The Data Controller is PLAIN CONCEPTS, S.L.U. (A company belonging to the PLAIN CONCEPTS Group) with CIF: B24532178 and registered office at C/ Gran Vía Don Diego López de Haro, 1º, 8ª planta, 48001 Bilbao (Vizcaya), Spain.

If you have any questions regarding the processing of your personal data, do not understand or need the translation of this Privacy Policy into another language, you can contact us at the address gdpr@plainconcepts.com.

We also inform you that PLAIN CONCEPTS has a designated Data Protection Officer (hereinafter DPO), who can be contacted at the address dpo@leasba.com.

In this Privacy Policy, “personal data” means any information that identifies you or can be used to identify you.

The personal data processed by PLAIN CONCEPTS are:

1. Those that you provide to us by filling in the forms you fill in or through the different email accounts that are made available to you on the website for contacting PLAIN CONCEPTS.
2. Those that you provide us with for your registration in the Newsletter service. PLAIN CONCEPTS will only process the personal data necessary to fulfill the purposes of registration of the service. This data is your name and email address.
3. Those that you may provide in each of the forms where your personal data are collected. (For example: Job offers, Events or Whistleblowing Channel). In each of these forms you will find specific information on the data required, the purposes for which they will be used, the third parties to whom, if applicable, they may be transferred, the legitimacy of the processing, etc.

PLAIN CONCEPTS will process your personal data for the following purposes:

1. Answer and attend to any queries or request you may have.
2. Manage your subscription to the Plain Concepts Newsletter, and therefore, send you by electronic means information of interest about congresses, events, projects, activities, news, and any other information of interest about PLAIN CONCEPTS.
3. To answer your request to apply for a job position and to carry out the necessary steps for the processing of your application (in this case, the Privacy Policy that you will accept before sending your application will be applicable).
4. To send commercial communications.
5. To use them for any other purpose required or permitted by applicable legislation or when you have given your express consent.

The legal bases pursuant to Article 6 of the GDPR for the processing of your personal data are as follows:

1. Consent of the data subject (you) (Art. 6.1.a GDPR): For the processing of your personal data when subscribing to the Newsletter and to respond to queries or requests that you may make, the legal basis that legitimizes the processing is your consent that you are giving when accepting this Privacy Policy or the consent that you are giving when contacting us and,  therefore, the need for such processing to attend and respond to the query or request for information that you make to us.
2. Compliance with a legal obligation (Art. 6.1.c GDPR): Some processing of your personal data may be processed in compliance with current legal obligations that apply to PLAIN CONCEPTS. When this happens, you will be informed of the details of the processing, as well as the rule that requires the specific processing.
3. Legitimate interest of PLAIN CONCEPTS (Art. 6.1.f GDPR): PLAIN CONCEPTS may have a legitimate interest in processing your data, to analyse the usability of the website, as well as your degree of satisfaction, as this may be of benefit to you.

Your personal data may be transferred to the following groups:

1. Service suppliers: If necessary, PLAIN CONCEPTS may transfer your personal data to the appropriate suppliers for the development and execution of the purposes of the processing. In these cases, PLAIN CONCEPTS, as the data controller, has signed the confidentiality and data processing contracts required by current regulations.
2. Companies belonging to the PLAIN CONCEPTS Group: There is the possibility that your data may be transferred to one of the companies of the Group, for internal administration purposes or to provide specific services necessary for the development and execution of the processing.

Data will be kept as long as the interested party does not exercise their right of deletion or for the time necessary to maintain the purpose of the processing. However, the data will be kept for the corresponding period to comply with legal obligations, during the applicable limitation periods to meet possible liabilities arising during processing. In this case, the data will be kept duly blocked until the limitation period for any legal liabilities associated with the processing has elapsed.   In the event that they are removed, it will be carried out by applying the appropriate security measures to guarantee their total destruction.

It is possible that in order to send the Newsletter, manage your requests, collect data from forms and emails, it is necessary to transfer some data to non-European countries (which you consent to by accepting this Policy) such as the USA, etc. USA, for which there is an adequacy decision by the European Commission (EU- USA Data Privacy Framework Decision of 10 July 2023).

