Protection Regulation.

Contacts

Legal basis: Consent of the data subject.
Purposes of processing: To handle your request, send you information and follow up on the request.
Data subjects: Contact persons, clients, suppliers.
Categories of data: Name and surname, telephone number, email address.
Categories of recipients: No disclosure of data to third parties is envisaged.
International transfers: No international transfers of the data are planned.
Retention period: Contact data will be kept for as long as necessary to fulfil the purpose for which it was collected or until the data subject withdraws their consent.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, the General Data Protection Regulation.

Candidates in recruitment processes (HR)

Legal basis: GDPR 6.1(b): processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Purposes of processing: Staff selection and filling of job positions.
Data subjects: Candidates who apply for job positions.
Categories of data: Name and surname, national ID/tax ID/identity document, staff registration number, address, signature and telephone number.
Special categories of data: health data (disabilities).
Personal characteristics: sex, marital status, nationality, age, date and place of birth and family details.
Academic and professional data: qualifications, training and professional experience.
Employment details.
Categories of recipients: No disclosure of data to third parties is envisaged.
International transfers: No international transfers of the data are planned.
Retention period: The data will be kept for as long as necessary to fulfil the purpose for which it was collected and to determine any liability that may arise from that purpose and from the processing of the data.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, the General Data Protection Regulation.

Employees

Legal basis: GDPR 6.1(b): processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
GDPR 6.1(c): processing is necessary for compliance with a legal obligation to which the controller is subject.
Royal Legislative Decree 2/2015 of 23 October, approving the consolidated text of the Workers’ Statute.
Purposes of processing: Management of employed staff.
Personnel file. Working-time records. Training. Pension plans. Occupational risk prevention.
Payroll.
Management of trade union activity.
Data subjects: Employees.
Categories of data: Name and surname, national ID/tax ID/identity document, staff registration number, Social Security/mutual insurance number, address, signature and telephone number.
Special categories of data: health data (sick leave, occupational accidents and degree of disability, without diagnoses), trade union membership solely for the payment of union dues (where applicable), union representative (where applicable), attendance certificates of the employee and of third parties.
Personal characteristics: sex, marital status, nationality, age, date and place of birth and family details. Family circumstances: start and end dates, leave, permits and authorisations.
Academic and professional data: qualifications, training and professional experience.
Employment and career details. Incompatibilities.
Attendance records: date/time of arrival and departure, reason for absence.
Financial data: payroll data, credits, loans, guarantees, tax deductions, salary reduction from a previous position (where applicable), court-ordered withholdings (where applicable), other withholdings (where applicable). Bank details.
Categories of recipients: The entity entrusted with occupational risk prevention.
Spanish Social Security Treasury (Tesorería General de la Seguridad Social).
Trade union organisations.
Financial institutions.
Spanish Tax Agency (Agencia Estatal de Administración Tributaria).
Main contractors for whom we provide services as subcontractors.
International transfers: No international transfers of the data are planned.
Retention period: The data will be kept for as long as necessary to fulfil the purpose for which it was collected and to determine any liability that may arise from that purpose and from the processing of the data. The financial data of this processing activity will be kept under the provisions of Law 58/2003 of 17 December, the General Tax Law.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, the General Data Protection Regulation.

Handling of data subject rights requests

Legal basis: GDPR 6.1(c): processing is necessary for compliance with a legal obligation to which the controller is subject.
General Data Protection Regulation.
Purposes of processing: To handle requests to exercise the rights established by the General Data Protection Regulation: right of access, rectification, erasure, restriction, portability and objection to automated decision-making.
Data subjects: Natural persons who make a request (employees, clients, suppliers, contact persons).
Categories of data: Name and surname, address, signature and telephone number.
Categories of recipients: Personal data may be communicated to the supervisory authority (Spanish Data Protection Agency, AEPD) in the context of an investigation for the protection of rights initiated by the data subject.
International transfers: No international transfers of the data are planned.
Retention period: The data will be kept for five years from the date of the request.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, the General Data Protection Regulation.