In particular, data transfers to third countries may occur when using the services of the provider HubSpot, S.L. HubSpot may, in accordance with its Privacy Policy, transfer information to other subsidiaries of the Group and external entities that provide services to it on a contractual basis. However, this company has incorporated Standard Contractual Clauses (SCC) in the contracts signed between the parties, approved by the European Commission, which allow secure processing and in accordance with the current regulation on data protection. In addition, HubSpot will take additional measures as appropriate, such as implementing commercially standard secure encryption methods to protect personal data at rest and in transit, TLS on HubSpot-hosted sites, and firewalls to protect web applications, as well as other relevant contractual and organizational measures.

Some of the companies in the PLAIN CONCEPTS group are located outside the European Economic Area, which entails an international transfer of data. Specifically, to the following group companies:

• PLAIN CONCEPTS CORP INC. (United States of America): The US has an adequate level of protection for personal data, as there is an adequacy decision by the European Commission (EU- USA Data Privacy Framework Decision of 10 July 2023).
• PLAIN CONCEPTS UK LTD (United Kingdom): The guarantee for this international transfer of data is based on the existence of an Adequacy Decision of the European Commission: Commission Implementing Decision (EU) 2021/1773 of 28 June 2021

The data subject (you) can exercise their rights under current data protection legislation. Specifically:

• Right of access to your personal data: You have the right to obtain confirmation from the controller as to which of your personal data is being processed or not and whether an international transfer of your personal data is taking place.
• Right to rectification of the wrong or inaccurate data: You have the right to obtain without undue delay from the controller the rectification of inaccurate personal data concerning you. Considering the purposes of the processing, you have the right to have incomplete personal data completed for you, including by means of an additional statement.
• Right of deletion or cancellation: You have the right to obtain erasure of your personal data without undue delay where:

1. The data are no longer necessary in relation to the purpose for which it was collected.
2. The data are out of date.
3. The consent is withdrawn by the interested party. This withdrawal of consent shall not affect the lawfulness of the processing that has been previously carried out on the basis of the corresponding legitimation.
4. The data have been used unlawfully.

• Right to data portability: you have the right to have the controller transmit your data to another controller, which will be done in a structured format that is commonly used and machine-readable when the processing is carried out by automated means.
• Right to restriction of the processing: in certain circumstances, you may request the restriction of the processing of your data, in which case the data will only be kept for the purpose of pursuing or defending claims.
• Right to object: You may object to the processing of your personal data in certain circumstances and for reasons relating to your particular situation. In this case, PLAIN CONCEPTS will stop processing both personal data, except in those cases in which there is an overriding legitimate interest or the exercise or defense of possible claims.

The interested party may exercise their rights by sending an email to the gdpr@plainconcepts.com address, indicating the reason for their request and the right they wish to exercise. If we consider it necessary, because there are reasonable doubts as to whether we can identify you, we may ask you to copy a document proving your identity. You can also send a communication to the Data Protection Officer by sending an email to dpo@leasba.com.

In those cases in which you feel that your rights regarding the protection of your personal data have been violated, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the Data Protection Supervisory Authority, specifically the Spanish Data Protection Agency, through its website: www.aepd.es.

As the PLAIN CONCEPTS Group processes data in different EU Member States, its main point of contact may be a Supervisory Authority of another EU Member State, which can find its contact details at the following link: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.

PLAIN CONCEPTS websites may contain links to other websites, which we may consider to be useful to you. However, PLAIN CONCEPTS is not responsible for the content published on such websites, nor for their Privacy Policies.  PLAIN CONCEPTS encourages you to carefully review the Privacy Policy before using these websites to ensure that you are satisfied with the information that is collected.

This website is not directed to minors in accordance with applicable current legislation. Parents, guardians or legal representatives will be solely responsible for all acts carried out on this website by the minors in their care, including the completion of the forms with the personal data of said minors and the ticking, where appropriate, of the boxes that accompany them.

PLAIN CONCEPTS applies all the security measures required by the regulations on the protection of personal data, with the aim of protecting your rights and freedoms. PLAIN CONCEPTS implements the necessary measures to guarantee the confidentiality of the personal data of all persons under its responsibility.

PLAIN CONCEPTS reserves the right to modify or update this Privacy Policy at any time. In the event that any clause of this Privacy Policy is annulled or considered null and void, the rest of the conditions will not be affected, and will fully retain their validity and validity, in accordance with the regulations in force applicable at all times.

This website may use Cookies. For more information, please consult our Cookies Policy.

The Data Controller, as manager of the selection process, is PLAIN CONCEPTS, S.L.U. (a company belonging to the Plain Concepts Group) with CIF: B24532178 and registered office at C/ Gran Vía Don Diego Lopez de Haro, 1º, 8º planta, 48001 Bilbao (Vizcaya), Spain.

PLAIN CONCEPTS, S.L.U. manages the selection process of its own candidatures and of the following companies of the PLAIN CONCEPTS Business Group:

If you have any questions about who is responsible for your data, you can send an inquiry to the email address: gdpr@plainconcepts.com.  

PLAIN CONCEPTS has a Data Protection Officer (DPO), whom you can contact by sending an email to dpo@leasba.com in order to resolve any questions regarding this Privacy Policy.

The personal data processed by PLAIN CONCEPTS comes from the interested party, who provides them in the registration form of the corresponding job offer.

The personal data that are processed by PLAIN CONCEPTS are:

• Curriculum Vitae
• First and Last Name.
• Email Address.
• Phone Number.
• Any other personal data that the data subject may enter or attach in the registration form.

PLAIN CONCEPTS may request and process additional data, in the event that you pass the selection process, such as: identity and/or social security number and/or passport, bank details, family data, etc. In addition, PLAIN CONCEPTS may request or process any personal data that is necessary to complete the selection process, depending on the legal obligations in force in the country where the Group Company that has the vacancy is open is located.

If you do not provide us with the personal data requested, we may not be able to register you as a job candidate, manage your participation in the selection processes, respond to your application, comply with our legal obligations and manage our activity.

We ask you to update your personal data as they change, and always provide truthful information, since we must have your current information.

Your personal information will be processed for the following purposes:

1. Managing the selection process for which you apply
2. If you pass the selection process, the additional data requested or processed by PLAIN CONCEPTS will be used to prepare all necessary administrative arrangements prior to employment
3. Their inclusion in a database of potential candidates (job bank).
4. Inviting you to participate in selection processes that match your professional profile.

The legal basis for processing your data is:

1. The consent, which you grant by accepting this Policy (Article 6.1.a GDPR), for the purposes set out in letters c) and d) of the previous point.
2. For the execution of a contract to which the data subject is a party or for the application at the request of the latter of pre-contractual measures (Article 6.1.b GDPR), for the purposes set out in letters a) and b) of the previous point.

Personal data will be communicated to the following recipients:

1. Companies belonging to the PLAIN CONCEPTS Group: personal data may be communicated, in certain cases, to some or all of the companies that are part of the Group for the purpose of managing different aspects of the selection process. Some of the companies in the group are located outside the European Economic Area (EEA), which entails an international transfer of data, which is discussed in detail in point six (6) of this Policy.
2. Organizations or people directly related to PLAIN CONCEPTS: for needs for business or professional collaboration or contracting of services for the management of the selection process (Suppliers). With all those organizations, companies or people with whom a relationship is established that involves the communication of personal data, the mandatory Data Processing Contract will be signed where the obligations in terms of security and purposes of the processing are specified.

Specifically:

• Workable

PLAIN CONCEPTS uses Workable as a provider for the management of the selection process. Workable Software Limited operates in this case as a data processor/processor and will process your data in accordance with the provisions of its terms of use which can be found at the following link: https://www.workable.com/terms.

As an integral part of this Policy, additional information regarding the processing of your personal data when using the Workable service is added. This information can be found as Annex 1 to this document.

• Factorial

Once the selection process has been completed and if you have been selected, your data will be transferred to the Human Resources management platform “FACTORIAL” owned by EVERYDAY SOFTWARE, S.L. Once the employment relationship with you has been formalised, the Employee Privacy Policy will apply.