Notification of security breaches

Legal basis: GDPR 6.1(c): processing is necessary for compliance with a legal obligation to which the controller is subject.
General Data Protection Regulation, Articles 33 and 34.
Purposes of processing: Management and assessment of security breaches occurring in our organisation.
Data subjects: Variable: employees, clients, suppliers, contact persons (depending on the security breach).
Categories of data: Variable (depending on the security breach).
Categories of recipients: Spanish Data Protection Agency (AEPD).
State law enforcement agencies.
International transfers: No international transfers of the data are planned.
Retention period: The data will be kept for as long as necessary to fulfil the purpose for which it was collected and to determine any liability that may arise from that purpose and from the processing of the data. The regulations on archives and documentation will apply.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, the General Data Protection Regulation.

Website management

Legal basis: Legitimate interest of the controller in guaranteeing the security, technical maintenance, prevention of abuse and proper functioning of the website; consent of the user for the use of non-technical cookies or similar technologies; performance of pre-contractual measures or consent for the handling of forms, depending on the nature of the request.
Purposes of processing: Management, maintenance, security and operation of the website; handling of requests received through forms; statistical analysis of browsing; measurement of advertising campaigns; conversion tracking; management of cookies and similar technologies in accordance with the cookie policy.
Data subjects: Website users, potential clients, clients, people requesting information.
Categories of data: IP address, identification data, contact details, logs, data entered in forms, online identifiers.
Categories of recipients: No disclosure of data to third parties is envisaged, except where required by law. Technology providers acting as data processors may access the data, as may, where applicable, third-party providers of cookies or similar technologies in accordance with the cookie policy.
International transfers: No international transfers are planned, except those that may arise from the use of technology providers or third-party cookie providers, which will be carried out in accordance with the guarantees provided for in the GDPR and identified in the cookie policy where applicable.
Retention period: Technical and security logs: for as long as necessary to guarantee the security and operation of the website and, where applicable, to address possible liabilities. Forms: for as long as necessary to handle the request and, thereafter, for the applicable limitation periods. Cookies and similar technologies: for the periods indicated in the cookie policy.
Security measures: HTTPS, access control, backups, WAF/CDN, data minimisation, cookie configuration, data processing agreement.

Cookies

This website does not place cookies on your device. Videos play through the Vimeo player, which loads only when you click on a piece and with the do-not-track option enabled. Visit statistics are collected without cookies and without identifying the person browsing.

Your rights

You have the right to ask us for a copy of your personal data, to rectify inaccurate data or complete it if it is incomplete, or, where applicable, to erase it when it is no longer necessary for the purposes for which it was collected.

You also have the right to restrict the processing of your personal data and to obtain your personal data in a structured, readable format.

You may object to the processing of your personal data in certain circumstances (in particular, when we do not need to process it to comply with a contractual or other legal requirement, or when the processing is for direct marketing).

Where you have given us your consent, you may withdraw it at any time. We will then stop processing your data or, where applicable, stop processing it for that specific purpose. Withdrawing your consent will not affect any processing that took place while your consent was in force.

These rights may be limited; for example, if fulfilling your request would require us to disclose data about another person, or if you ask us to delete records that we are obliged to keep by law or by a legitimate interest, such as the defence of claims. Or where the right to freedom of expression and information must prevail.

You can contact us by any of the means indicated in the Data controller section of this privacy policy, providing a copy of a document proving your identity (usually a national ID or passport).

You also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or affects you.

If your rights are infringed — for example, if we have not dealt with your request — you have the right to lodge a complaint with the data protection supervisory authority. This may be the authority of your country (if you live outside Spain) or the Spanish Data Protection Agency (AEPD) if you live in Spain.

Additional information

Links to third-party websites

Our website may occasionally contain links to other websites. It is your responsibility to read the data protection policy and legal terms that apply to each site.

Third-party data

If you give us data about third parties, you take on the responsibility of informing them beforehand, as set out in Article 14 of the GDPR.