Transfers to third countries are envisaged in the following cases:

1. Organizations or persons directly related to PLAIN CONCEPTS: If any of these companies, organizations or persons are located in countries outside the EEA that do not have sufficient and adequate data protection safeguards or there is no adequacy decision and this poses a risk to the privacy of personal data, PLAIN CONCEPTS will ensure that it has the appropriate measures in place and that it signs the Standard Contractual Clauses (SCCs) in accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 OF 4 JUNE 2021, so that your data is protected at all times in terms identical or similar to those provided for in European regulations.

1. PLAIN CONCEPTS Group Subsidiaries outside the EEA: Data transfers to subsidiaries located in third countries are carried out for collaboration and management purposes among the different Group companies.

Therefore, international data transfers are planned to the following companies in the Group:

− PLAIN CONCEPTS CORP INC. (United States of America): The US has an adequate level of protection for personal data, as there is an adequacy decision by the European Commission (EU- USA Data Privacy Framework Decision of 10 July 2023).

− PLAIN CONCEPTS UK LTD (United Kingdom): The guarantee for this international transfer of data is based on the existence of an Adequacy Decision of the European Commission: Commission Implementing Decision (EU) 2021/1773 of 28 June 2021.

1. WORKABLE Platform:

Workable reports: 

Data that we collect from you and process using the Workable Services may be transferred to and stored at a destination outside of the United Kingdom or the European Economic Area (“EEA”). They may also be processed by staff operating outside the UK or EEA who work for us or for one of our suppliers. Such staff may be involved in, among other things, the fulfilment of your orders, the processing of your payment details and the provision of support services. By submitting your personal data, you consent to this transfer, storage or processing.

In particular, your data may be accessible to i) Workable staff in the USA or ii) Workable hosting service provider, which may store it on servers in the USA as well as in the EU. The United States has an adequate level of protection for personal data, as there is an adequacy decision by the European Commission (EU- USA Data Privacy Framework Decision of 10 July 2023).

A Data Processor Agreement has been entered into between Workable Software Limited and its overseas group companies, and between Workable Software Limited and each of its data processors. These data processor agreements are designed to help safeguard your privacy rights and provide you with remedies in the unlikely event of misuse of your personal data.

For more information:

• You can consult the following link: https://www.workable.com/terms.
• Or send an inquiry to the following email address: support@workable.com.

Transfers to third countries are foreseen in the following cases: 

1. PLAIN CONCEPTS Group subsidiaries outside the EEA: Data transfers to subsidiaries located in third countries are carried out for collaboration and management purposes among the different Group companies. 

Therefore, international data transfers are foreseen to the following Group companies: 

• PLAIN CONCEPTS CORP (USA). The guarantee for this international data transfer is based on the necessity of the performance of a contract between the data subject and the data controller (Article 49.1.b of the GDPR). 
•  PLAIN CONCEPTS UK LTD (United Kingdom). The guarantee for this international data transfer is based on the existence of an Adequacy Decision by the Commission dated 28 June 2021. 

1. WORKABLE Platform:  

Workable states: 

The data we collect from you and process using the Workable Services may be transferred to and stored at a destination outside the United Kingdom or the European Economic Area (“EEA”). It may also be processed by staff operating outside the United Kingdom or the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, fulfilling your orders, processing your payment details, and providing support services. By submitting your personal data, you agree to this transfer, storing, or processing. 

In particular, your data may be accessible to i) Workable staff in the United States, or ii) Workable’s hosting service provider may store it on servers in the United States as well as the EU. The United States does not have the same data protection laws as the United Kingdom and the EEA. A Data Processing Agreement has been signed between Workable Software Limited and its overseas group companies, and between Workable Software Limited and each of its data processors. These Data Processing Agreements are designed to help safeguard your privacy rights and provide you with remedies in the unlikely event of misuse of your personal data. 

If you would like more information, please contact us (see ‘Contact’ below). Otherwise, we will not transfer your personal data outside the United Kingdom or the EEA or to any organization (or subordinated bodies) governed by public international law or established under any agreement between two or more countries. 

For more information: 

• You can visit the following link: https://www.workable.com/terms 
• Or you can send an inquiry to the following email address: support@workable.com 

Your data will be stored in the system for a period of 12 months. After this period, your personal data will be deleted. However, this timeframe may be extended if there are any updates to your data or any interaction with the candidate takes place. 

The data subject can exercise the rights granted to them by current data protection regulations, including: 

• Right of access to personal data: The data subject has the right to obtain confirmation from the data controller as to whether their personal data is being processed, transferred to a third country, or to an international organization. 
• Right to rectification of inaccurate or incorrect data: The data subject has the right to obtain without undue delay the rectification of inaccurate personal data concerning them. Considering the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by providing an additional statement. 
•  Right to erasure or cancellation: The data subject has the right to obtain the erasure of their personal data without undue delay when: 

1. The data is no longer necessary for the purposes for which it was collected. 

1. The data is outdated. 

1. The data subject withdraws their consent, and this withdrawal does not affect the lawfulness of the previous processing. 

1. The data has been unlawfully processed. 

• Right to data portability: The data subject has the right to have their data transmitted to another data controller, in a structured, commonly used, and machine-readable format, where the processing is carried out by automated means. 
•  Right to restriction of processing: In certain circumstances, the data subject can request the restriction of the processing of their data, in which case it will only be retained for the exercise or defense of legal claims. 

•  Right to object: to the processing of personal data in certain circumstances and for reasons related to their particular situation. In this case, PLAIN CONCEPTS will cease to process such personal data, except for compelling legitimate grounds or the exercise or defense of potential legal claims. 

The data subject can exercise their rights by sending an email to gdpr@plainconcepts.com  indicating the reason for their request and the right they wish to exercise. If necessary to identify the data subject, a copy of an identification document may be requested. Alternatively, a communication can be addressed to the Data Protection Officer by sending an email to dpo@leasba.com  

In cases where the data subject feels that their rights regarding the protection of their personal data have been violated, especially when they have not obtained satisfaction in the exercise of their rights, they can lodge a complaint with the Data Protection Authority, specifically the Spanish Data Protection Agency, through their website: www.aepd.es  

As Plain Concepts processes data in different EU member states, the primary point of contact may be a Data Protection Authority of another EU member state, whose contact information can be found at the following link: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm  

In the case of the United Kingdom, if you wish to obtain more information about each of your rights, including the circumstances in which they apply, please refer to the Guide from the Information Commissioner’s Office (ICO) of the United Kingdom on individuals’ rights under the General Data Protection Regulation. The supervisory authority in the UK is the Information Commissioner, who can be contacted at http://ico.org.uk/concerns/  or by phone: +44303-123-1113. 

PLAIN CONCEPTS S.L.U. (Company belonging to the Plain Concepts Group) with VAT number: B24532178 and registered address at C/ Gran Vía Don Diego Lopez Haro 1 8º (Bilbao) – Spain. (Hereinafter, PLAIN CONCEPTS) is committed to protecting and respecting your privacy. This Privacy Notice (part of the Candidate Privacy Policy) sets out the basis on which we will process personal data collected from you, or that you provide to us, in relation to our hiring processes. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. For the purposes of the General Data Protection Regulation (“GDPR”), the Data Controller is PLAIN CONCEPTS. 

We use Workable, an online application provided by Workable Software Limited, to assist with our hiring process. We use Workable as a data processor to handle personal information on our behalf. Workable is only authorized to process your personal data in accordance with the instructions given by PLAIN CONCEPTS. When you apply for a job vacancy posted by PLAIN CONCEPTS, the provisions of this Privacy Notice will apply to our processing of your personal information in addition to our separate “Recruitment Privacy Policy.” 

Your Personal Information Information  

Information we collect from you: 

We collect and process some or all of the following types of information about you:  

• Information you provide when applying for a position. This includes information provided through an online job site, via email, in-person interviews, and/or any other method. In particular, we process personal data such as your name, email address, address, phone number, date of birth, qualifications, experience, information related to your employment history, skills experience you provide, as well as your video if you conduct your interview using the Video Interview feature.  
• If you contact us, we may keep a record of that correspondence.  

• A record of your progress through any hiring process we may conduct. 
• Details of your visits to the Workable website, including but not limited to traffic data, location data, weblogs, and other communication data, the site that referred you to the Workable website, and the resources you access. 

Information we collect from other sources:  

Workable provides us with the ability to link the data you provide to us with other publicly available information about you that may be posted on the internet, including sources such as LinkedIn and other social media profiles.  

Workable’s technology allows us to search multiple databases, some of which are publicly available and others that are not, which may include your personal data (including your CV or resume) in order to find potential candidates to fill our vacancies. When we find you in this way, we obtain your personal data from these sources.  

We may receive your personal data from a third party who recommends you as a candidate for a specific job opportunity or for our business in general. 

Legitimization: 

• Legal basis for processing.  
• We rely on legitimate interest as the legal basis upon which we collect and use your personal data. Our legitimate interests are in hiring personnel for our business. 

Processing Purposes  

We use the information we have about you in the following ways:  

• To consider your application for a specific role you have applied for.  
• To consider your application for other roles.  
• To communicate with you regarding the hiring process. 
• To enhance any information, we receive from you with information obtained from third-party data providers.  

• To find suitable candidates to fill our job vacancies.  
• To assist our service providers (such as Workable and its processors and data providers) and partners (such as job sites through which you have submitted your application) in improving their services. 

Decision Making/Automated Profiling: 

We may use Workable’s technology to select suitable candidates for consideration based on criteria explicitly identified by us or typical for the position you have applied for. The process of searching for suitable candidates is automated; however, any decision regarding whom we will hire to fill the vacant position will be made by our staff. 

Disclosure of your information: 

As stated above, we may share your information with our external service providers, including Workable, who will use it only in accordance with our instructions and as required by law. If you have applied for a job through another service provider, we may disclose similar data to the aforementioned Provision Data to such service provider. The service provider will be the data controller for this data and will therefore be responsible for complying with all applicable laws regarding the use of that data after we transfer it. 

How we store your personal data 

• Security:  

We take appropriate measures to ensure that all personal data is kept secure, including security measures to prevent personal data from being accidentally lost, used, or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data breach. We will notify you and any applicable regulator of a suspected data breach where we are legally required to do so. Unfortunately, the transmission of information over the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted through any online means; therefore, any transmission is at your own risk. 

• Where we store your personal data:  

When we store your personal data on our own systems, it is stored within the EEA. The data we collect from you and process using Workable’s Services may be transferred and stored at a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, fulfilling your orders, processing your payment details, and providing support services. By submitting your personal data, you agree to this transfer, storing, or processing. In particular, your data may be accessible to i) Workable staff in the USA, or ii) Workable’s hosting service provider may store it on servers in the USA as well as in the EU. The USA does not have the same data protection laws as the UK and EEA. A Data Processor Agreement has been entered into between Workable Software Limited and its overseas group companies, and between Workable Software Limited and each of its data processors. These Data Processor Agreements are designed to help safeguard your privacy rights and provide you with remedies in the unlikely event of misuse of your personal data.  

If you would like more information, please contact us (see ‘Contact’ below). Otherwise, we will not transfer your personal data outside of the UK or EEA or to any organization (or subordinate bodies) governed by public international law or which is set up under any agreement between two or more countries. 

The Data Controller of your data is the company of the Plain Concepts Group with which you have a contractual relationship and whose data appears in the contractual documentation.

Company name Registered office

Plain Global Solutions S.L. C/ Gran Vía Don Diego Lopez de Haro, 1-8º – 48001 – Bilbao – VIZCAYA.

Plain Concepts S.L.U. C/ Gran Vía Don Diego Lopez de Haro, 1-8º – 48001 – Bilbao – VIZCAYA.

Plain Concepts UK LTD Delta Place, 27 Bath Road, Cheltenham, Gloucestershire GL53 7TH (U.K.).

Plain Concepts Corporation INC 8201 164th Ave Ne, Redmond, WA 98052 (USA).

Plain Concepts GmbH c/o KRIEGER GmbH Steuerberatungsgesellschaft, Berliner Straße 51, 60311 Frankfurt am Main (Germany).

Plain Concepts RO S.R.L. Bucureşti Sectorul 1, Calea VICTORIEI, Nr. 145, MODUL 1.25, Etaj 1, Cod poștal 10072 (Romania).

In the contracting carried out by Plain Concepts UK LDT, Plain Concepts Corporation INC, Plain Concepts GmbH or Plain Concepts RO S.R.L., Plain Concepts S.L.U. will act as joint controller.

If you have any questions about who is responsible for your data, you can send an inquiry to the email address: gdpr@plainconcepts.com.

PLAIN CONCEPTS has a Data Protection Officer (DPO), who you can contact by sending an email to dpo@leasba.com in order to resolve any questions regarding this Privacy Policy.

The personal data processed by PLAIN CONCEPTS comes from the interested party, who provides them during the registration process in the Register of Suppliers and, where appropriate, throughout the contracting process and throughout the period of development of the contractual relationship.

The personal data that are processed by PLAIN CONCEPTS are:

• Identification data: name and surname, postal and email address, telephone number, NIF/DNI/NIE, passport or any other similar identity document and signature.
• Commercial data or conditions: services provided, activities and business and, where applicable, commercial licenses.
• Data relating to transactions of goods and services: financial transactions, compensation, etc.
• Bank details: such as, for example: account number.
• Employment data: in the event that you are a natural person who provides services for our legal entity Suppliers, PLAIN CONCEPTS may process, in addition to your contact details, data relating to the function or position performed.

If you do not provide us with the personal data requested, it is likely that we will not be able to register you in the Register of Suppliers, comply with the contractual relationship, manage the activity and comply with legal obligations.

Likewise, PLAIN CONCEPTS, in accordance with its internal procedure for managing suppliers and potential suppliers and in compliance with the established guidelines on risk management, may obtain information from third parties.

The personal data that is requested and collected by PLAIN CONCEPTS is strictly necessary to comply with the following purposes:

1. Participation in the supplier qualification and selection process within the framework of its risk management standards and procedures.
2. Periodic verification of compliance with all the requirements required to be a Supplier of PLAIN CONCEPTS, as well as the appropriate economic and financial situation.
3. Management of the contractual relationship with suppliers in all its aspects.
4. Internal management and communication between the Group’s organizations on matters relating to supplier relations.
5. Administrative, collection and payment management.
6. Sending commercial communications related to sustainability, ethics and compliance.
7. Comply with legal obligations and requirements from government and judicial bodies.

The legal basis for processing your data is different depending on the purpose for which the data is intended:

• Performance of a contract (art. 6.1 b) GDPR): for the purposes of paragraphs a), b), c) and e), standing is based on the performance of a contract to which you are a party or for the application of pre-contractual measures, in particular in the case of the qualification and selection process of suppliers.
• Compliance with legal obligations (art. 6.1.c) GDPR): for the purposes of section g), the legitimacy is based on compliance with the legal obligations imposed on PLAIN CONCEPTS.
• Legitimate interest of the controller (art. 6.1 f) GDPR): the legitimacy for the purpose set out in section d), is based on the legitimate interest of PLAIN CONCEPTS in the management of the present and future relationship with you as a representative of a supplier, legal person or contact person, or as a natural person.
• Consent of the interested party (art. 6.1.a) GDPR): the legitimacy for the purpose set out in section f), is based on the consent granted by you for the sending of commercial communications.

By virtue of legitimate interest and in accordance with Recital 48 GDPR, all entities that are part of the PLAIN CONCEPTS Group may communicate data with each other for internal administrative purposes, supplier control, relationship management and risk management.

The personal data of you, a natural person or representative or contact person in the case of a legal person, may be communicated to third parties and relevant bodies when necessary for the fulfilment of the purposes set out above.

Specifically, the data will be communicated to:

• Public records.
• Tax Administration.
• Other Public Administration bodies.
• Banks/Savings Banks.
• Insurance companies.
• Suppliers of products and services.
• PLAIN CONCEPTS Group companies: Some of the group companies are located outside the European Economic Area (EEA), which entails an international transfer of data, which will be detailed in point 6 referring to international transfers.

In the processing of personal data relating to the management of suppliers, transfers to third countries are foreseen, in particular to:

1. PLAIN CONCEPTS GROUP COMPANIES OUTSIDE THE EEA: the transfer of data to subsidiaries located in third countries is carried out for the purpose of collaboration between the different companies of the Group, administration, execution and development of projects for the provision of services to customers.

The personal data that are subject to transfer are only the personal identification and professional data that are essential for internal administrative purposes, supplier control, relationship management and risk management.

Therefore, international data transfers are planned to the following companies in the Group:

• PLAIN CONCEPTS CORP INC. (United States of America): The US has an adequate level of protection for personal data, as there is an adequacy decision by the European Commission (EU- USA Data Privacy Framework Decision of 10 July 2023).
• PLAIN CONCEPTS UK LTD (United Kingdom): The guarantee for this international transfer of data is based on the existence of an Adequacy Decision of the European Commission: Commission Implementing Decision (EU) 2021/1773 of 28 June 2021.

PLAIN CONCEPTS will keep your personal data for the duration of the current commercial relationship. In addition, for the sending of commercial communications, they will be maintained as long as you do not withdraw your consent to them. This, without prejudice to the conservation of the data during the period established to comply with the legally established obligations and to deal with possible claims that may arise in relation to the processing of the data. During this period of time, the data will be kept duly blocked.

The data subject (you) can exercise their rights under current data protection legislation. Specifically:

• Right of access to your personal data: You have the right to obtain confirmation from the controller as to which of your personal data is being processed or not and whether an international transfer of your personal data is taking place.
• Right to rectification of inaccurate or erroneous data: You have the right to obtain without undue delay from the controller the rectification of inaccurate personal data concerning you. Considering the purposes of the processing, you have the right to have incomplete personal data completed for you, including by means of an additional statement.
• Right of deletion or cancellation: You have the right to obtain erasure of your personal data without undue delay where:

1. The personal data is no longer necessary in relation to the purpose for which it was collected.
2. The data is out of date.
3. The consent is withdrawn by the interested party. This withdrawal of consent will not affect the lawfulness of the processing that has been previously carried out on the basis of the corresponding legitimation.
4. The data have been used unlawfully.

• Right to data portability: you have the right to have the controller transmit your data to another controller, which will be done in a structured format that is commonly used and machine-readable when the processing is carried out by automated means.
• Right to restriction of processing: in certain circumstances, you may request the limitation of the processing of your data, in which case it will only be kept duly blocked for the exercise or defence of claims.
• Right to object: You may object to the processing of your personal data in certain circumstances and for reasons relating to your particular situation. In this case, PLAIN CONCEPTS will cease to process any personal data, except in those cases in which there is a compelling legitimate interest or the exercise or defence of possible claims.

The interested party may exercise their rights by sending an email to the gdpr@plainconcepts.com address, indicating the reason for their request and the right they wish to exercise. If we consider it necessary, because there are reasonable doubts as to whether we can identify you, we may ask you to copy a document proving your identity. You can also send a communication to the Data Protection Officer by sending an email to dpo@leasba.com.

In those cases in which you feel that your rights regarding the protection of your personal data have been violated, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the Data Protection Supervisory Authority, specifically the Spanish Data Protection Agency, through its website: www.aepd.es.

As the PLAIN CONCEPTS Group processes data in different EU Member States, your main point of contact may be a Supervisory Authority of another EU Member State, which can find your contact details at the following link: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

PLAIN CONCEPTS applies all the security measures required by the regulations on the protection of personal data, with the aim of protecting your rights and freedoms. PLAIN CONCEPTS applies the necessary measures to guarantee the confidentiality of the personal data of all people under its responsibility.

PLAIN CONCEPTS reserves the right to modify or update this Privacy Policy at any time. In the event that any clause of this Privacy Policy is annulled or considered null and void, the rest of the conditions will not be affected, and will fully retain their validity and validity, in accordance with the regulations in force applicable at all times.